3 ms·

So it's like strace looking for brk()?

• weinzierl 4y ago
  Sorry if this is a dumb question, but can't strace trace brk() calls? And as kind of a follow up what is the easiest way to trace all allocations (brk() and mmap) but nothing else?
  • matheusmoreira 4y ago
    > can't strace trace brk() calls? Absolutely. > what is the easiest way to trace all allocations (brk() and mmap) but nothing else? strace -e mmap "$command" I don't think anything modern still uses the program break but one should know brk and sbrk exist. To see deallocations, add munmap to the filter. Note that these represent operating system allocations: programs usually request huge chunks and then manage that memory in user space in order to avoid system call overhead. In many systems, this memory won't actually count as used unless the process actually touches it and causes page fault.
    • zokier 4y ago
      Fyi there is -e %memory alias in strace for all memory related syscalls
• wyldfire 4y ago
  strace is limited to system calls but this particular tool uses ptrace to trap symbolic references to mmap, malloc, calloc, etc. This provides better resolution because your allocator probably asks for large chunks of memory from the system and allocates from those instead of making each request one-for-one.