strace 用法
strace 命令
用途：打印 STREAMS 跟踪消息。
语法：strace [ mid sid level ] ...
描述：没有参数的 strace 命令将所有的驱动程序和模块中的所有 STREAMS 事件跟踪消息写到它的标准输出中。 这些消息是从 STREAMS 日志驱动程序中获取的。如果提供参数，它们必须是在三元组中。每个三元组表明跟踪消息要从给定的模块或驱动程序、子标识（通常表明次要设备）以及优先级别 等于或小于给定级别的模块或驱动程序中接收。all 标记可由任何成员使用，以表明对该属性没有限制。
参数：mid---指定 STREAMS 模块的标识号 sid---指定子标识号 level----指定跟踪优先级别
输出格式：每个跟踪消息输出的格式是：
跟踪序列号
消息时间（格式为 hh:mm:ss）
系统启动后，以机器滴答信号表示消息的时间
跟踪优先级别
有以下值之一：
E
消息也在错误日志中
F
表示一个致命错误
N
邮件已发送给系统管理员
源的模块标识号
源的子标识号
跟踪消息的格式化文本
在多处理器系统上， 由两部分组成：消息所有者发送处的处理器号码，格式化文本本身。
一旦启动，strace 命令将继续执行，直到用户终止该命令。
注：由于性能的考虑，所以一次只允许一个 strace 命令来打开 STREAMS 日志驱动程序。
日志驱动程序有一个三元组的列表（该列表在命令调用中指定），并且程序会根据该列表比较每个潜在的跟踪消息，以决定是否要格式化和发送这个信息到 strace 进程中。因此，长的三元组列表会对 STREAMS 的总体性能的影响更大。 运行 strace 命令对于某些模块和驱动程序（生成要发送给 strace 进程的跟踪消息的模块和驱动程序）的定时的影响最大。 如果跟踪消息生成过快，以至 strace 进程无法处理，那么就会丢失一些消息。 最后的情况可以通过检查跟踪消息输出上的序列号来确定。
示例
要输出模块标识为 41 的模块或驱动程序中的所有跟踪消息，请输入：
strace 41 all all
要输出模块标识为 41，子标识为 0、1 或 2 的模块或驱动程序中的跟踪消息:
strace 41 0 1 41 1 1 41 2 0
子标识为 0 和 1 的模块或驱动程序中的消息必须具有小于或等于 1 的跟踪级别。子标识为 2 的模块或驱动程序中的消息必须具有跟踪级别 0。
strace: option requires an argument -- e
usage: strace [-dffhiqrtttTvVxx] [-a column] [-e expr] ... [-o file]
[-p pid] ... [-s strsize] [-u username] [-E var=val] ...
[command [arg ...]]
or: strace -c [-e expr] ... [-O overhead] [-S sortby] [-E var=val] ...
[command [arg ...]]
-c -- count time, calls, and errors for each syscall and report summary
-f -- follow forks, -ff -- with output into separate files
-F -- attempt to follow vforks, -h -- print help message
-i -- print instruction pointer at time of syscall
-q -- suppress messages about attaching, detaching, etc.
-r -- print relative timestamp, -t -- absolute timestamp, -tt -- with usecs
-T -- print time spent in each syscall, -V -- print version
-v -- verbose mode: print unabbreviated argv, stat, termio[s], etc. args
-x -- print non-ascii strings in hex, -xx -- print all strings in hex
-a column -- alignment COLUMN for printing syscall results (default 40)
-e expr -- a qualifying expression: option=[!]all or option=[!]val1[,val2]...
