31–40 of 105 posts
Mac OS X has a suite of tools built on a similar package called dtrace—opensnoop and execsnoop. Gives really nice real time lists of all files opened on the system and all binaries executed, respectively.
If you think strace is useful, wait until you try dtrace.
Don't forget it's userspace equiv (strace is syscalls), ltrace. This tracks all lib calls made by process. Under windows, strace is an SSL/TLS monitoring tool (also hella useful). It shows payloads passed to CryptoAPI/CNG libs so you can easily troubleshoot explicitly encrypted protocols like ldaps. Especially useful if you use client authenticated TLS where is is not possible to use a TLS mitm proxy to snoop the lay…
VMware is using SpyStudio for creating and troubleshooting application virtualization packages, this is, for example, a twitter post from a VMware escalation engineer: https://twitter.com/DooDleWilk/status/428562701313662977
[1] http://www.nektra.com/products/spystudio-api-monitor/
[2] http://www.nektra.com/products/deviare-api-hook-windows/devi...
Even in the 90s Java decompilers existed, so the "We had no source code" excuse sounds a bit strange :-)
Don't forget it's userspace equiv (strace is syscalls), ltrace. This tracks all lib calls made by process. Under windows, strace is an SSL/TLS monitoring tool (also hella useful). It shows payloads passed to CryptoAPI/CNG libs so you can easily troubleshoot explicitly encrypted protocols like ldaps. Especially useful if you use client authenticated TLS where is is not possible to use a TLS mitm proxy to snoop the lay…
Good call on ltrace. I thought about writing about that one next.
Earlier quoted context omitted.
+1! Don't leave us hanging like this.
OP: "I can’t remember the exact problem, but it had something to do with files not being properly accessible in its database"
Please see ftp://86.0.252.89/pub/release/website/tools/trace-20140126-x86_64-b95.tar.gz This is a tool called ptrace - which does everything that strace does and a lot more. You have working binaries in there, and most of the source - I havent extricated the full build dependencies so it all builds, but this includes extra facilities like reporting summaries of process trees, showing only connections or files, and sh…
Why do you link directly to the download file? A link to the tool's man page[1] would be sufficient. [1] http://linux.die.net/man/2/ptrace
Elsewhere in this discussion: There's a difference between man page section 1 and 2 - and read was quoted as an example for a potential ambiguous result if you invoke "man read" (opens man 1 read here, when man 2 read was the syscall I might want to look at after running strace).
Please see ftp://86.0.252.89/pub/release/website/tools/trace-20140126-x86_64-b95.tar.gz This is a tool called ptrace - which does everything that strace does and a lot more. You have working binaries in there, and most of the source - I havent extricated the full build dependencies so it all builds, but this includes extra facilities like reporting summaries of process trees, showing only connections or files, and sh…
Why do you link directly to the download file? A link to the tool's man page[1] would be sufficient. [1] http://linux.die.net/man/2/ptrace