strace
Processes and system
Usage
strace [-f] -p <pid>Prints every system call a process makes, which is how you see where it is stuck; the output goes to stderr so redirect it with `2>&1`, it needs ptrace permission (usually sudo), and it is Linux only (macOS has dtruss).
Common flags
| Flag | Meaning |
|---|---|
| -p <pid> | Attach to a process that is already running. |
| -f | Follow child processes and threads too. |
| -e trace=openat,connect | Only the syscalls you care about. |
| -s 200 | Show 200 characters of each string instead of the default 32. |
| -o <file> | Write to a file, since output goes to stderr. |
| -c | A summary count per syscall instead of every line. |
| -tt | Timestamps with microseconds, to see where the time went. |
Examples
strace -f -e trace=openat ./app 2>&1 | grep configFind which config file it actually reads.
sudo strace -p 1234 -s 200See what a stuck process is waiting on.
sudo dtruss -p 1234The macOS counterpart; needs elevated privileges and often SIP changes.
What is running and what is eating the machine. Identifying it comes before killing it.
How to read this
- Square brackets [ ] mark a part you may leave out.
- An ellipsis … means you can list more than one.
- Flags are case-sensitive — in some commands -r and -R do different things.
Questions
Q. What does strace do?
Prints every system call a process makes, which is how you see where it is stuck; the output goes to stderr so redirect it with `2>&1`, it needs ptrace permission (usually sudo), and it is Linux only (macOS has dtruss).
Q. How do I type it?
strace [-f] -p <pid> — square brackets mark the parts you can leave out.
Q. How many flags are worth knowing?
7 are listed here; the full set is in man strace. This command sits under Processes and system.
Related commands
man page: man strace