Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Magic of strace

chadfowler.com

Post reply on HN
Print view View original

91–100 of 105 posts

Re: The Magic of strace

#91

Post by alinspired »

mrfusion wrote: post #72
peterwwillis wrote: post #68

Earlier quoted context omitted.

Sounded like an interesting script, so I just wrote it in about a half hour. You're welcome to sell it if you want... (also, there's probably a default recursion limit of 100; unroll the recursion in walkpid to go farther) Collect logs with 'strace -o pids.log -e trace=process -f [specify your process here]', run with 'perl printpids.pl #!/usr/bin/perl -w $|=1; use strict; my (%pidmap, @order); while ( ) { chomp; if…

Wow that's amazing! Can I have strace launch the program? Or does it already have to be running?

you can, last strace argument can be a command you want to strace

Re: The Magic of strace

#92

Post by windowsworkstoo »

yread wrote: post #42

You can use Process monitor http://technet.microsoft.com/en-us/sysinternals/bb896645.asp... to see a similar overview of low level activity. You won't see all the system calls, you can't pipe the output directly, but there is a UI and you don't have to look up file descriptors

Yes, which uses ETW, which is the equivalent to DTrace for Windows and something that should be known about (but by and large isn't) for Windows opers

Re: The Magic of strace

#93

Post by holyjaw »

rosser wrote: post #4

Small, somewhat nit-picky critique: the man pages for system calls are in section 2. If you want to see the docs for the "read()" syscall, and not the bash builtin "read", saying "man read" w̶o̶n̶'̶t̶ may not (see follow-up) do what you expect. Instead, you should say man 2 read This should probably be mentioned somewhere. Otherwise, great writeup. Thanks for sharing! (edited)

I'm going to hijack this comment to ask a question that I haven't been able to google:

What is the number after the command called? For example, when I look up 'man sed', I find a manpage for 'sed(1)'[0]. When I look up 'man kill', I find manpages for 'kill(1)' and 'kill(2)'[2].

Can somebody tell me what that number is called so I can look it up? Thanks..

0: https://developer.apple.com/library/mac/documentation/Darwin... 1: https://developer.apple.com/library/mac/documentation/Darwin... 2: http://man7.org/linux/man-pages/man2/kill.2.html

Re: The Magic of strace

#94

Post by arxanas »

holyjaw wrote: post #93
rosser wrote: post #4

Small, somewhat nit-picky critique: the man pages for system calls are in section 2. If you want to see the docs for the "read()" syscall, and not the bash builtin "read", saying "man read" w̶o̶n̶'̶t̶ may not (see follow-up) do what you expect. Instead, you should say man 2 read This should probably be mentioned somewhere. Otherwise, great writeup. Thanks for sharing! (edited)

I'm going to hijack this comment to ask a question that I haven't been able to google: What is the number after the command called? For example, when I look up 'man sed', I find a manpage for 'sed(1)'[0]. When I look up 'man kill', I find manpages for 'kill(1)' and 'kill(2)'[2]. Can somebody tell me what that number is called so I can look it up? Thanks.. 0: https://developer.apple.com/library/mac/documentation/Darwi…

That number refers to the section of the man pages that the command is in. See http://en.wikipedia.org/wiki/Man_page#Manual_sections for an example list; however, it seems the list is not the same between systems.

Re: The Magic of strace

#95

Post by rosser »

holyjaw wrote: post #93
rosser wrote: post #4

Small, somewhat nit-picky critique: the man pages for system calls are in section 2. If you want to see the docs for the "read()" syscall, and not the bash builtin "read", saying "man read" w̶o̶n̶'̶t̶ may not (see follow-up) do what you expect. Instead, you should say man 2 read This should probably be mentioned somewhere. Otherwise, great writeup. Thanks for sharing! (edited)

I'm going to hijack this comment to ask a question that I haven't been able to google: What is the number after the command called? For example, when I look up 'man sed', I find a manpage for 'sed(1)'[0]. When I look up 'man kill', I find manpages for 'kill(1)' and 'kill(2)'[2]. Can somebody tell me what that number is called so I can look it up? Thanks.. 0: https://developer.apple.com/library/mac/documentation/Darwi…

That's the "section" I'm talking about. "sed(1)" means that the man page for that sed is in section 1. "kill(1)" versus "kill(2)" likewise: the former is the command; the latter is the syscall. To distinguish between them, you need to tell man(1) which section to look in for the desired context.

Re: The Magic of strace

#96

Post by wmf »

eldavido wrote: post #71

I use strace all the time doing ops at Crittercism. Some of the random things it's helped with/taught me: - allowed exploring forking behavior of daemons, in particular the nitty-gritty of gunicorn's prefork behavior, and understanding the rationale behind single- and double-fork daemons generally (very important to understand for job control e.g. writing upstart/init.d jobs) - isolated hot reads to memcache in situ,…

let me explore the behavior of node.js's several threads, and find one of them sending "X" over a socket to the other (still not quite sure what this is, some kind of heartbeat/clock tick?)

I don't know about node.js specifically, but this is a common pattern to wake another thread that uses a select()-style event loop.

Re: The Magic of strace

#98

Post by quotemstr »

yread wrote: post #42

You can use Process monitor http://technet.microsoft.com/en-us/sysinternals/bb896645.asp... to see a similar overview of low level activity. You won't see all the system calls, you can't pipe the output directly, but there is a UI and you don't have to look up file descriptors

If you like Process Monitor, you'll love xperf.

Re: The Magic of strace

#100

Post by MiWCryptohn »

wslh wrote: post #34
MiWCryptohn wrote: post #2

Don't forget it's userspace equiv (strace is syscalls), ltrace. This tracks all lib calls made by process. Under windows, strace is an SSL/TLS monitoring tool (also hella useful). It shows payloads passed to CryptoAPI/CNG libs so you can easily troubleshoot explicitly encrypted protocols like ldaps. Especially useful if you use client authenticated TLS where is is not possible to use a TLS mitm proxy to snoop the lay…

Shameless plug: if you want to trace Windows applications you can take a look at my company products SpyStudio[1] and Deviare[2]. Before downvoting me try them to see how powerful and unique they are in the Windows ecosystem. VMware is using SpyStudio for creating and troubleshooting application virtualization packages, this is, for example, a twitter post from a VMware escalation engineer: https://twitter.com/DooDle…

Agreed, neat stuff. I installed it on my windows workstation.
Post reply on HN