How does strace connect to an already running process?

strace
new_perl picture new_perl · Sep 20, 2011 · Viewed 53.3k times · Source

I do know that strace uses ptrace to do the job,

but it needs to run the target process with TRACE_ME on,

which don't apply for the case of an already running process.

how does it work on an already running process?

Answer

Prabhat Kumar Singh picture Prabhat Kumar Singh · Feb 28, 2014

strace -p <PID> ----> To attach a process to strace. "-p" option is for PID of the process.

strace -e trace=read,write -p <PID> --> By this you can also trace a process/program for an event, like read and write (in this example). So here it will print all such events that include read and write system calls by the process.

Other such examples

-e trace= network  (Trace all the network related system calls.)

-e trace=signal    (Trace all signal related system calls.)

-e trace=ipc       (Trace all IPC related system calls.)

-e trace=desc      (Trace all file descriptor related system calls.)

-e trace=memory    (Trace all memory mapping related system calls.)

and many more..

trace is one of the many options you can use with -e option.

Press Ctrl-C to abbort the tracing by strace.

Check HELP section for brief summary on strace by typing strace -h and man page for detailed info.

NOTE: A traced process runs slowly.

Related questions

How should strace be used?

A colleague once told me that the last option when everything has failed to debug on Linux was to use strace. I tried to learn the science behind this strange tool, but I am not a system admin guru and …

Read More
Systrace for Windows

I'm looking for a Windows equivalent of Systrace or at least strace. I'm aware of StraceNT, but wondering if there are any more alternatives out there. Specifically, I'm looking for a specific way to programmatically enforce system call policies, though …

Read More
How to track child process using strace?

I used strace to attach to a process briefly. The process created 90 threads. When I found the offending thread, I had to tediously search for the parent thread, then the grandparent thread, and so on all the way to the …

Read More