Strace daemon process started using service

Question

Strace can be used for tracing process by passing command for the process as below

strace -f -tt -o strace.log -D <SOME_COMMAND>

But below command fails to trace the syscalls of started daemon process

strace -f -tt -o strace.log -D service nginx start

In this case the strace just traces syscall for /usr/sbin/service and terminates. It does not trace syscalls on nginx process which is started as result of service nginx start

How do a I trace the process started by /usr/sbin/service? Specifically looking for solution with daemon process only!

Answer 1

Instead of running the nginx from service. Run service nginx stop and then run

strace nginx -g "daemon off;"

this will make sure that you get the trace of the process. The -g "daemon off;" will make sure the nginx is not run as a daemon process, else again the strace would end

Service command is just activating a process and if you want to strace it the best is to launch the process directly.

In case you are still interested in debugging the process started using the service command. Then do below

service nginx start
ps aux | grep nginx

Capture the pid from the nginx process and then attach to it using

strace -p <pid>

Forking Processes

To trace processes which fork, you need to use the -f flag

strace -f nginx

Service tracing

When you call service start nginx, assuming the system uses systemd, the call gets translated to systemctl start nginx. Now if you look at the source code of systemd

https://github.com/systemd/systemd/blob/cf45dd36282368d5cdf757cac2cf1fc2b562dab2/src/systemctl/systemctl.c#L3100

r = sd_bus_call_method_async(
    bus,
    NULL,
    "org.freedesktop.systemd1",
    "/org/freedesktop/systemd1",
    "org.freedesktop.systemd1.Manager",
    "Subscribe",
    NULL, NULL,
    NULL);

It doesn't spawn/fork the process. It sends the message to the systemd service which then starts nginx process.

So in short, NO you can't strace through your service nginx start command.

Answer 2

Change the ExecStart property of the service to include "strace". For example (tested on Debian Buster):

# grep ExecStart /lib/systemd/system/nginx.service
ExecStartPre=/usr/sbin/nginx -t -q -g 'daemon on; master_process on;'
ExecStart=/usr/sbin/nginx -g 'daemon on; master_process on;'
# cd /etc/systemd/system/
# mkdir nginx.service.d
# cat > nginx.service.d/strace.conf <<-EOD
    [Service]
    ExecStart=
    ExecStart=/usr/bin/strace -f -tt -o /tmp/strace.log -D /usr/sbin/nginx -g 'daemon on; master_process on;'
EOD
# systemctl daemon-reload
# systemctl restart nginx.service