strace

strace

概述

strace是一个集诊断、调试、统计于一体的工具。使用该工具可以跟踪进程执行时的系统调用和所接收的信号。当进程需要访问硬件设备时，必须由用户态模式切换至内核态模式，通过系统调用访问硬件设备。

strace的最简单的用法就是执行一个指定的命令，在指定的命令执行结束后即退出。在命令执行的过程中，strace会记录和解析命令进程的所有系统调用，以及该进程所接收到的所有的信号值。

命令介绍

在终端界面，执行man 1 strace命令，可查看其他更多参数及其含义

STRACE(1) General Commands Manual STRACE(1) NAME strace - trace system calls and signals SYNOPSIS strace [-Adffhikqrtttvxxy[ IT l [bexecve] [-e exrl..aolu o file -s strsize [-x fornat [-P pathl.. [-p pid]...-p pid |[-D][-E var[=yal]]...[-u username] command [args]} strace-c[-df][-In] [-bexecve][-eexpr]...[-0 overhead] [-S sortby] [-P path]...[-pid]...(-p pid | [-D] [-E var[=val]]...[-u username] command [args]} DESCRIPTION In the simplest case strace runsthe specified command until it exits.It intercepts and records the system calls which are called by a process and the signals which are received by a process.The name of each system call,its arguments and its return value are printed on standard error or to the file specified with the -o option. straceisasefuldagnostic,instructional,and debugging tool.System administrators,diagnosticians and trouble- shooters will find it invaluable for solving prob lems with programs for which the source is not readily available since they donot need to be recompiled in order to trace them.tudents,hackers and the overly-curious will find that a great deal can be learned abouta system and its system calls by tracing even ordinary programs. And programmers wil find that since system calls and signals are events that happen at the user/kernel interface,a close examination of th1s boundaryis veryuseful for bug isolation,sanity checking and attempting to capture race conditions. Each Line in the trace contains the system call name,followed by its arguments in parentheses and its return value An example from stracing the command "cat/dev/null"is: open("/dev/null",0_RDONLY)=3 Errors (typically a return value of -1) have the errno symbol and error string appended. open("/foo/bar",0_RDONLY)=-1 ENOENT (No such file or directory) Signalsare printed as signal symbol and decoded siginfo structure.An excerpt from stracing and interrupting the com- mand"sleep 666"is: sigsuspend([] <unfinished... SIGINT {si_signo=SIGINT,si_code=S_USER,si_pid=..}…--- +++ killed by SIGINT +++ Ifa system call is being executed and meanwhileanother one is being called from a different thread/process then strace will try to preserve the order of those events and mark the ongoing call as being unfinished. when the call returns it will be marked as resumed.)

### 功能测试

跟踪ls命令的系统调用情况。

```bash
[root@localhost man]# strace /bin/ls
execve("/bin/ls",["/bin/ls"],xfffff9ce3530/*31 vars*/)=0
brk (NULL)
=Oxaaaaecac0000
faccessat(AT_FDCWD,"/etc/ld.so.preload",R_0K)=-1 ENOENT(没有那个文件或目录)
mmap(NULL,78271,PROT_READ,MAP_PRIVATE,3,0)=0xfffde43a0000
close(3)
=0
read(3,"/7ELF/2/70/0/o//orore/e/0/370/27/0i0//0am/0/0/0/0/0/0.....832)=832
mmap(NULL,271752,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_DENYWRITE,3,)=Oxfffde4350000
map(exfffde4380000,131072,PRREAD|PRT WRITE,MAPPRVATE|MAP FIXED|MAP DENYWRTE,3,x20000)=xfffde438000
close(3)
0
read(3,"/17ELF/2//0/0/0/0/00/003/0/2670e/0P/26/00//00/"...32)=832
mmap(NULL,131392,PROT_READ|PROT_EXEC, MAP_ PRIVATE|MAP_DENYWRITE,3,0)=0xfffde4320000
close(3)
0
read(3,"\177ELF\2)21\30\0\0\00\\03\0\2670\00\0\240@2\0\00"...,832)=832
close(3)
=0
openat(AT_FDCWD,"/lib64/libpcre2-8.so.0",0_RDONLY|0_CLOEXEC)=3
read(3,"/177ELF\2/0000/000/03/0/267/0000/200#0/00/0/0"....832)=832
mmap(NULL,590280,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_DENYWRITE,3,)=0xfffde40foo00
mmap(exfffde4170000,131072,PRT_READ|PROT_WRTE,MAP_PRVATE|MAP_FIXED|MAP_DENYWRITE,3,x70000)=xfffde417000
close(3)
0
read(3,"/177ELF/2)000/00030/2670000/0200/0"...832)=832
mmap (NULL,131168,PROT_READ|PROTEXEC, MAP_PRIVATE|MAP_DENYWRITE,3,)= Gxfffde40c0000
mmap(exfffde40d000, 131072,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE,3,0)=Oxfffde40do000
close(3)
0
read(3,"/177ELF/2)2/1/30/000/00/0/03/0/260008t00/00"...832
```=832
=0
mmap(NULL,213336,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_DENYWRITE,3,)=Oxfffde4080000
mmap(0xfffde40a0000,131072,PRTREAD|PROTWRITE,MAP PRVATE|MAP_FIXED|MAP DENYWRITE,3,x10000)=xfffde40a000)