Trace a command
strace ls
Trace running process
strace -p 1234
Count system calls
strace -c ls
Trace only specific syscalls
strace -e open,read ls
Trace file operations
strace -e trace=file ls
Trace network operations
strace -e trace=network curl example.com
Trace process and children
strace -f ./script.sh
Save output to file
strace -o output.txt ls
Show timestamps
strace -t ls
Show relative timestamps
strace -r ls
Show time spent in each syscall
strace -T ls
Attach to all threads
strace -f -p 1234
Trace file opens
strace -e openat nginx
Trace network connections
strace -e connect,socket curl example.com
Filter by string match
strace -e open -e trace=\!open ls 2>&1 | grep ".conf"
Debug "file not found" errors
strace -e openat ./program 2>&1 | grep ENOENT
Trace stat/access calls
strace -e stat,access ls
See what files a process reads
strace -e read -s 100 cat file.txt
Common syscall categories
# File operations
strace -e trace=file
# Network operations
strace -e trace=network
# Process operations
strace -e trace=process
# IPC operations
strace -e trace=ipc
# Memory operations
strace -e trace=memory