Tracking System Calls & Signals

1. Using Strace
Tracking System Calls and Signals

2. What is Strace?
• A system program that traces system calls and
signals of any script or program
• Allows the customization of output to focus on the
area you need to examine
• Quickly see a permissions issue
• Find files that are opened and closed
• Helps to troubleshoot problems

3. How to use Strace?
• Installation done by running
/scripts/ensurerpm strace or
yum install strace
• Run the command “strace” with several options.
Here are a few examples:
strace -fvs 4096 $(SCRIPT)
f = follow forks
v = verbose output
s = output line size
(the size 4096 give this many characters)

4. How to use Strace?
• Additional options
• Example of using all useful options
This command will show all system calls and signals of cPanel, WHM or
Webmail UI actions
-o = output goes to this file
-p = process PID to strace
strace -fvs 4096 -o /root/cpservd.strace -p `cat /var/run/cpsrvd.pid`

5. How to use Strace?
• Advanced Use:
• Calls that can be traced:
strace -e trace=file will trace only file accesses
strace -e trace=network will trace only network activity
strace -e trace=open will trace only open system calls
strace -e trace=!open will trace all system calls except open
strace -e trace=open,close,read,write
strace -e trace=process
strace -e trace=signal

6. How to read Strace output?
• Strace shows System Calls:
• Strace shows the Signals received (but not where
they came from):
read
write
open
close
stat
fork
connect
getuid
getgid
setuid
setgid
execve
chmod
chown
SIGINT (ex. ctrl-c)
SIGKILL (kill -9)
ENOENT (file or directory not found)
EPERM (permission error) (chmod)
ENOPERM (permission error (chown)
EACCESS if -1 (permission denied)
SIGSEGV (Segmentation fault)

7. How to read output?
• Once you get the strace output, just view the output
file.
1. Start with the error message. Search through the log file for the error
messages displayed:
Example: 32116 write(1, “There was a problem creating the”, 32)=32
2. Then start scrolling up for the last action resulting in an error before the
error was written to stdout:
Example: 32116 open("/home/scooby/etc/snoopy.com/passwd",
O_WRONLY|O_CREAT|O_APPEND| O_LARGEFILE, 0666) = -1 EACCES
(Permission denied)

8. Strace will not show:
• Any program logic
• Computation
• Strace is not a debugger