{"id":21552,"date":"2014-09-04T13:00:00","date_gmt":"2014-09-04T18:00:00","guid":{"rendered":"http:\/\/blog.cpanel.net\/?p=21552"},"modified":"2014-09-04T13:00:00","modified_gmt":"2014-09-04T18:00:00","slug":"starting-with-strace","status":"publish","type":"post","link":"https:\/\/devel.www.cpanel.net\/blog\/tips-and-tricks\/starting-with-strace\/","title":{"rendered":"Starting with Strace"},"content":{"rendered":"

What is strace?<\/h2>\n

Strace is a \u201csystem call trace\u201d program. It attaches to a process and tracks system calls and signals made to and from it (and possibly it\u2019s children). There are limitations to strace, some of which are detailed below. However, strace can be a very valuable tool for determining the root cause of many issues. This post only covers very basic usage of strace. The example used here can be done using jailshell.<\/p>\n

<\/p>\n

What is a process?<\/h3>\n

For the purposes of this tutorial, a process is a unique instance of program being run, identified on the system by a unique process identifier (pid). For more information see http:\/\/www.linfo.org\/process.html<\/a> and http:\/\/en.wikipedia.org\/wiki\/Process_identifier<\/a><\/p>\n

What is a system call?<\/h3>\n

A system call is how a program requests that the operating system kernel perform a task for it. There are quite a few \u201cnormal\u201d tasks that the operating system kernel does for programs regularly, including extremely common file operations like reading and writing. More information regarding system calls can be found at: http:\/\/en.wikipedia.org\/wiki\/System_call<\/a><\/p>\n

What information can strace capture? Not capture?<\/h3>\n

Strace can tell you<\/p>\n