STRACE(1) General Commands Manual STRACE(1) (NAME) strace - (SYNOPSIS) strace [-ACdffhikqqrtttTvVwxxyyYzZ] [-a column] [-b execve] [-e expr]... [-I n] [-o file] [-O overhead] [-p pid]... [-P path]... [-s strsize] [-S sortby] [-U columns] [-X format] [--seccomp-bpf] [--stack-trace-frame-limit=limit] [--syscall-limit=limit] [--tips[=format]] { -p pid | [-DDD] [-E var[=val]]... [-u username] command [args] } strace -c [-dfwzZ] [-b execve] [-e expr]... [-I n] [-O overhead] [-p pid]... [-P path]... [-S sortby] [-U columns] [--seccomp-bpf] [--syscall-limit=limit] [--tips[=format]] { -p pid | [-DDD] [-E var[=val]]... [-u username] command [args] } strace --tips[=format] strace command . . -o . strace . . . / (sanity checking) (race conditions) . . <>: open("/dev/null", O_RDONLY) = 3 -1 errno . open("/foo/bar", O_RDONLY) = -1 ENOENT (No such file or directory) siginfo . <>: sigsuspend([] --- SIGINT {si_signo=SIGINT, si_code=SI_USER, si_pid=...} --- +++ killed by SIGINT +++ strace unfinished . resumed . [pid 28772] select(4, [3], NULL, NULL, NULL [pid 28779] clock_gettime(CLOCK_REALTIME, {tv_sec=1130322148, tv_nsec=3977000}) = 0 [pid 28772] <... select resumed> ) = 1 (in [3]) ( ) . read(0, 0x7ffff72cf5cf, 1) = ? ERESTARTSYS (To be restarted) --- SIGALRM {si_signo=SIGALRM, si_code=SI_KERNEL} --- rt_sigreturn({mask=[]}) = 0 read(0, "", 1) = 0 . <<>>xyzzy>> : open("xyzzy", O_WRONLY|O_APPEND|O_CREAT, 0666) = 3 open(2) OR (bitwise- OR) mode . ANSI POSIX . strace . (dereference) . C . <> : lstat("/dev/null", {st_mode=S_IFCHR|0666, st_rdev=makedev(0x1, 0x3), ...}) = 0 struct stat . st_mode OR . lstat(2) . . <> : lstat("/foo/bar", 0xb004) = -1 ENOENT (No such file or directory) . . strace <> : syscall_0xbad(0x1, 0x2, 0x3, 0x4, 0x5, 0x6) = -1 ENOSYS (Function not implemented) C . (escape codes) C . strsize ( ) (...) . <> getpwuid(3) : read(3, "root::0:0:System Administrator:/"..., 1024) = 422 () . id(1) (supplementary group IDs) : getgroups(32, [100, 0]) = 2 . : sigprocmask(SIG_BLOCK, [CHLD TTOU], []) = 0 SIGCHLD SIGTTOU. . . (~) : sigprocmask(SIG_UNBLOCK, ~[], NULL) = 0 ..SH " (OPTIONS)" (General) -e expr (qualifying expression) . : [qualifier=][!]value[,value]... qualifier : trace ( t) trace-fds ( trace-fd fd fds) abbrev ( a) verbose ( v) raw ( x) signal ( signals s) read ( reads r) write ( writes w) fault inject status quiet ( silent silence q) decode-fds ( decode-fd) decode-pids ( decode-pid) kvm value . trace . . -e open -e trace=open open . -e trace=!open open . all none . (quoted arguments) (history expansion) . (escape ). (Startup) -E var=val --env=var=val var=val . -E var --env=var var . -p pid --attach=pid ID pid . (CTRL-C) . strace . -p -p . -p (",") (" ") . -p "$(pidof PROG)" -p "$(pgrep PROG)" . -u username --user=username ID ID username . (root) setuid / setgid . setuid setgid . -u UID:GID --user=UID:GID . . --argv0=name argv[0] name . (multi-call) argv[0] ( busybox kmod) ..SS " (Tracing)" -b syscall --detach-on=syscall . execve execve(2) execveat(2) . -f ( ) . -D --daemonize --daemonize=grandchild (tracer) () (tracee) . strace . -DD --daemonize=pgroup --daemonize=pgrp . strace strace kill(2) . -DDD --daemonize=session (session) ( << >> ). strace strace . -f --follow-forks fork(2) vfork(2) clone(2) . PID -f -p PID thread_id = PID. --output-separately --output=filename filename.pid pid . -ff --follow-forks --output-separately --follow-forks --output-separately . -c . strace-log-merge(1) . -I interruptible --interruptible=interruptible strace ( CTRL-C) . 