You can do this on Linux using perf, if you want less overhead and less impact on the application-under-test: $ perf record -e syscalls:sys_enter_read -g --

You can do this on Linux using perf, if you want less overhead and less impact on the application-under-test: $ perf record -e syscalls:sys_enter_read -g -- application arg1 arg2 ... [ application runs while perf writes out a log, recording every read() syscall, and keeping track of the backtrace each time] $ perf report -g --stdio [ perf reads the log, writing out the backtraces ] This is the basic usage. Lots more is available, obviously. This has been available for a LONG time.