options: trace, abbrev, verbose, raw, signal, read, or write
-o file -- send trace output to FILE instead of stderr
-O overhead -- set overhead for tracing syscalls to OVERHEAD usecs
-p pid -- trace process with process id PID, may be repeated
-s strsize -- limit length of print strings to STRSIZE chars (default 32)
-S sortby -- sort syscall counts by: time, calls, name, nothing (default time)
-u username -- run command as username handling setuid and/or setgid
-E var=val -- put var=val in the environment for command
-E var -- remove var from the environment for command
strace - 跟踪系统调用和信号
usage: strace [-dffhiqrtttTvVxx] [-a column] [-e expr] [-o file]
[-p pid] [-s strsize] [-u username] [command [arg]]
strace -c [-e expr] [-O overhead] [-S sortby] [command [arg]]
-a column
指定显示返回值的列位置，默认是40(从0开始计数)，就是说"="出现在40列的位
置。
-c 产生类似下面的统计信息
strace -c -p 14653 (Ctrl-C)
% time seconds usecs/call calls errors syscall
------ ----------- ----------- --------- --------- ----------------
53.99 0.012987 3247 4 2 wait4
42.16 0.010140 2028 5 read
1.78 0.000429 61 7 write
0.76 0.000184 10 18 ioctl
0.50 0.000121 2 52 rt_sigprocmask
0.48 0.000115 58 2 fork
0.18 0.000043 2 18 rt_sigaction
0.06 0.000014 14 1 1 stat
0.03 0.000008 4 2 sigreturn
0.02 0.000006 2 3 time
0.02 0.000006 3 2 1 setpgid
------ ----------- ----------- --------- --------- ----------------
100.00 0.024053 114 4 total
-d 输出一些strace自身的调试信息到标准输出
strace -c -p 14653 -d (Ctrl-C)
[wait(0x137f) = 14653]
pid 14653 stopped, [SIGSTOP]
[wait(0x57f) = 14653]
pid 14653 stopped, [SIGTRAP]
cleanup: looking at pid 14653
% time seconds usecs/call calls errors syscall
------ ----------- ----------- --------- --------- ----------------
------ ----------- ----------- --------- --------- ----------------
100.00 0.000000 0 total
-e expr
A qualifying expression which modifies which events to trace or how to trace
them. The format of the expression is:
[qualifier=][!]value1[,value2]...
这里qualifier可以是trace、abbrev、verbose、raw、signal、read或者write。
value是qualifier相关的符号或数值。缺省qualifier是trace。!表示取反。
-eopen等价于-e trace=open，表示只跟踪open系统调用。-etrace=!open意思是
跟踪除open系统调用之外的其他所有系统调用。此外value还可以取值all和none。
某些shell用!表示重复历史指令，此时可能需要引号、转义符号(/)的帮助。
-e trace=set
只跟踪指定的系统调用列表。决定跟踪哪些系统调用时，-c选项很有用。
trace=open,close,read,write意即只跟踪这四种系统调用，缺省是trace=all
-e trace=file
跟踪以指定文件名做参数的所有系统调用。
-e trace=process
Trace all system calls which involve process management. This is
useful for watching the fork, wait, and exec steps of a process.
-e trace=network
跟踪所有和网络相关的系统调用
-e trace=signal
Trace all signal related system calls.
-e trace=ipc
Trace all IPC related system calls.
-e abbrev=set
Abbreviate the output from printing each member of large structures.
缺省是abbrev=all，-v选项等价于abbrev=none
-e verbose=set
Dereference structures for the specified set of system calls.
The default is verbose=all.
-e raw=set
Print raw, undecoded arguments for the specifed set of system calls.
This option has the effect of causing all arguments to be printed in
hexadecimal. This is mostly useful if you don"t trust the decoding or
you need to know the actual numeric value of an argument.
-e signal=set
只跟踪指定的信号列表，缺省是signal=all。signal=!SIGIO (or signal=!io)
导致 SIGIO 信号不被跟踪
-e read=set
Perform a full hexadecimal and ASCII dump of all the data read from
file descriptors listed in the specified set. For example, to see all
input activity on file descriptors 3 and 5 use -e read=3,5. Note that
this is independent from the normal tracing of the read(2) system call
which is controlled by the option -e trace=read.
-e write=set
Perform a full hexadecimal and ASCII dump of all the data written to
file descriptors listed in the specified set. For example, to see all
output activity on file descriptors 3 and 5 use -e write=3,5. Note
that this is independent from the normal tracing of the write(2)
system call which is controlled by the option -e trace=write.
-f
follow forks，跟随子进程？
Trace child processes as they are created by currently traced
processes as a result of the fork(2) system call. The new process
is attached to as soon as its pid is known (through the return value
of fork(2) in the parent process). This means that such children may
run uncontrolled for a while (especially in the case of a vfork(2)),
until the parent is scheduled again to complete its (v)fork(2)
call. If the parent process decides to wait(2) for a child that is
currently being traced, it is suspended until an appropriate child
process either terminates or incurs a signal that would cause it to
terminate (as determined from the child"s current signal disposition).
意思应该是说跟踪某个进程时，如果发生fork()调用，则选择跟踪子进程
可以参考gdb的set follow-fork-mode设置
-F
attempt to follow vforks
(On SunOS 4.x, this is accomplished with some dynamic linking trickery.
On Linux, it requires some kernel functionality not yet in the
standard kernel.) Otherwise, vforks will not be followed even if -f
has been given.