1, anywhere 2, waiting () 3, never ( -o FILE PROG) 4, never_tstp SIGTSTP (CTRL-Z) ( strace -o FILE PROG CTRL-Z -D). --syscall-limit=limit limit . --trace --trace-path --status . --kill-on-exit ptrace PTRACE_O_EXITKILL SIGKILL . . --kill-on-exit -p/--attach ..SS " (Filtering)" -e trace=syscall_set -e t=syscall_set --trace=syscall_set . syscall_set [!]value[,value] value : syscall ( syscalls(2) NOTES ). ?value . value@64 value personality . value@32 value personality . value@x32 value personality x32 . all . /regex regex . POSIX ( regex(7) ). %file file . --trace=open,stat,chmod,unlink,... . newfstatat(2) . ("--trace=file") . %process process ( exec ) . ("--trace=process") . %net %network network . ("--trace=network") . %signal signal . ("--trace=signal") . %ipc ipc IPC . ("--trace=ipc") . %desc desc . ("--trace=desc") . %memory memory . ("--trace=memory") . %creds capability . %stat stat . %lstat lstat . %fstat fstat fstatat statx . %%stat (stat lstat fstat fstatat statx ) . %statfs statfs statfs64 statvfs osf_statfs osf_statfs64 . --trace=/^(.*_)?statv?fs . %fstatfs fstatfs fstatfs64 fstatvfs osf_fstatfs osf_fstatfs64 . --trace=/fstatv?fs . %%statfs ( statfs fstatfs ustat) . --trace=/statv?fs|fsstat|ustat . %clock . %pure . arc_gettls(2) getdtablesize(2) getegid(2) getegid32(2) geteuid(2) geteuid32(2) getgid(2) getgid32(2) getpagesize(2) getpgrp(2) getpid(2) getppid(2) get_thread_area(2) ( x86) gettid(2) get_tls(2) getuid(2) getuid32(2) getxgid(2) getxpid(2) getxuid(2) kern_features(2) metag_get_tls(2) . -c . --trace=open,close,read,write . / (user/kernel boundary) . --trace=all ..TP -e trace-fd=set -e trace-fds=set -e fd=set -e fds=set --trace-fds=set () . . --trace-path . -e signal=set -e signals=set -e s=set --signal=set . --signal=all . --signal=!SIGIO ( --signal=!io) SIGIO . -e status=set --status=set . --status=all . status . strace . strace . . select(2) select(2) clock_gettime(2) : [pid 28779] 1130322148.939977 clock_gettime(CLOCK_REALTIME, {1130322148, 939977000}) = 0 [pid 28772] 1130322148.438139 select(4, [3], NULL, NULL, NULL) = 1 (in [3]) set : successful . -z --status=successful . failed . -Z --status=failed . unfinished . execve . unavailable strace . detached strace . -P path --trace-path=path path . -P . --trace-fds . -z --successful-only . -Z --failed-only ..SS " (Output format)" -a column --columns=column ( ). -e abbrev=syscall_set -e a=syscall_set --abbrev=syscall_set . syscall_set --trace . --abbrev=all . -v --abbrev=none . -e verbose=syscall_set -e v=syscall_set --verbose=syscall_set (dereference ). syscall_set --trace . --verbose=all . -e raw=syscall_set -e x=syscall_set --raw=syscall_set . syscall_set --trace . () . . -X raw . -e read=set -e reads=set -e r=set --read=set (dump) ASCII . 3 5 --read=3,5 . read(2) --trace=read . -e write=set -e writes=set -e w=set --write=set ASCII . 3 5 --write=3,5 . write(2) --trace=write . -e quiet=set -e silent=set -e silence=set -e q=set --quiet=set --silent=set --silence=set . --quiet=none . set : attach ("[ Process NNNN attached ]" "[ Process NNNN detached ]"). exit ("+++ exited with SSS +++"). path-resolution -P ("Requested path "..." resolved into "...""). personality (personality) ("[ Process PID=NNNN runs in PPP mode. ]"). thread-execve superseded execve(2) (thread) ("+++ superseded by execve in pid NNNN +++"). -e decode-fds=set --decode-fds=set . --decode-fds=none . set : path . AT_FDCWD . socket . dev / . eventfd eventfd eventfd . pidfd (PID) pidfd . signalfd signalfd . -e decode-pids=set --decode-pids=set ( ) . --decode-pids=none . set : comm . pidns PID PID strace . -e kvm=vcpu|vcpu+ --kvm=vcpu|vcpu+ vcpu kvm (=vcpu) kvm_run (=vcpu+). 