4 ms·

Intentrace: Strace for Everyone

82 points by MrBuddyCasino 2y ago

maxmcd 2y ago
Huh, I did not realize I was settling for something so incomprehensible compared to this. Really nice to see. Maybe there are other nice tools like this?
- djbusby 2y ago
  A better traceroute is mtr - was mentioned a few days ago on here.
  - nunez 2y ago
    tcptraceroute can also be more useful sometimes, as it doesn't rely on ICMP for the probes. But mtr all the way.
    - teddyh 2y ago
      mtr --tcp “Use TCP SYN packets instead of ICMP ECHO. PACKETSIZE is ignored, since SYN packets can not contain data.”
- ranger_danger 2y ago
  eBPF has entered the chat: https://github.com/iovisor/bcc https://github.com/iovisor/bcc https://www.youtube.com/watch?v=Wb_vD3XZYOA https://www.youtube.com/watch?v=Wb_vD3XZYOA
deleted 2y ago
[deleted]
immibis 2y ago
So it just prints "get the target path of link foo" instead of "readlink(foo)" and so on? When I read the description I hoped it would match broad strokes like "load library foo.so" but the screenshot shows that it just rewords each syscall name into English.
- Hello71 2y ago
  Yeah, it seems like it could be implemented as a postprocessor of strace --decode-fds. Knowing what each syscall does isn't really the hard part of strace, it's knowing which ones are important, which ones are part of libc itself and can usually be ignored (e.g. collecting /etc/localtime) and which are explicitly requested by the application, piecing together multi-threaded/multi-process logic, etc. strace has a lot of functions to help with that which this doesn't support, like syscall filtering, struct decoding, and stack tracing.
  - donaldihunter 2y ago
    Agreed, I'm a bit underwhelmed by intentrace when compared to the richness of strace. For sure, strace could maybe benefit from some UX like colorised output and a TUI that lets you filter syscalls while it is running.
    - donaldihunter 2y ago
      Mmmm: https://github.com/xfgusta/strace-with-colors https://github.com/xfgusta/strace-with-colors
  - peter_d_sherman 2y ago
    >Knowing what each syscall does isn't really the hard part of strace, it's knowing which ones are important, which ones are part of libc itself and can usually be ignored An excellent point! More broadly, since many/most Linux/Unix/etc, programs use one or more libraries (which in turn could use one or more other libraries, etc., etc.), then one very important key for designers of any type of strace program, present or future, is: Can the traced system calls be set granularly, such that the individual libraries making syscalls (as opposed to the main program!) be identified individually, and possibly filtered in/out from the results accordingly? So, an excellent point!
- oldstadium 2y ago
  I'm the author of the repo, your comment seems to paint a false picture of linux syscalls being "very easy" to decipher from their names, filesystem calls like readlink, mkdir, and chmod are unfortunately the exception and not the rule. A syscall which I consider one of the more simple syscalls and I'd point you towards is `madvise` whose action can be customized with over 18 different flags, some of these flags create effects, and some of them have a `dispelling` effect and their purpose is not that obvious from the name. More complicated syscalls range from semi-decipherable with experience to entirely indecipherable, those syscalls will have arguments that can be a numbers/NULL/a pointer/the number -1, each with its own interpretation rules, some syscalls even have arguments that can be both a pointer or a numeric (int) depending on some other flag in a different argument, some syscalls have their entire logic encoded within multi-level structs like the `sigaction` syscall. the value that can be derived from something like intentrace becomes apparent when you consider that a lot of programmers don't want to peruse the man pages and in the same time want to wield the power of strace, it allows programmers of every walk to be able to skim a strace-like feed very fast obtaining the optimal amount of information needed to know "what wen't wrong", "how does this binary work", etc..
throwaway984393 2y ago
[dead]
cassianoleal 2y ago
> Strace for Everyone For a moment there I was excited to see strace on the Mac. Not for everyone, it seems.
- nunez 2y ago
  To be fair, we do have fs_usage and, if you disable SIP, dtrace. fs_usage is nowhere near as awesome and comprehensive as strace, but it's something.
  - donaldihunter 2y ago
    Yes, I get by with dtruss which is inferior to strace but usually good enough. It's just a 1000 line dtrace program so I guess it could be improved.
- cstrahan 2y ago
  While it doesn't capture every syscall, you can get pretty far with the (seemingly little known) Endpoint Security Framework: https://developer.apple.com/documentation/endpointsecurity https://developer.apple.com/documentation/endpointsecurity I cobbled together a little tool at my previous job that would capture a full trace of all process fork+exec and file opens, which would then present all of these events in the usual tracing UI (like you'd get when view a trace of a single program with Tracy[1] or Perfetto[2]). We had a massive monorepo built with bazel and a heap of shell, and it wasn't clear which part of our code base was responsible for generating some mis-generated file. This tool gave me the whole inter-process call stack, complete with arguments and environment variables, letting me quickly find where and how to fix the problem. It's such a nice tool to have that it kinda blows my mind that no one has openly published anything like it. By leveraging eBPF on Linux, the same UI could be used on both macOS and Linux. If I had more time and energy, I'd do it myself. [1]: https://github.com/wolfpld/tracy https://github.com/wolfpld/tracy [2]: https://perfetto.dev/ https://perfetto.dev/

