strace — Development Environment and Programming

A tracing tool that shows in real time the system calls and signals a process requests from the kernel.

Basic information

What is this program?

strace is a tool that displays in real time every system call (open, read, connect, stat, etc.) a running process requests from the kernel and the signals it receives.

When a program says “it cannot find a file” or “permission is denied,” you can see with your own eyes what path and what permissions it is actually trying to use. It is one of the fastest ways to determine “why isn’t this working” when diagnosing server failures.

What problems does it solve?

• When a program fails because it cannot find a file or configuration, and you need to see which paths it tries.
• When you need to narrow down where a permission error (Permission denied) occurs.
• When you need to see which host and port a network program attempts to connect to.
• When a program starts unusually slowly and you need to see which I/O or network calls are the bottleneck.

Key features

System call tracing

Prints the system calls of a specified process together with their arguments and return values.

• Use case: Prefix the command used to reproduce the failure with strace.
• What you get: See failed calls (e.g. ENOENT, EACCES) including their return values.
• Limitations: There can be so many calls that the output becomes very large.

Statistical summary (-c)

Summarizes the number of calls and time spent per system call.

• Use case: Find bottleneck calls in a slow process.
• What you get: A table showing which calls consume the most time.
• Limitations: Individual argument details are lost, so it is not enough for root-cause analysis.

Child process tracing (-f)

Traces all child processes created by fork and exec together.

• Use case: Observe the startup process of a multi-process server.
• What you get: The call flow of the entire parent and child processes.
• Limitations: As the number of traced processes increases, overhead and output volume grow rapidly.

File and network filter

Filters the traced system calls or paths.

• Use case: See only open-related calls, or only a specific path.
• What you get: View only the calls you are interested in.
• Limitations: Using the filter syntax incorrectly can omit necessary calls.

Installation and execution

Ubuntu / Debian

Install from the distribution repository.

sudo apt update
sudo apt install strace

RHEL / CentOS / Fedora

Install from the default repository.

sudo dnf install strace

Building from source

Download and build the source tarball from the official distribution page.

# https://strace.io/files/

Real-world examples

Trace by prepending to a command

Just put strace in front of the original command.

strace ls /var/www/html

Trace child processes as well

Use -f to trace child processes too.

strace -f -e trace=openat,connect ./app-server --once

Summary statistics (example)

Use -c to produce per-call statistics. The output is an example.

strace -c ls /etc

Advantages and limitations

Advantages

• You can see the actual kernel interactions of an existing binary without source code or rebuilding.
• It provides the most direct evidence when diagnosing file, permission, and network problems.
• It is included by default in most Linux distributions and is simple to use.
• The LGPL license allows free use.

Considerations before use

• Tracing slows the process significantly, so do not use it as-is on long-running production processes.
• The output can explode, so using filter and summary options is essential.
• If the kernel version and the system call list do not match, some call names may not be displayed.
• Programs with many threads or asynchronous I/O are difficult to interpret.

Comparison with similar programs

Official resources and additional learning

• Official homepage — https://strace.io/
• Official documentation / knowledge base — https://strace.io/documentation.html
• Official download — https://strace.io/files/
• Release notes — https://github.com/strace/strace/blob/master/NEWS
• Source / development resources — https://github.com/strace/strace

Version and supported environment information was verified on the official website as of 2026-10-18. Installation commands may differ depending on the distribution and version you use, so also check the official installation documentation.

Actual execution screen

This is a synthetic example that recreates in a server-like style the result of tracing only file access system calls with strace. The screen is a synthetic example and not an actual execution result.

!strace openat/stat system call tracing screen: terminal showing access attempts to /var/www/html and return values

Live production server

Source (HTML): https://games.aidebatehub.com/programs/apps/dev/strace.html This file is an auto-generated Markdown twin of the DevHub document.