Trace system calls and signals made by a process.
low risk
strace intercepts and logs every system call (open, read, write, socket, etc.) made by a process. The go-to tool for debugging 'permission denied' errors, missing files, and mysterious failures — shows exactly what the kernel sees.
| Flag | Meaning |
|---|---|
-p --attach | Attach to an already-running process by PID |
-e --expr | Filter to specific system calls |
-f --follow-forks | Follow child processes |
-o --output | Write output to file instead of stderr |
-c --summary | Print summary statistics only |
-t --timestamp | Prefix each line with timestamp |
strace -p $(pgrep nginx) -e trace=networkTrace network calls of running nginx · explain & risk-check →strace -f -e openat ls /tmp 2>&1 | grep ENOENTFind missing files a command tries to open · explain & risk-check →strace -c -p 1234Get syscall frequency summary for PID 1234 · explain & risk-check →strace -o /tmp/trace.txt myappRun app and log all syscalls to file · explain & risk-check →Use `strace -e trace=openat,read,write` to narrow output — full strace output is overwhelming; filtering to file I/O syscalls finds 80% of 'permission denied' bugs fast.
Reference text is hand-written and may be incomplete — check man strace for your version. Test destructive commands on a non-production system first.