strace on Linux not logging all calls to open()

Question

I am using strace to capture calls to open(), close() and read() on Linux. The target process is the jetty web server. As far as I can tell, strace is not logging all calls to open(). Maybe the others too, I have not tried to correlate the file descriptors to open() calls.

For example, starting strace:

strace -f -e trace=open,close,read -o/tmp/strace.out -p62881

I then use wget to fetch 100 static files; all were retrieved successfully. In one run, only 56 open events were logged; on another run of 100 different files, I got 66 open events.

I believe that using "-f" results in strace attaching to all the LWPIDs for the threads ("Process 62881 attached with 25 threads - interrupt to quit "); when I try to explicitly attach to all using multiple "-p" options, I get a single "attach" success message, but multiple "Operation not permitted messages", one for each child PID.

I restarted Jetty to clear its cache before my tests.

Kernel version is 2.6.32-504.3.3.el6.x86_64 (Red Hat). Strace package version is strace-4.5.19-1.19.el6.x86_64.

What am I missing?

Thanks

Answer 1

On some systems you have to use openat() instead of open().

Try: strace -f -e trace=openat,close,read -o/tmp/strace.out -p62881