I started the chapter with the simple and ubiquitous tool, top, and I will finish with another: strace. It is a very simple tracer that captures system calls made by a program and, optionally, its children. You can use it to do the following:
- Learn which system calls a program makes
- Find those system calls that fail, together with the error code: I find this useful if a program fails to start but doesn't print an error message or if the message is too general
- Find which files a program opens
- Find out which syscalls a running program is making, for example, to see whether it is stuck in a loop
There are many more examples online; just search for strace tips and tricks. Everybody has their own favorite story, for example, http://chadfowler.com/2014/01/26/the-magic-of-strace.html.
strace uses the ptrace(2) function to hook calls as they are made from user space...