strace Command
Advanced Performance & Debugging man(1)Trace system calls and signals of a process
👁 8 views
📅 Updated: Mar 15, 2026
SYNTAX
strace [OPTION]... COMMAND
What Does strace Do?
strace traces system calls and signals received by a process. It shows every interaction between a process and the Linux kernel — file operations, network calls, memory management, and more.
strace is the ultimate debugging tool for understanding what a program is actually doing. When a program fails silently, hangs, or behaves unexpectedly, strace reveals the underlying system calls and error codes.
strace can attach to running processes or trace new commands. It shows the system call name, arguments, return value, and any errors — making it invaluable for debugging permission issues, missing files, and performance problems.
strace is the ultimate debugging tool for understanding what a program is actually doing. When a program fails silently, hangs, or behaves unexpectedly, strace reveals the underlying system calls and error codes.
strace can attach to running processes or trace new commands. It shows the system call name, arguments, return value, and any errors — making it invaluable for debugging permission issues, missing files, and performance problems.
Options & Flags
| Option | Description | Example |
|---|---|---|
| -p PID | Attach to running process | sudo strace -p 1234 |
| -f | Follow child processes | strace -f ./server |
| -e | Filter by system call type | strace -e open,read,write ./program |
| -c | Count time, calls, and errors | strace -c ./program |
| -o | Write output to file | strace -o trace.log ./program |
| -t | Show timestamps | strace -t ./program |
| -s | Maximum string size to print | strace -s 1000 ./program |
Practical Examples
#1 Trace a command
Shows all system calls made by ls.
$ strace ls /tmp/
Output:
open("/tmp/", O_RDONLY) = 3\ngetdents64(3, ...) = 120
#2 Find missing files
Shows files the program tried to open but could not find.
$ strace -e openat ./myapp 2>&1 | grep -i "no such file"
Output:
openat(AT_FDCWD, "/etc/myapp.conf", O_RDONLY) = -1 ENOENT
#3 Attach to running process
Traces network system calls of a running nginx process.
$ sudo strace -p $(pgrep nginx | head -1) -e network#4 Performance summary
Shows a summary of system call counts and time.
$ strace -c curl -s https://example.com > /dev/null
Output:
% time seconds calls errors syscall\n 50.00 0.001234 15 0 read\n 30.00 0.000789 10 0 write
#5 Trace file operations
Shows only file-related system calls (open, stat, unlink, etc.).
$ strace -e trace=file ./deploy.sh#6 Full trace to file
Traces all processes with full strings and saves to file.
$ strace -f -o /tmp/trace.log -s 500 ./myappTips & Best Practices
Filter for specific calls: -e trace=file for file ops, -e trace=network for networking, -e trace=process for fork/exec. Reduces noise dramatically.
Significant performance impact: strace slows the traced process 10-100x. Never use on production servers handling real traffic.
ENOENT = file not found: When debugging, grep strace output for ENOENT (file not found), EACCES (permission denied), ECONNREFUSED (connection refused).
Frequently Asked Questions
How do I find why a program fails?
strace ./program 2>&1 | tail -20. The last system calls before exit usually reveal the problem (file not found, permission denied, etc.).
How do I trace a running process?
sudo strace -p PID attaches to a running process. Use -f to follow child processes.
How do I find what files a program opens?
strace -e openat ./program 2>&1 shows all file open attempts, including failures.
Related Commands
More Performance & Debugging Commands
Master Linux with Professional eBooks
Curated IT eBooks covering Linux, DevOps, Cloud, and more
Browse Books →