Strace 是一個(gè)用於Linux 的診斷、調(diào)試和教學(xué)工具，它通過攔截程序運(yùn)行時(shí)的系統(tǒng)調(diào)用並輸出詳細(xì)信息來幫助分析問題。其核心原理是利用ptrace() 系統(tǒng)調(diào)用控制目標(biāo)進(jìn)程，並在每次系統(tǒng)調(diào)用時(shí)暫停進(jìn)程以記錄調(diào)用細(xì)節(jié)。常見用途包括調(diào)試應(yīng)用程序、識(shí)別依賴、性能分析和安全審計(jì)。典型場(chǎng)景如定位配置文件打開失敗、網(wǎng)絡(luò)連接阻塞或內(nèi)存映射錯(cuò)誤。使用時(shí)可採(cǎi)用strace -f mycommand 啟動(dòng)新進(jìn)程，或用strace -p PID 附加到已有進(jìn)程；常用選項(xiàng)包括-o 輸出到文件、-tt 添加時(shí)間戳、-T 顯示調(diào)用耗時(shí)、-s 增加字符串顯示長(zhǎng)度，以及-e trace=xxx 指定追蹤的系統(tǒng)調(diào)用類型。需要注意的是，strace 會(huì)帶來性能開銷，不適合在生產(chǎn)環(huán)境中長(zhǎng)期運(yùn)行。

Strace is a powerful diagnostic, debugging, and instructional tool for Linux. It lets you see what system calls a program is making while it runs — which can be super helpful when trying to understand why something isn't working as expected.

What Happens When You Run strace

When you run a program with strace, it attaches to that process and intercepts all the system calls it makes. These include things like opening files, reading from or writing to sockets, memory allocations, and more. Strace then prints out each call, along with its arguments and return values.

This works by using the ptrace() system call under the hood — a special interface provided by the Linux kernel that allows one process (like strace) to control another (like your application). So every time the traced process tries to make a system call, the kernel pauses it and hands control over to strace so it can log what's happening.

You'll typically see output like this:

 execve("./myprogram", ["./myprogram"], 0x7fffec13c020) = 0
brk(NULL) = 0x55d6e9a0d000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3

Each line shows the system call name, the arguments passed, and the result.

Common Use Cases for Strace

• Debugging applications : If a program crashes or hangs without clear logs, strace helps pinpoint where it's getting stuck.
• Understanding dependencies : You can see which files or libraries a program opens at runtime.
• Performance analysis : Spot slow operations like repeated disk reads or network calls.
• Security audits : Check if a binary is accessing unexpected files or resources.

Some typical scenarios include:

• A script fails to open a config file — strace shows it's looking in the wrong directory.
• A network app hangs — strace reveals it's waiting on a socket connection that never comes.
• A binary segfaults — strace might show it's failing to mmap memory properly.

How to Use Strace Effectively

Start simple:
strace -f mycommand
The -f flag tells strace to follow forks, which is important because many programs spawn child processes.

If you're dealing with an already running process, use:
strace -p PID
That attaches strace to the process ID you specify.

Other useful flags:

• -o filename : Save output to a file instead of printing to screen.
• -tt : Add timestamps to each line.
• -T : Show how much time was spent in each system call.
• -s : Increase the string size displayed (default is short, sometimes not enough).

For example, to trace a long-running service and save output:

 strace -f -o debug.log -p 1234

One thing to keep in mind: strace adds overhead. Programs will run slower under tracing, especially if they make lots of system calls. So don't rely on it in performance-critical environments unless you really need to dig deep.

Also, some system calls are easy to miss if you're not filtering correctly. That's where options like -e trace=open,read,write come in handy — you can focus only on specific calls relevant to your issue.

基本上就這些。 Once you get used to reading the output and knowing which flags to reach for, strace becomes a go-to tool for figuring out what's really going on behind the scenes.

以上是Strace命令如何工作？的詳細(xì)內(nèi)容。更多資訊請(qǐng)關(guān)注PHP中文網(wǎng)其他相關(guān)文章！