类似-f选项
-ff
如果-o file选项有效指定，则跟踪过程中新产生的其他相关进程的信息分别写
入file.pid，这里pid是各个进程号。
-h
显示帮助信息
-i
显示发生系统调用时的IP寄存器值
strace -p 14653 -i
-o filename
指定保存strace输出信息的文件，默认使用标准错误输出stderr
Use filename.pid if -ff is used. If the argument begins with `|" or
with `!" then the rest of the argument is treated as a command and all
output is piped to it. This is convenient for piping the debugging
output to a program without affecting the redirections of executed
programs.
-O overhead
Set the overhead for tracing system calls to overhead microseconds.
This is useful for overriding the default heuristic for guessing how
much time is spent in mere measuring when timing system calls using
the -c option. The acuracy of the heuristic can be gauged by timing
a given program run without tracing (using time(1)) and comparing
the accumulated system call time to the total produced using -c.
好象是用于确定哪些系统调用耗时多
-p pid
指定待跟踪的进程号，可以用Ctrl-C终止这种跟踪而被跟踪进程继续运行。可以
指定多达32个-p参数同时进行跟踪。
比如 strace -ff -o output -p 14653 -p 14117
-q
Suppress messages about attaching, detaching etc. This happens
automatically when output is redirected to a file and the command is
run directly instead of attaching.
-r
Print a relative timestamp upon entry to each system call. This
records the time difference between the beginning of successive
system calls.
strace -p 14653 -i -r
-s strsize
指定字符串最大显示长度，默认32。但文件名总是显示完整。
-S sortby
Sort the output of the histogram printed by the -c option by the
specified critereon. Legal values are time, calls, name, and nothing
(default time).
-t
与-r选项类似，只不过-r采用相对时间戳，-t采用绝对时间戳(当前时钟)
-tt
与-t类似，绝对时间戳中包含微秒
-ttt
If given thrice, the time printed will include the microseconds and
the leading portion will be printed as the number of seconds since
the epoch.
-T
这个选项显示单个系统调用耗时
-u username
用指定用户的UID、GID以及辅助组身份运行待跟踪程序
-v
冗余显示模式
Print unabbreviated versions of environment, stat, termios, etc. calls.
These structures are very common in calls and so the default behavior
displays a reasonable subset of structure members. Use this option to
get all of the gory details.
-V
显示strace版本信息
-x 以16进制字符串格式显示非ascii码，比如"/x08"，默认采用8进制，比如"/10"
-xx 以16进制字符串格式显示所有字节
用途：打印 STREAMS 跟踪消息。
语法：strace [ mid sid level ] ...
描述：没有参数的 strace 命令将所有的驱动程序和模块中的所有 STREAMS 事件跟踪消息写到它的标准输出中。 这些消息是从 STREAMS 日志驱动程序中获取的。如果提供参数，它们必须是在三元组中。每个三元组表明跟踪消息要从给定的模块或驱动程序、子标识（通常表明次要设备）以及优先级别 等于或小于给定级别的模块或驱动程序中接收。all 标记可由任何成员使用，以表明对该属性没有限制。
参数：mid---指定 STREAMS 模块的标识号 sid---指定子标识号 level----指定跟踪优先级别
输出格式：每个跟踪消息输出的格式是：
跟踪序列号
消息时间（格式为 hh:mm:ss）
系统启动后，以机器滴答信号表示消息的时间
跟踪优先级别
有以下值之一：
E
消息也在错误日志中
F
表示一个致命错误
N
邮件已发送给系统管理员
源的模块标识号
源的子标识号
跟踪消息的格式化文本
在多处理器系统上， 由两部分组成：消息所有者发送处的处理器号码，格式化文本本身。
一旦启动，strace 命令将继续执行，直到用户终止该命令。
注：由于性能的考虑，所以一次只允许一个 strace 命令来打开 STREAMS 日志驱动程序。
日志驱动程序有一个三元组的列表（该列表在命令调用中指定），并且程序会根据该列表比较每个潜在的跟踪消息，以决定是否要格式化和发送这个信息到 strace 进程中。因此，长的三元组列表会对 STREAMS 的总体性能的影响更大。 运行 strace 命令对于某些模块和驱动程序（生成要发送给 strace 进程的跟踪消息的模块和驱动程序）的定时的影响最大。 如果跟踪消息生成过快，以至 strace 进程无法处理，那么就会丢失一些消息。 最后的情况可以通过检查跟踪消息输出上的序列号来确定。
示例
要输出模块标识为 41 的模块或驱动程序中的所有跟踪消息，请输入：
strace 41 all all
要输出模块标识为 41，子标识为 0、1 或 2 的模块或驱动程序中的跟踪消息:
strace 41 0 1 41 1 1 41 2 0
子标识为 0 和 1 的模块或驱动程序中的消息必须具有小于或等于 1 的跟踪级别。子标识为 2 的模块或驱动程序中的消息必须具有跟踪级别 0。
strace: option requires an argument -- e
usage: strace [-dffhiqrtttTvVxx] [-a column] [-e expr] ... [-o file]
[-p pid] ... [-s strsize] [-u username] [-E var=val] ...
