Unix tools? You mean Linux....
The Magic of strace
61–70 of 105 posts
Re: The Magic of strace
#62You can use Process monitor http://technet.microsoft.com/en-us/sysinternals/bb896645.asp... to see a similar overview of low level activity. You won't see all the system calls, you can't pipe the output directly, but there is a UI and you don't have to look up file descriptors
If you want to see the DLL calls, exceptions, etc, you can use the tools I posted here: https://news.ycombinator.com/item?id=7156160
Re: The Magic of strace
#63Earlier quoted context omitted.
while we wait, could you elaborate on that? ;)
strace shows syscalls -- it's effectively truss. That's useful and all, but what if you want to instrument arbitrary parts of a program, not just the syscall interface? By function or instruction? Either in userspace or in kernel? With statistical functions? And speculative tracing? And extensive control flow (except loops, which prevent certain safely guarantees DTrace makes). And a lot more. Don't be fooled by the…
Still doesn't tell me what dtrace does.
Re: The Magic of strace
#64Earlier quoted context omitted.
strace shows syscalls -- it's effectively truss. That's useful and all, but what if you want to instrument arbitrary parts of a program, not just the syscall interface? By function or instruction? Either in userspace or in kernel? With statistical functions? And speculative tracing? And extensive control flow (except loops, which prevent certain safely guarantees DTrace makes). And a lot more. Don't be fooled by the…
Still doesn't tell me what dtrace does.
Re: The Magic of strace
#65Earlier quoted context omitted.
Still doesn't tell me what dtrace does.
Read this: http://blog.bignerdranch.com/1907-hooked-on-dtrace-part-1/
Or you could just give a concise definition:
>What is this "DTrace" thing? It stands for "Dynamic Tracing",
>a way you can attach "probes" to a running system
>and peek inside as to what it is doing.Re: The Magic of strace
#66There's a lot of fun to be had with strace. I wrote a tiny perl script that spies on the file descriptors of another process and outputs it to your terminal: https://github.com/psypete/public-bin/blob/public-bin/src/sy...
Re: The Magic of strace
#67Don't forget it's userspace equiv (strace is syscalls), ltrace. This tracks all lib calls made by process. Under windows, strace is an SSL/TLS monitoring tool (also hella useful). It shows payloads passed to CryptoAPI/CNG libs so you can easily troubleshoot explicitly encrypted protocols like ldaps. Especially useful if you use client authenticated TLS where is is not possible to use a TLS mitm proxy to snoop the lay…
Shameless plug: if you want to trace Windows applications you can take a look at my company products SpyStudio[1] and Deviare[2]. Before downvoting me try them to see how powerful and unique they are in the Windows ecosystem. VMware is using SpyStudio for creating and troubleshooting application virtualization packages, this is, for example, a twitter post from a VMware escalation engineer: https://twitter.com/DooDle…
Thanks, it actually works quite well!
Re: The Magic of strace
#68Has anyone heard of a program that will take strace (or dtrace) output and create a pretty diagram showing which commands call which commands and which files they read or create? We've got a fairly complicated bioinformatics pipeline that calls about 100 other programs, and creates or reads about 100 different files. I'd love a way to create a picture of what's going on. Which files each program uses, etc. If such a…
Sounded like an interesting script, so I just wrote it in about a half hour. You're welcome to sell it if you want... (also, there's probably a default recursion limit of 100; unroll the recursion in walkpid to go farther) Collect logs with 'strace -o pids.log -e trace=process -f [specify your process here]', run with 'perl printpids.pl
#!/usr/bin/perl -w
$|=1;
use strict;
my (%pidmap, @order);
while ( ) {
chomp;
if ( /^(\d+)\s+(\w+)(.*)$/ ) {
my ($pid, $syscall, $args) = ($1, $2, $3);
if ( $syscall =~ /(^clone$|fork$)/ and $args =~ / = (\d+)$/ and $1 > 0 ) {
my $clonepid = $1;
$pidmap{$clonepid} = { -parent => $pid };
push(@order, $clonepid);
}
elsif ( $syscall =~ /^exec/ and $args =~ / = (\d+)$/ and $1 == 0 ) {
my $exec = $args;
@order = ($pid) if !@order;
$exec =~ s/^\("([^"]+?)",.*$/$1/g;
push( @{ $pidmap{$pid}->{-exec} } , $exec );
}
}
}
foreach my $pid ( @order ) {
my $spaces = walkpid($pid);
print " " x $spaces . join("\n" . (" " x $spaces), map { $_ . " ($pid)" } @{ $pidmap{$pid}->{-exec} } ) . "\n";
}
sub walkpid {
my $pid = shift;
my $c = shift || 0;
if ( exists $pidmap{$pid}->{-parent} ) {
return walkpid($pidmap{$pid}->{-parent}, $c+1);
}
return($pid, $c);
}Re: The Magic of strace
#69Small, somewhat nit-picky critique: the man pages for system calls are in section 2. If you want to see the docs for the "read()" syscall, and not the bash builtin "read", saying "man read" w̶o̶n̶'̶t̶ may not (see follow-up) do what you expect. Instead, you should say man 2 read This should probably be mentioned somewhere. Otherwise, great writeup. Thanks for sharing! (edited)
There's a manpage bash-builtins in section 7, but I've never seen a system that had manpages for the individual builtins, let alone having them in section 1. "man read" on every system I've used opens the read manpage in section 2.
I can't remember a unix system for at least the last decade that hasn't given me the section 1 bash "read" instead of the section 2 system "read" on a "man read".
Re: The Magic of strace
#70Earlier quoted context omitted.
There's a manpage bash-builtins in section 7, but I've never seen a system that had manpages for the individual builtins, let alone having them in section 1. "man read" on every system I've used opens the read manpage in section 2.
I can't remember a unix system for at least the last decade that hasn't given me the section 1 bash "read" instead of the section 2 system "read" on a "man read".
I've been on Ubuntu for several years, and I see the same as JoshTriplett. Must be platform dependent.