Strace: trace 系统调用

strace - trace system calls and signals

如：

strace -s 200 -f -o /var/tmp/trace.log -p <process pid>

-s strsize  Specify  the maximum string size to print (the default is 32).  Note that filenames are not considered strings and are always printed
                   in full. 打处理的最大字符串长度

-p pid      Attach to the process with the process ID pid and begin tracing.  The trace may be terminated at any time  by  a  keyboard  interrupt
                   signal  (CTRL-C).  strace will respond by detaching itself from the traced process(es) leaving it (them) to continue running.  Multi-
                   ple -p options can be used to attach to up to 32 processes in addition to command (which is optional if at least  one  -p  option  is
                   given).

-o file     输出到文件

-f          Trace child processes as they are created by currently traced processes as a result of the fork(2) system call.

                   On non-Linux platforms the new process is attached to as soon as its pid is known (through the return value of fork(2) in the  parent
                   process).  This means that such children may run uncontrolled for a while (especially in the case of a vfork(2)), until the parent is
                   scheduled again to complete its (v)fork(2) call.  On Linux the child is traced from its first instruction with no delay.  If the par-
                   ent  process decides to wait(2) for a child that is currently being traced, it is suspended until an appropriate child process either
                   terminates or incurs a signal that would cause it to terminate (as determined from the child’s current signal disposition).

                   On SunOS 4.x the tracing of vforks is accomplished with some dynamic linking trickery.