4.16.0 . vcpu+ VCPU:CPU#< VCPU:CPU#> . KVM_RUN KVM_RUN . -e namespace=new --namespace=new . : clone(2) clone3(2) setns(2) unshare(2). -i --instruction-pointer (instruction pointer) . -n --syscall-number . -N --arg-names . -k --stack-trace[=symbol] . --stack-trace-frame-limit=limit (backtrace) ( 256 ). --stack-trace ( -k) . -o filename --output=filename stderr filename . -ff filename.pid . '|' '!' (pipe) . . -ff . -A --output-append-mode -o (append mode) . --color=when . --color=auto ( stderr -o) . NO_COLOR --color=always . when auto always never . STRACE_COLORS : STRACE_COLORS="syscall=1;33:argname=39:argval=35:const=1;36:comment=36:punct=0:retval=32:error=31" key=value : SGR . (SGR 90-97) ANSI (SGR 30-37) (bold) . : syscall argname argval const comment punct retval error. -q --quiet --quiet=attach,personality (attach) (detach) personality . . -qq --quiet=attach,personality,exit personality . -qqq --quiet=all ( --quiet ). -r --relative-timestamps[=precision] . . precision s ( ) ms () us () ns () . us () . -r (monotonic clock) -t (wall clock) ..TP -s strsize --string-limit=strsize ( ). . --absolute-timestamps[=[[format:]format],[[precision:]precision]] --timestamps[=[[format:]format],[[precision:]precision]] format precision . format : none . . time (strftime(3) %T ). unix (epoch) (strftime(3) %s ). precision s ( ) ms () us () ns () . format:time,precision:s . -t --absolute-timestamps . -tt --absolute-timestamps=precision:us . -ttt --absolute-timestamps=format:unix,precision:us (epoch) . -T --syscall-times[=precision] . . precision s ( ) ms () us () ns () . us () . -v --no-abbrev environment stat termios . . . --strings-in-hex[=option] . . ( -x ) strace : ASCII ( ) . strace C : "\t" () "\n" ( ) "\v" ( ) "\f" () "\r" ( ). strace (octal) . . option : none . . non-ascii-chars . non-ascii ASCII . all . all . -x --strings-in-hex=non-ascii ASCII . -xx --strings-in-hex[=all] . -X format --const-print-style=format . format : raw . abbrev . strace . verbose ( ) . -y --decode-fds --decode-fds=path AT_FDCWD . -yy --decode-fds=all : / PID pidfd. --pidns-translation --decode-pids=pidns strace tracee PID PID strace ..TP -Y --decode-pids=comm PID . --always-show-pid PID strace . -f -o . (Statistics) -c --summary-only . ( ) (wall clock) . -c -f . -C --summary -c . -O overhead --summary-syscall-overhead=overhead (overhead) overhead . (heuristic) -c . ( time(1)) -c . overhead Time specification format description . -S sortby --summary-sort-by=sortby -c . : time ( time-percent time-total total-time) min-time ( shortest time-min) max-time ( longest time-max) avg-time ( time-avg) calls ( count) errors ( error) name ( syscall syscall-name) nothing ( none) time . -U columns --summary-columns=columns . columns : time-percent ( time) . total-time ( time-total) ( -w ) . min-time ( shortest time-min) . max-time ( longest time-max) . avg-time ( time-avg) . calls ( count) . errors ( error) . name ( syscall syscall-name) . time-percent,total-time,avg-time,calls,errors,name. name . -w --summary-wall-clock (wall clock) . ..SS " (Tampering)" --inject=syscall_set[:error=errno|:retval=value][:signal=sig] [:syscall=syscall][:delay_enter=delay][:delay_exit=delay] [:poke_enter=@argN=DATAN,@argM=DATAM...] [:poke_exit=@argN=DATAN,@argM=DATAM...][:when=expr] . syscall_set --trace . error retval signal delay_enter delay_exit poke_enter poke_exit . error retval . error=errno . -1 ( ) errno . -1 syscall= . errno ENOSYS 1..4095 . retval=value . error= value . signal=sig SIGSEGV 1..SIGRTMAX syscall_set . delay_enter=delay delay_exit=delay : (tracee) delay . delay Time specification format description . poke_enter=@argN=DATAN,@argM=DATAM... poke_exit=@argN=DATAN,@argM=DATAM... argN argM ( arg1 arg7) DATAN DATAM ( poke_enter=@arg1=0000DEAD0000BEEF) . poke_enter poke_exit . . signal= . error= . signal=sig error=errno retval=value . syscall=syscall syscall -1 . syscall (side effect) %pure . when=expr syscall_set . : first[..last][+[step]] first last step . : first first syscall_set . first..last first last ( ) syscall_set . first+ first syscall_set . first+step first