1、DESCRIPTIONIn the simplest case strace runs the specified command untilitexits.It intercepts and records the system calls which are called by a process and the signals which are received by a process.The name of each systemcall,its argumentsandits return value are printed on standard error or to the
2、 file specified with the -o option.strace is a useful diagnostic, instructional,debuggingtool.System administrators,diagnosticiansand trouble-shooters will find it invaluable for solving problems with programs for which the source is not readily availablesincetheydo not need to be recompiled in orde
3、r to trace them.Students, hackers and the overly-curious will find thatagreatdealcanbe learnedaboutsystemand its system calls by tracing even ordinary programs.And programmers will find that since systemcallssignalsare eventsthat happen at the user/kernel interface, a close examination of this bound
4、ary is very useful for bug isolation, sanity checking and attemptingto capture race conditions.Eachlinein the trace contains the system call name, followed by its arguments in parentheses and its return value.An example from stracing the command cat /dev/null is:open（/dev/null, O_RDONLY） = 3Errors（t
5、ypicallyreturnvalueof-1） have the errno symbol and error string appended./foo/bar, O_RDONLY） = -1 ENOENT （No such file or directory）Signals are printed as a signal symbol and a signal string.An excerptfrom stracing and interrupting the command sleep 666sigsuspend（ - SIGINT （Interrupt） -+ killed by S
6、IGINT +Argumentsareprintedin symbolic form with a passion.This example shows the shell performing xyzzy output redirection:xyzzy, O_WRONLY|O_APPEND|O_CREAT, 0666） = 3Here the three argument form of open is decoded bybreakingdowntheflagargumentintoits three bitwise-OR constituents and printing the mo
7、de value in octal by tradition.Where traditional or native usage differsfromANSI orPOSIX,the latter forms are preferred.In some cases, strace output has proven to be more readable than the source.Structure pointers are dereferenced and the members are displayedasappropriate.In all cases arguments ar
8、e formatted in the most C-like fashion possible.For example, the essence of the command ls -l /dev/nulliscaptured as:lstat（, st_mode=S_IFCHR|0666, st_rdev=makedev（1, 3）, .） = 0Noticehow the struct stat argument is dereferenced and how each member is displayed symbolically.In particular, observe hows
9、t_modememberis carefullydecodedbitwise-OR of symbolic and numeric values.Also notice in this example that the first argument to lstat is aninputtothe system call and the second argument is an output.Since output arguments are not modified if the system call fails, arguments may not alwaysbedereferen
10、ced.For example, retrying the ls -l example with a non-existent file produces the following line:, 0xb004） = -1 ENOENT （No such file or directory）In this case the porch light is on but nobody is home.Character pointers are dereferenced and printed as Cstrings.Non-printing charactersinstringsare norm
11、ally represented by ordinary C escape codes.Only the first strsize （32 by default） bytes of strings areprinted;longer stringshaveanellipsisappended following the closing quote.Here is a line from where the getpwuid library routine is readingpassword file:read（3, root:0:System Administrator:/., 1024）
12、 = 422While structures are annotated using curly braces, simple pointers and arrays are printed using square brackets with commas separating elements.Hereis an example from the command id on a system with supplementary group ids:getgroups（32, 100, 0） = 2On the other hand, bit-sets are also shown usi
