Of course, typing this on my phone, I didn't get the syntax exactly right. Sorry! The actual strace argument should be -e fault=clone:error=ENOMEM:when=1+2

Of course, typing this on my phone, I didn't get the syntax exactly right. Sorry! The actual strace argument should be -e fault=clone:error=ENOMEM:when=1+2 First, modern glibc doesn't use the `fork` syscall directly; it uses clone() instead, so you have to fault clone to see anything happen on a glibc-based system. Second, I botched the syntax, oops! For practical use, you probably want something like this: strace -e fault=clone:error=ENOMEM:when=2+2 -e fault=write:error=EFAULT:when=3+3 -c -o /dev/null bash This faults both clone and write at different rates (try it, the results are sort of funny), sets strace to only count events (reducing its overhead), and then suppresses the count printout at the end. Might be fun to use as a prank login shell if you want someone to think their machine is broken :)