[command [arg ...]]
or: strace -c [-e expr] ... [-O overhead] [-S sortby] [-E var=val] ...
[command [arg ...]]
-c -- count time, calls, and errors for each syscall and report summary
-f -- follow forks, -ff -- with output into separate files
-F -- attempt to follow vforks, -h -- print help message
-i -- print instruction pointer at time of syscall
-q -- suppress messages about attaching, detaching, etc.
-r -- print relative timestamp, -t -- absolute timestamp, -tt -- with usecs
-T -- print time spent in each syscall, -V -- print version
-v -- verbose mode: print unabbreviated argv, stat, termio[s], etc. args
-x -- print non-ascii strings in hex, -xx -- print all strings in hex
-a column -- alignment COLUMN for printing syscall results (default 40)
-e expr -- a qualifying expression: option=[!]all or option=[!]val1[,val2]...
options: trace, abbrev, verbose, raw, signal, read, or write
-o file -- send trace output to FILE instead of stderr
-O overhead -- set overhead for tracing syscalls to OVERHEAD usecs
-p pid -- trace process with process id PID, may be repeated
-s strsize -- limit length of print strings to STRSIZE chars (default 32)
-S sortby -- sort syscall counts by: time, calls, name, nothing (default time)
-u username -- run command as username handling setuid and/or setgid
-E var=val -- put var=val in the environment for command
-E var -- remove var from the environment for command
strace - 跟踪系统调用和信号
usage: strace [-dffhiqrtttTvVxx] [-a column] [-e expr] [-o file]
[-p pid] [-s strsize] [-u username] [command [arg]]
strace -c [-e expr] [-O overhead] [-S sortby] [command [arg]]
-a column
指定显示返回值的列位置，默认是40(从0开始计数)，就是说"="出现在40列的位
置。
-c 产生类似下面的统计信息
strace -c -p 14653 (Ctrl-C)
% time seconds usecs/call calls errors syscall
------ ----------- ----------- --------- --------- ----------------
53.99 0.012987 3247 4 2 wait4
42.16 0.010140 2028 5 read
1.78 0.000429 61 7 write
0.76 0.000184 10 18 ioctl
0.50 0.000121 2 52 rt_sigprocmask
0.48 0.000115 58 2 fork
0.18 0.000043 2 18 rt_sigaction
0.06 0.000014 14 1 1 stat
0.03 0.000008 4 2 sigreturn
0.02 0.000006 2 3 time
0.02 0.000006 3 2 1 setpgid
------ ----------- ----------- --------- --------- ----------------
100.00 0.024053 114 4 total
-d 输出一些strace自身的调试信息到标准输出
strace -c -p 14653 -d (Ctrl-C)
[wait(0x137f) = 14653]
pid 14653 stopped, [SIGSTOP]
[wait(0x57f) = 14653]
pid 14653 stopped, [SIGTRAP]
cleanup: looking at pid 14653
% time seconds usecs/call calls errors syscall
------ ----------- ----------- --------- --------- ----------------
------ ----------- ----------- --------- --------- ----------------
100.00 0.000000 0 total
-e expr
A qualifying expression which modifies which events to trace or how to trace
them. The format of the expression is:
[qualifier=][!]value1[,value2]...
这里qualifier可以是trace、abbrev、verbose、raw、signal、read或者write。
value是qualifier相关的符号或数值。缺省qualifier是trace。!表示取反。
-eopen等价于-e trace=open，表示只跟踪open系统调用。-etrace=!open意思是
跟踪除open系统调用之外的其他所有系统调用。此外value还可以取值all和none。
某些shell用!表示重复历史指令，此时可能需要引号、转义符号(/)的帮助。
-e trace=set
只跟踪指定的系统调用列表。决定跟踪哪些系统调用时，-c选项很有用。
trace=open,close,read,write意即只跟踪这四种系统调用，缺省是trace=all
-e trace=file
跟踪以指定文件名做参数的所有系统调用。
-e trace=process
Trace all system calls which involve process management. This is
useful for watching the fork, wait, and exec steps of a process.
-e trace=network
跟踪所有和网络相关的系统调用
-e trace=signal
Trace all signal related system calls.
-e trace=ipc
Trace all IPC related system calls.
