strace Cheat Sheet

Trace system calls — see every open/read/write a process makes and find the syscall that hangs.

Troubleshooting3 sections · 18 commands
⌘K

Attaching & Basic

6
strace CMD

Trace a new process

strace -p PID

Attach to a running process

strace -p PID -o trace.log

Write output to a file

strace -T CMD

Add per-syscall timing

strace -tt CMD

Microsecond timestamps

timeout 10 strace -p PID

Trace for 10 seconds then stop

Syscall Filters

6
strace -e trace=network CMD

Only network syscalls

strace -e trace=file CMD

File opens and I/O

strace -e trace=read,write CMD

Specific syscalls

strace -e fault=openat:error=EACCES CMD

Inject an error (testing)

strace -e trace=process CMD

Process lifecycle calls

strace -e signal CMD

Only signal delivery

Children & Summation

6
strace -f CMD

Follow forks and children

strace -ff -o out CMD

One file per process

strace -c CMD

Summary of count/time per syscall

strace -c -f CMD

Summary across the whole tree

strace -f -e trace=openat CMD 2>&1 | grep ENOENT

Which file could not be opened

strace -f -e trace=connect CMD

Connection attempts only