How should strace be used on Linux?

Linux utility commands are what makes Linux such a powerful operating system, while there are plenty of commands that we can use to interact and get information about the signals and system calls, but the most used and preferred command when it comes to getting the information about the system calls and signals is the linux trace command.

It can be used for getting a diagnosis of the system, for monitoring specific processes or instruction tools of Linux. It has variety of use cases and some of these use cases are −

  • Print timestamp for each system call

  • Output line with clock time

  • Trace a running process

  • Intercept system calls

While these might be some of the use cases, there are plenty of cases where we can make use of strace.

Before making use of the strace tool, we must install it on our local machines. Please consider the different commands shown below for different operating systems to install strace tools on your local operating system.

For Ubuntu/Debian

sudo apt install strace

For CentOS/RedHat

yum install strace

For r Mac OS

brew install strace

Now once we have installed the strace, let’s consider a few examples where we will make use of the strace tool.

The first example shown below contains the command which will print the linux command system calls of your linux environment.

Just type the following command in your terminal −

sudo strace df -h


root@Vostro-15-3568:/home/# strace df -h
execve("/bin/df", ["df", "-h"], [/ 31 vars /]) = 0
brk(NULL) = 0x888000
access("/etc/", F_OK) = -1 ENOENT (No such file or directory)
access("/etc/", R_OK) = 0
open("/etc/", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
close(3) = 0

Let’s run one more example where we will get the system calls that a process makes by attaching the ID of that process.

Type the following command in your terminal −

sudo strace -p pid

Replace the pid in the above example with the process id of the process that you want to get the system calls of.


strace -p 1924


root@Vostro-15-3568:/home/# strace -p 1616
strace: Process 1616 attached
select(11, [9 10], NULL, NULL, {0, 9427}) = 0
select(11, [9 10], NULL, NULL, {0, 10000}) = 0