Live data from Hacker News

The Magic of strace

chadfowler.com

41–50 of 105 posts

Re: The Magic of strace

#41

Don't forget it's userspace equiv (strace is syscalls), ltrace. This tracks all lib calls made by process. Under windows, strace is an SSL/TLS monitoring tool (also hella useful). It shows payloads passed to CryptoAPI/CNG libs so you can easily troubleshoot explicitly encrypted protocols like ldaps. Especially useful if you use client authenticated TLS where is is not possible to use a TLS mitm proxy to snoop the lay…

You can also track non-lib calls: http://stackoverflow.com/q/311840/309483

Re: The Magic of strace

#43
post #42

You can use Process monitor http://technet.microsoft.com/en-us/sysinternals/bb896645.asp... to see a similar overview of low level activity. You won't see all the system calls, you can't pipe the output directly, but there is a UI and you don't have to look up file descriptors

[deleted]

Re: The Magic of strace

#44
post #4

Small, somewhat nit-picky critique: the man pages for system calls are in section 2. If you want to see the docs for the "read()" syscall, and not the bash builtin "read", saying "man read" w̶o̶n̶'̶t̶ may not (see follow-up) do what you expect. Instead, you should say man 2 read This should probably be mentioned somewhere. Otherwise, great writeup. Thanks for sharing! (edited)

There's a manpage bash-builtins in section 7, but I've never seen a system that had manpages for the individual builtins, let alone having them in section 1. "man read" on every system I've used opens the read manpage in section 2.

read is also documented by POSIX, and those man pages are often installed in section 1p.

Re: The Magic of strace

#46
post #13

Earlier quoted context omitted.

There's a manpage bash-builtins in section 7, but I've never seen a system that had manpages for the individual builtins, let alone having them in section 1. "man read" on every system I've used opens the read manpage in section 2.

My local CentOS 6.2 VM has bash-builtins in section 1, which is where "man read" takes me. Same with a RHEL 6.4 machine in the colo. This might be a distro-specific thing.

Same with OSX: "man read" opens the builtin(1) manpage. However on Debian 7.3, it opens read(2).

Re: The Magic of strace

#50
Has anyone heard of a program that will take strace (or dtrace) output and create a pretty diagram showing which commands call which commands and which files they read or create?

We've got a fairly complicated bioinformatics pipeline that calls about 100 other programs, and creates or reads about 100 different files. I'd love a way to create a picture of what's going on. Which files each program uses, etc.

If such a program doesn't exist, would that be worth building? Could it be something I could potentially sell?

Post reply on HN