13、ng square brackets but set elements are separated only by a space.Here is the shell preparing toexecute an external command:sigprocmask（SIG_BLOCK, CHLD TTOU, ） = 0secondargument is a bit-set of two signals, SIGCHLD and SIGTTOU.In some cases the bit-set is so full that printing out the unset elements
14、is more valuable.In that case, the bit-set is prefixed by a tilde like this:sigprocmask（SIG_UNBLOCK, , NULL） = 0Here the second argument represents the full set of all signals.1.调用:strace -dffhiqrtttTvxx -acolumn -eexpr . -ofile -ppid . -sstrsize -uusername command arg . strace -c -eexpr . -Ooverhea
15、d -Ssortby command arg . 2.功能:跟踪程序执行时的系统调用和所接收的信号.通常的用法是strace执行一直到commande结束.并且将所调用的系统调用的名称、参数和返回值输出到标准输出或者输出到-o指定的文件.strace是一个功能强大的调试,分析诊断工具.你将发现他是一个极好的帮手在你要调试一个无法看到源码或者源码无法在编译的程序.你将轻松的学习到一个软件是如何通过系统调用来实现他的功能的.而且作为一个程序设计师,你可以了解到在用户态和内核态是如何通过系统调用和信号来实现程序的功能的.strace的每一行输出包括系统调用名称,然后是参数和返回值.这个例子:stra
16、ce cat /dev/null他的输出会有:open（/dev/null/,O_RDONLY） = 3有错误产生时,一般会返回-1.所以会有错误标志和描述:/foor/bar/,）_RDONLY） = -1 ENOENT （no such file or directory）信号将输出喂信号标志和信号的描述.跟踪并中断这个命令/sleep 600/sigsuspend（- SIGINT （Interrupt） -+ killed by SIGINT +参数的输出有些不一致.如shell命令中的tmp/,将输出:,O_WRONLY|O_APPEND|A_CREAT,0666） = 3对于结构指
17、针,将进行适当的显示.如:ls -l /dev/null/lstat（/,st_mode=S_IFCHR|0666,st_rdev=makdev1,3,.） = 0请注意/struct stat/的声明和这里的输出.lstat的第一个参数是输入参数,而第二个参数是向外传值.当你尝试/ls -l/一个不存在的文件时,会有:lstat（/foot/ball/,0xb004） = -1 ENOENT （no such file or directory）char*将作为C的字符串类型输出.没有字符串输出时一般是char*是一个转义字符,只输出字符串的长度.当字符串过长是会使用/./省略.如在/会有一
18、个gepwuid调用读取password文件:read（3,/.,1024） = 422当参数是结构数组时,将按照简单的指针和数组输出如:getgroups（4,0,2,4,5） = 4关于bit作为参数的情形,也是使用方括号,并且用空格将每一项参数隔开.如:sigprocmask（SIG_BLOCK,CHLD TTOU,） = 0这里第二个参数代表两个信号SIGCHLD和SIGTTOU.如果bit型参数全部置位,则有如下的输出:sigprocmask（SIG_UNBLOCK,NULL） = 0这里第二个参数全部置位.3.参数说明:-c统计每一系统调用的所执行的时间,次数和出错的次数等.-d输
19、出strace关于标准错误的调试信息.-f跟踪由fork调用所产生的子进程.-ff如果提供-o filename,则所有进程的跟踪结果输出到相应的filename.pid中,pid是各进程的进程号.-F尝试跟踪vfork调用.在-f时,vfork不被跟踪.-h输出简要的帮助信息.-i输出系统调用的入口指针.-q禁止输出关于脱离的消息.-r打印出相对时间关于,每一个系统调用.-t在输出中的每一行前加上时间信息.-tt在输出中的每一行前加上时间信息,微秒级.-ttt微秒级输出,以秒了表示时间.-T显示每一调用所耗的时间.-v输出所有的系统调用.一些调用关于环境变量,状态,输入输出等调用由于使用频繁
20、,默认不输出.-V输出strace的版本信息.-x以十六进制形式输出非标准字符串-xx所有字符串以十六进制形式输出.-a column设置返回值的输出位置.默认为40.-e expr指定一个表达式,用来控制如何跟踪.格式如下:qualifier=!value1,value2.qualifier只能是trace,abbrev,verbose,raw,signal,read,write其中之一.value是用来限定的符号或数字.默认的qualifier是trace.感叹号是否定符号.例如:-eopen等价于-e trace=open,表示只跟踪open调用.而-etrace!=open表示跟踪除了
21、open以外的其他调用.有两个特殊的符号allnone.注意有些shell使用!来执行历史记录里的命令,所以要使用/.-e trace=set只跟踪指定的系统调用.例如:-e trace=open,close,rean,write表示只跟踪这四个系统调用.默认的为set=all.-e trace=file只跟踪有关文件操作的系统调用.-e trace=process只跟踪有关进程控制的系统调用.-e trace=network跟踪与网络有关的所有系统调用.-e strace=signal跟踪所有与系统信号有关的系统调用-e trace=ipc跟踪所有与进程通讯有关的系统调用-e abbrev=
22、set设定strace输出的系统调用的结果集.-v等与abbrev=none.默认为abbrev=all.-e raw=set将指定的系统调用的参数以十六进制显示.-e signal=set指定跟踪的系统信号.默认为all.如signal=!SIGIO（或者signal=!io）,表示不跟踪SIGIO信号.-e read=set输出从指定文件中读出的数据.例如:-e read=3,5-e write=set输出写入到指定文件中的数据.-o filename将strace的输出写入文件filename-p pid跟踪指定的进程pid.-s strsize指定输出的字符串的最大长度.默认为32.文
23、件名一直全部输出.-u username以username的UID和GID执行被跟踪的命令.4.示例rootrac1 u01# strace cat /dev/nullexecve（/bin/cat, cat, , /* 32 vars */） = 0brk（0）= 0x9052000mmap2（NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0） = 0xb7f8f000access（/etc/ld.so.preload, R_OK）= -1 ENOENT （No such file or directory）
24、/u01/app/oracle/product/10.2.0/db_1/lib/tls/i686/sse2/libc.so.6stat64（/u01/app/oracle/product/10.2.0/db_1/lib/tls/i686/sse2, 0xbfdb8218） = -1 ENOENT （No such file or directory）/u01/app/oracle/product/10.2.0/db_1/lib/tls/i686/libc.so.6/u01/app/oracle/product/10.2.0/db_1/lib/tls/i686/u01/app/oracle/product/10.2.0/db_1/lib/tls/sse2/libc.so.6/u01/app/oracle/product/10.2.0/db_1/lib/tls/sse2/u01/app/oracle/product/10.2.0/db_1/lib/tls/l
