Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to exclude some calls in strace?

Tags:

strace

I want to trace system calls with strace. There are too many read and write, so I want to exclude them.

Here is my test:

strace -e trace=!read ls

My PC (Ubuntu 14) failed to run this command. The error message is !open: event not found. I have read the man carefully and I can't understand why it failed.

like image 460
bucherren Avatar asked Mar 10 '16 14:03

bucherren


People also ask

Does strace slow down a process?

strace(1) is a great tool, but the current version (using ptrace()) can slow down the target severely. Be aware of the overhead strace causes, and consider other alternates for Linux that use lower-cost buffered tracing.

How does strace call work?

strace works by using the ptrace system call which causes the kernel to halt the program being traced each time it enters or exits the kernel via a system call. The tracing program (in this case strace ) can then inspect the state of the program by using ptrace .

How do you get out of strace?

The trace may be terminated at any time by a keyboard interrupt signal (CTRL-C). strace will respond by detaching itself from the traced process(es) leaving it (them) to continue running.


1 Answers

Your shell interprets ! as a special symbol and thus fails to run the command. Use quotes:

strace -e 'trace=!read' ls

or escape with \:

strace -e trace=\!read ls
like image 96
GreyCat Avatar answered Sep 28 '22 05:09

GreyCat