Linux Administration Cookbook

Strace

strace, a program that's written to specifically trace system calls (and signals), is often forgotten, but extremely powerful. If you want to find out what a program is doing in real-time, you can use strace.

At a glance, it can be extremely baffling:

$ sudo strace -p $(pidof NetworkManager)strace: Process 550 attachedrestart_syscall(<... resuming interrupted poll ...>) = 1epoll_wait(14, [], 1, 0) = 0poll([{fd=11, events=POLLIN}], 1, 0) = 1 ([{fd=11, revents=POLLIN}])read(11, "\2\0\0\0\200\0\0\0G\10\0\0\20\0\0\00054\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 2048) = 128poll([{fd=11, events=POLLIN}], 1, 0) = 0 (Timeout)poll([{fd=3, events=POLLIN}, {fd=6, events=POLLIN}, {fd=7, events=POLLIN|POLLPRI}, {fd=11, events=POLLIN}, {fd=12, events=POLLIN}, ...