3 ms·
>I'm old-school, and even I rarely use unfiltered strace anymore. Too noisy on a complex/concurrent program, and not just because of dumb stuff. I filter it dow
by chrsig 4y ago
>I'm old-school, and even I rarely use unfiltered strace anymore. Too noisy on a complex/concurrent program, and not just because of dumb stuff. I filter it down to what I'm looking for or use another tool entirely.
This!
Learning all of the strace flags is a very useful endeavor. Filtering is a must to see exactly the calls that I'm looking for.
I don't think most developers appreciate how often syscalls happen. Without filtering, you're getting all:
- file i/o (read, write, readv, writev, pread, pwrite, ...)
- network i/o (select, poll, accept, epoll, ...)
- memory allocations (mmap,munmap, sbrk, ...)
- process querying (getenv/setenv, getpid, gettid,...)
- time (gettimeofday, sleep, ...)
- synchronization (futex, ...)
I'm sure there's a bunch more that I'm neglecting. It produces quite a bit of noise!
- scottlamb 4y agoYeah, excellent description of why the number of syscalls is so high, and when you're tracing a multithreaded program there's the additional noise from the way it reports concurrent syscalls from the various threads. Besides filtering, I forgot to mention that I like seeing some kind of aggregation/summary. strace flags are useful; even better to write a little program with eBPF (on Linux) or DTrace (on macOS/BSD/Solaris). I like being able to do stuff like this: https://github.com/scottlamb/retina/issues/5#issue-933945792 https://github.com/scottlamb/retina/issues/5#issue-933945792