-e abbrev=set
Abbreviate the output from printing each member of large structures.
缺省是abbrev=all，-v选项等价于abbrev=none
-e verbose=set
Dereference structures for the specified set of system calls.
The default is verbose=all.
-e raw=set
Print raw, undecoded arguments for the specifed set of system calls.
This option has the effect of causing all arguments to be printed in
hexadecimal. This is mostly useful if you don"t trust the decoding or
you need to know the actual numeric value of an argument.
-e signal=set
只跟踪指定的信号列表，缺省是signal=all。signal=!SIGIO (or signal=!io)
导致 SIGIO 信号不被跟踪
-e read=set
Perform a full hexadecimal and ASCII dump of all the data read from
file descriptors listed in the specified set. For example, to see all
input activity on file descriptors 3 and 5 use -e read=3,5. Note that
this is independent from the normal tracing of the read(2) system call
which is controlled by the option -e trace=read.
-e write=set
Perform a full hexadecimal and ASCII dump of all the data written to
file descriptors listed in the specified set. For example, to see all
output activity on file descriptors 3 and 5 use -e write=3,5. Note
that this is independent from the normal tracing of the write(2)
system call which is controlled by the option -e trace=write.
-f
follow forks，跟随子进程？
Trace child processes as they are created by currently traced
processes as a result of the fork(2) system call. The new process
is attached to as soon as its pid is known (through the return value
of fork(2) in the parent process). This means that such children may
run uncontrolled for a while (especially in the case of a vfork(2)),
until the parent is scheduled again to complete its (v)fork(2)
call. If the parent process decides to wait(2) for a child that is
currently being traced, it is suspended until an appropriate child
process either terminates or incurs a signal that would cause it to
terminate (as determined from the child"s current signal disposition).
意思应该是说跟踪某个进程时，如果发生fork()调用，则选择跟踪子进程
可以参考gdb的set follow-fork-mode设置
-F
attempt to follow vforks
(On SunOS 4.x, this is accomplished with some dynamic linking trickery.
On Linux, it requires some kernel functionality not yet in the
standard kernel.) Otherwise, vforks will not be followed even if -f
has been given.
类似-f选项
-ff
如果-o file选项有效指定，则跟踪过程中新产生的其他相关进程的信息分别写
入file.pid，这里pid是各个进程号。
-h
显示帮助信息
-i
显示发生系统调用时的IP寄存器值
strace -p 14653 -i
-o filename
指定保存strace输出信息的文件，默认使用标准错误输出stderr
Use filename.pid if -ff is used. If the argument begins with `|" or
with `!" then the rest of the argument is treated as a command and all
output is piped to it. This is convenient for piping the debugging
output to a program without affecting the redirections of executed
programs.
-O overhead
Set the overhead for tracing system calls to overhead microseconds.
This is useful for overriding the default heuristic for guessing how
much time is spent in mere measuring when timing system calls using
the -c option. The acuracy of the heuristic can be gauged by timing
a given program run without tracing (using time(1)) and comparing
the accumulated system call time to the total produced using -c.
好象是用于确定哪些系统调用耗时多
-p pid
指定待跟踪的进程号，可以用Ctrl-C终止这种跟踪而被跟踪进程继续运行。可以
指定多达32个-p参数同时进行跟踪。
比如 strace -ff -o output -p 14653 -p 14117
-q
Suppress messages about attaching, detaching etc. This happens
automatically when output is redirected to a file and the command is
run directly instead of attaching.
-r
Print a relative timestamp upon entry to each system call. This
records the time difference between the beginning of successive
system calls.
strace -p 14653 -i -r
-s strsize
指定字符串最大显示长度，默认32。但文件名总是显示完整。
-S sortby
Sort the output of the histogram printed by the -c option by the
specified critereon. Legal values are time, calls, name, and nothing
(default time).
-t
与-r选项类似，只不过-r采用相对时间戳，-t采用绝对时间戳(当前时钟)
-tt
与-t类似，绝对时间戳中包含微秒
-ttt
If given thrice, the time printed will include the microseconds and
the leading portion will be printed as the number of seconds since
the epoch.
-T
这个选项显示单个系统调用耗时
-u username
用指定用户的UID、GID以及辅助组身份运行待跟踪程序
-v
冗余显示模式
Print unabbreviated versions of environment, stat, termios, etc. calls.
These structures are very common in calls and so the default behavior
displays a reasonable subset of structure members. Use this option to
get all of the gory details.
-V
显示strace版本信息
-x 以16进制字符串格式显示非ascii码，比如"/x08"，默认采用8进制，比如"/10"
-xx 以16进制字符串格式显示所有字节