82 points by MrBuddyCasino 2y ago

Huh, I did not realize I was settling for something so incomprehensible compared to this. Really nice to see. Maybe there are other nice tools like this?

djbusby 2y ago
A better traceroute is mtr - was mentioned a few days ago on here.
- nunez 2y ago
  tcptraceroute can also be more useful sometimes, as it doesn't rely on ICMP for the probes. But mtr all the way.
  - teddyh 2y ago
    mtr --tcp “Use TCP SYN packets instead of ICMP ECHO. PACKETSIZE is ignored, since SYN packets can not contain data.”
ranger_danger 2y ago
eBPF has entered the chat: https://github.com/iovisor/bcc https://github.com/iovisor/bcc https://www.youtube.com/watch?v=Wb_vD3XZYOA https://www.youtube.com/watch?v=Wb_vD3XZYOA

deleted 2y ago

[deleted]

immibis 2y ago

So it just prints "get the target path of link foo" instead of "readlink(foo)" and so on? When I read the description I hoped it would match broad strokes like "load library foo.so" but the screenshot shows that it just rewords each syscall name into English.

Hello71 2y ago
Yeah, it seems like it could be implemented as a postprocessor of strace --decode-fds. Knowing what each syscall does isn't really the hard part of strace, it's knowing which ones are important, which ones are part of libc itself and can usually be ignored (e.g. collecting /etc/localtime) and which are explicitly requested by the application, piecing together multi-threaded/multi-process logic, etc. strace has a lot of functions to help with that which this doesn't support, like syscall filtering, struct decoding, and stack tracing.
- donaldihunter 2y ago
  Agreed, I'm a bit underwhelmed by intentrace when compared to the richness of strace. For sure, strace could maybe benefit from some UX like colorised output and a TUI that lets you filter syscalls while it is running.
  - donaldihunter 2y ago
    Mmmm: https://github.com/xfgusta/strace-with-colors https://github.com/xfgusta/strace-with-colors
- peter_d_sherman 2y ago
  >Knowing what each syscall does isn't really the hard part of strace, it's knowing which ones are important, which ones are part of libc itself and can usually be ignored An excellent point! More broadly, since many/most Linux/Unix/etc, programs use one or more libraries (which in turn could use one or more other libraries, etc., etc.), then one very important key for designers of any type of strace program, present or future, is: Can the traced system calls be set granularly, such that the individual libraries making syscalls (as opposed to the main program!) be identified individually, and possibly filtered in/out from the results accordingly? So, an excellent point!
oldstadium 2y ago
I'm the author of the repo, your comment seems to paint a false picture of linux syscalls being "very easy" to decipher from their names, filesystem calls like readlink, mkdir, and chmod are unfortunately the exception and not the rule. A syscall which I consider one of the more simple syscalls and I'd point you towards is `madvise` whose action can be customized with over 18 different flags, some of these flags create effects, and some of them have a `dispelling` effect and their purpose is not that obvious from the name. More complicated syscalls range from semi-decipherable with experience to entirely indecipherable, those syscalls will have arguments that can be a numbers/NULL/a pointer/the number -1, each with its own interpretation rules, some syscalls even have arguments that can be both a pointer or a numeric (int) depending on some other flag in a different argument, some syscalls have their entire logic encoded within multi-level structs like the `sigaction` syscall. the value that can be derived from something like intentrace becomes apparent when you consider that a lot of programmers don't want to peruse the man pages and in the same time want to wield the power of strace, it allows programmers of every walk to be able to skim a strace-like feed very fast obtaining the optimal amount of information needed to know "what wen't wrong", "how does this binary work", etc..

throwaway984393 2y ago

[dead]

cassianoleal 2y ago

> Strace for Everyone For a moment there I was excited to see strace on the Mac. Not for everyone, it seems.

nunez 2y ago
To be fair, we do have fs_usage and, if you disable SIP, dtrace. fs_usage is nowhere near as awesome and comprehensive as strace, but it's something.
- donaldihunter 2y ago
  Yes, I get by with dtruss which is inferior to strace but usually good enough. It's just a 1000 line dtrace program so I guess it could be improved.
cstrahan 2y ago
While it doesn't capture every syscall, you can get pretty far with the (seemingly little known) Endpoint Security Framework: https://developer.apple.com/documentation/endpointsecurity https://developer.apple.com/documentation/endpointsecurity I cobbled together a little tool at my previous job that would capture a full trace of all process fork+exec and file opens, which would then present all of these events in the usual tracing UI (like you'd get when view a trace of a single program with Tracy[1] or Perfetto[2]). We had a massive monorepo built with bazel and a heap of shell, and it wasn't clear which part of our code base was responsible for generating some mis-generated file. This tool gave me the whole inter-process call stack, complete with arguments and environment variables, letting me quickly find where and how to fix the problem. It's such a nice tool to have that it kinda blows my mind that no one has openly published anything like it. By leveraging eBPF on Linux, the same UI could be used on both macOS and Linux. If I had more time and energy, I'd do it myself. [1]: https://github.com/wolfpld/tracy https://github.com/wolfpld/tracy [2]: https://perfetto.dev/ https://perfetto.dev/