I want to trace system calls with strace. There are too many read and write, so I want to exclude them.
Here is my test:
strace -e trace=!read ls
My PC (Ubuntu 14) failed to run this command. The error message is !open: event not found
. I have read the man carefully and I can't understand why it failed.
strace(1) is a great tool, but the current version (using ptrace()) can slow down the target severely. Be aware of the overhead strace causes, and consider other alternates for Linux that use lower-cost buffered tracing.
strace works by using the ptrace system call which causes the kernel to halt the program being traced each time it enters or exits the kernel via a system call. The tracing program (in this case strace ) can then inspect the state of the program by using ptrace .
The trace may be terminated at any time by a keyboard interrupt signal (CTRL-C). strace will respond by detaching itself from the traced process(es) leaving it (them) to continue running.
Your shell interprets !
as a special symbol and thus fails to run the command. Use quotes:
strace -e 'trace=!read' ls
or escape with \
:
strace -e trace=\!read ls
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With