first+step first+step+step syscall_set . first..last+step last ( ) . chdir ENOENT : --inject=chdir:error=ENOENT:when=3+. first step 1..65535 last 1..65534 . ( error= retval=) signal= . when= ..IP . -P /dev/urandom --inject=file:error=ENOENT. -e inject=args --inject=args . --fault=syscall_set[:error=errno][:when=expr] . --inject= errno ENOSYS . -e fault=args --fault=args . (Miscellaneous) -d --debug strace . -F . . -F -f . -f . -h --help . --seccomp-bpf seccomp-bpf ( seccomp(2)) . -f/--follow-forks . --seccomp-bpf --syscall-limit -b/--detach-on . -p/--attach . seccomp-bpf seccomp strace . seccomp-bpf strace . --seccomp-bpf -p/--attach --kill-on-exit . seccomp SECCOMP_RET_TRACE strace --seccomp-bpf . seccomp strace --seccomp-bpf . --tips[=[[id:]id],[[format:]format]] strace . id (: ). random () . format : none . . compact . full . id:random,format:compact . -V --version strace . der Strauss ..SS " (Time specification format description)" ( strtod(3) ) : s () ms () us () ns (). . -O --inject=delay_enter --inject=delay_exit . (DIAGNOSTICS) command strace . command strace strace . - ( getppid(2) ) -D . -p command strace . SETUID (SETUID INSTALLATION) strace setuid root . setuid setgid . root strace setuid root . strace 'rwsr-x---' root trace . trace . -setuid strace . (MULTIPLE PERSONALITIES SUPPORT) strace (ABI) strace . ABI (native) strace ABI : +-------------------+---------------------------------------------------+ | | ABI | +-------------------+---------------------------------------------------+ |x86_64 | i386, x32 [1]; i386 [2] | +-------------------+---------------------------------------------------+ |AArch64 | ARM 32-bit EABI | +-------------------+---------------------------------------------------+ |PowerPC 64-bit [3] | PowerPC 32-bit | +-------------------+---------------------------------------------------+ |s390x | s390 | +-------------------+---------------------------------------------------+ |SPARC 64-bit | SPARC 32-bit | +-------------------+---------------------------------------------------+ |TILE 64-bit | TILE 32-bit | +-------------------+---------------------------------------------------+ [1] strace x86_64 [2] strace x32 [3] Big endian . ABI strace strace -V . <<>> (non-native) ABI strace : m32-mpers strace . no-m32-mpers strace . mx32-mpers strace 32-on-64-bit . no-mx32-mpers strace 32-on-64-bit . m32-mpers no-m32-mpers . mx32-mpers no-mx32-mpers 32-on-64-bit ..SH " (NOTES)" . / . . . faccessat(2) flags setrlimit(2) (+2.6.38) prlimit64(2) . C . (personalities) . __NR_* . : ARM arm_fadvise64_64(2) Xtensa xtensa_fadvise64_64(2) fadvise64_64(2) . (ABI) x32 - __X32_SYSCALL_BIT x32 . strace #64 . readv(2) x86_64 x32 . -p EINTR . . strace . . strace command shebang ( #!/bin/sh) ENOEXEC . command . (BUGS) setuid ID . . --seccomp-bpf . command strace ( CTRL-C) . --kill-on-exit --seccomp-bpf --kill-on-exit . CLONE_UNTRACED clone strace . --seccomp-bpf strace seccomp ..SH " (HISTORY)" strace Paul Kranenburg SunOS trace . SunOS strace Branko Lankester . Paul 2.5 strace Branko 1.5 strace Paul . Rick Sladkey . strace 2.5 SunOS strace truss(1) SVR4 strace . Rick strace SVR4 Solaris . strace Irix ( ). strace Wichert Akkerman . strace CVS FreeBSD ( ARM IA-64 MIPS PA-RISC PowerPC s390 SPARC) . strace Roland McGrath . strace (AMD64 s390x SuperH) strace Git . strace Dmitry Levin . strace AArch64 ARC AVR32 Blackfin C-SKY LoongArch Meta Nios II OpenRISC 1000 RISC-V Tile/TileGx Xtensa . . strace (path tracing) . (stack trace) . (tampering) . NEWS strace . (REPORTING BUGS) strace strace ..SH " (SEE ALSO)" strace-log-merge(1), ltrace(1), perf-trace(1), trace-cmd(1), time(1), ptrace(2), seccomp(2), syscall(2), proc(5), signal(7) strace (AUTHORS) strace CREDITS . strace 7.0 2026-04-05 STRACE(1)