strace · ltrace in Practice — Tracing System Calls and Library Calls

sudo apt install -y strace    # Ubuntu / Debian

# Trace a program as it runs
strace ls /tmp

# Trace a running process (PID)
sudo strace -p 1234

# Also trace child processes
sudo strace -f -p 1234

# Summary of system call statistics (-c)
strace -c ls /tmp

# Trace only specific system calls
strace -e trace=open,read,write ls /tmp

# Print timestamps
strace -t ls /tmp              # Absolute time
strace -r ls /tmp              # Relative time (interval between calls)

# Trace files being opened
strace -e trace=openat,open,read,write,close ls /tmp 2>&1 | grep open

# Practical pattern: find config file locations
strace -e trace=openat nginx 2>&1 | grep ".conf"

# See which files are being read
strace -e trace=openat python3 myapp.py 2>&1 | grep -v "No such file"

# Write output to a separate file
strace -o trace.log -p 1234

# Network-related calls only
strace -e trace=network curl https://example.com

# Diagnose why connect failed
strace -e trace=connect,socket myapp 2>&1 | grep -E "connect|ECONNREFUSED|ETIMEDOUT"

# Check received data size
strace -e trace=read,write -s 1024 curl https://example.com 2>&1 | grep "read("

# Call count and time statistics per system call
strace -c -p 1234

# Example output
# % time     seconds  usecs/call     calls    errors syscall
# -------  -----------  ----------  --------  -------- -------
#  45.23    0.002345         12      195           read
#  32.11    0.001667          8      208           write
#  12.05    0.000625          6      104   42      openat   ← lots of errors

# Find slow system calls
strace -T -p 1234 2>&1 | awk -F'<' '{if($2+0 > 0.01) print}' | head -20

# When a program exits unexpectedly — check signals
strace -e trace=signal -p 1234

# Find the cause of Permission denied
strace -e trace=openat,access myapp 2>&1 | grep "EACCES|EPERM"

# Suspected deadlock — check blocked system calls
sudo strace -p 1234        # If it's stuck, this shows which call is blocking

# Trace which programs are executed via execve
strace -e trace=execve -f bash myscript.sh 2>&1 | grep execve

sudo apt install -y ltrace

# Trace library calls
ltrace ls /tmp

# Specific functions only
ltrace -e malloc,free myapp

# Summary statistics
ltrace -c myapp

# Combined with strace (system calls + library calls)
ltrace -S myapp 2>&1 | head -50