使用方法
- 复制安装命令，在自己的智能体环境安装前先检查源码包。
- 从原始文档核对所需工具、凭据和支持的宿主。
- 说明输入材料与期望交付物，并对照来源检查输出。
npx skills add https://github.com/mohitmishra786/low-level-dev-skills --skill strace-ltrace开始前需了解
- 安装不包含模型订阅、API 额度或访问文件的权限。
- 仓库星数和安装量反映活跃情况，不等于独立质量或安全测试。
仓库原始内容
按源仓库内容呈现，保留标题、案例、代码、表格、链接以及原文引用的演示图片。
strace / ltrace
Purpose
Guide agents through tracing system calls with strace and library calls with ltrace — the most effective tools for diagnosing incorrect binary behaviour without a crash or debugger.
Triggers
- "My program behaves incorrectly — how do I trace what it's doing?"
- "How do I find what files a binary is opening?"
- "strace shows ENOENT — how do I interpret it?"
- "How do I trace network calls with strace?"
- "What is ltrace and how does it differ from strace?"
- "How do I trace a running process?"
Workflow
1. Basic strace usage
bash
# Trace all syscalls of a command
strace ./myapp arg1 arg2
# Attach to running process
strace -p 12345
# Trace child processes too (-f = follow fork)
strace -f ./myapp
# Save to file (raw output — not stdout)
strace ./myapp 2> trace.txt
# Most useful: timestamps + summary
strace -t -f ./myapp 2>&1 | head -1002. Filter by syscall category
bash
# Trace file operations only
strace -e trace=file ./myapp
# Trace network syscalls
strace -e trace=network ./myapp
# Trace specific syscalls
strace -e trace=open,openat,read,write ./myapp
# Trace process management
strace -e trace=process ./myapp
# Trace memory operations
strace -e trace=memory ./myapp
# Trace signals
strace -e trace=signal ./myapp
# Multiple categories
strace -e trace=file,network ./myapp| Category | Syscalls included |
|---|---|
file | open, openat, stat, access, unlink, rename, ... |
network | socket, connect, bind, accept, send, recv, ... |
process | fork, exec, wait, clone, exit, ... |
memory | mmap, munmap, mprotect, brk, ... |
signal | kill, sigaction, sigprocmask, ... |
ipc | pipe, socket pair, shmget, ... |
desc | close, dup, poll, select, epoll, ... |
3. Interpreting common errors
bash
# See return values and errors
strace -e trace=file ./myapp 2>&1 | grep -E "ENOENT|EPERM|EACCES|ENOTSUP"| Error | Meaning | Common cause |
|---|---|---|
ENOENT | No such file or directory | Config file missing, wrong path |
EACCES | Permission denied | File permissions, SELinux |
EPERM | Operation not permitted | Missing capability, suid needed |
EADDRINUSE | Address already in use | Port already bound |
ETIMEDOUT | Connection timed out | Network unreachable, firewall |
ECONNREFUSED | Connection refused | Server not listening |
EAGAIN | Resource temporarily unavailable | Non-blocking I/O, try again |
ENOMEM | Out of memory | Allocation failed |
EBADF | Bad file descriptor | Using closed/invalid fd |
ENOEXEC | Exec format error | Wrong binary format for arch |
bash
# Find what file is not found
strace ./myapp 2>&1 | grep 'ENOENT'
# Example output:
# openat(AT_FDCWD, "/etc/myapp.conf", O_RDONLY) = -1 ENOENT (No such file or directory)
# → Config file expected at /etc/myapp.conf4. Useful strace flags
bash
# Show strings fully (default truncates at 32 chars)
strace -s 256 ./myapp
# Timestamps
strace -t ./myapp # wall clock time
strace -T ./myapp # time spent in each syscall
strace -r ./myapp # relative timestamps
# System call count summary
strace -c ./myapp
# Shows count, time, errors per syscall — great for profiling
# Trace with PIDs in output (for -f)
strace -f -p ./myapp
# Output: [pid 12346] open("/etc/passwd", O_RDONLY) = 3
# Decode numerical arguments
strace -e verbose=all ./myapp
# Print instruction pointer at each syscall
strace -i ./myapp5. ltrace — library call tracing
bash
# Trace all library calls
ltrace ./myapp
# Trace specific library function
ltrace -e malloc,free,fopen ./myapp
# Trace nested calls (lib → lib)
ltrace -n 2 ./myapp # indent nested calls
# Trace with syscalls too
ltrace -S ./myapp
# Attach to running process
ltrace -p 12345
# Summary statistics
ltrace -c ./myappTypical ltrace output:
text
malloc(1024) = 0x55a1b2c3d000
fopen("/etc/myapp.conf", "r") = 0
free(0x55a1b2c3d000) = <void>strace vs ltrace:
| | strace | ltrace | |--|--------|--------| | Traces | Kernel syscalls | User-space library calls | | Overhead | Lower | Higher (PLT hooking) | | Shows | open(), read(), write() | fopen(), malloc(), printf() | | Use when | Binary interacts with OS/files/network | Binary calls library functions you can't see |
6. Practical diagnosis workflows
bash
# Find missing config file
strace -e trace=openat,open ./myapp 2>&1 | grep ENOENT
# Find what network connections are made
strace -e trace=network -f ./myapp 2>&1 | grep connect
# Debug dynamic library loading failures
strace -e trace=openat ./myapp 2>&1 | grep "\.so"
# Find permission issues
strace -e trace=file ./myapp 2>&1 | grep -E "EACCES|EPERM"
# Debug slow startup (find where time is spent)
strace -c ./myapp 2>&1
# Look for high % time in unexpected syscalls
# Watch IPC/shared memory
strace -e trace=ipc,shm ./myapp
# Find what the binary exec's
strace -e trace=execve -f ./myapp7. seccomp filter debugging
If a program is killed by a seccomp policy, strace reveals which syscall triggered it:
bash
strace -e trace=all ./myapp 2>&1 | tail -5
# Often shows the last syscall before SIGSYSFor strace output patterns and ltrace filtering examples, see references/strace-patterns.md.
Related skills
- Use
skills/debuggers/gdbwhen strace shows the failing location and you need to inspect internals - Use
skills/binaries/elf-inspectionto understand what libraries and symbols a binary uses - Use
skills/binaries/dynamic-linkingfor diagnosingLD_*and library loading issues - Use
skills/profilers/linux-perffor performance profiling (strace overhead is too high for perf)
