29 ms·
strace is a rather powerfull tool if you want to find out what a certain executable is doing. Which files it is opening, reading and writing and also which othe
by fjfaase 2y ago
strace is a rather powerfull tool if you want to find out what a certain executable is doing. Which files it is opening, reading and writing and also which other executables it is executing. I personally have not used the '--stack-trace' option yet.
Earlier this year, I have used it to analyze what happens during the initial steps of live-bootstrap [1] and produce a web page with all the information [2]. For this, I wrote a C program to parse and process the output of strace.
[1] https://github.com/fosslinux/live-bootstrap https://github.com/fosslinux/live-bootstrap
[2] https://fransfaase.github.io/Emulator/ https://fransfaase.github.io/Emulator/
- ranger_danger 2y agoAnd if you want to do the same thing on a whole-system level, bpftrace is invaluable. With tools like opensnoop/execsnoop/etc. you can see all the files and processes being run and by what. There are network-level similar bpf tools also.
- amelius 2y agoWhat flags do you use when you just want to see the files that are being opened? I'm always grepping, but there must be an easier way.
- Amezarak 2y agostrace -e trace=open -f -p pid If you want to see all file-related calls, replace "open" with "file" or you could add the calls one by one: e.g., trace=open,read.