mirror of
https://github.com/freebsd/freebsd-src.git
synced 2026-10-28 11:25:21 +01:00
Konstantin Belousov
151a8512bd
The new ptrace(2) features allow to change truss(1) to systematically operate on the process descriptors instead of pids. Allocate the global kqueue that tracks all noted children by pdopenpid()-ing them and adding to the kqueue with EVFILT_PROCDESC/NOTE_PDSIGCHLD. The activated knote triggers the pdwait() call to return the child tracing info. This replaces the waitid(P_ALL) call in the non-capsicumized truss(1) eventloop. Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D58094
325 lines
7.0 KiB
Groff
325 lines
7.0 KiB
Groff
.\"
|
|
.Dd August 31, 2026
|
|
.Dt TRUSS 1
|
|
.Os
|
|
.Sh NAME
|
|
.Nm truss
|
|
.Nd trace system calls
|
|
.Sh SYNOPSIS
|
|
.Nm
|
|
.Op Fl facedyDHS
|
|
.Op Fl o Ar file
|
|
.Op Fl s Ar strsize
|
|
.Op Fl t Ar expr
|
|
.Fl p Ar pid
|
|
.Nm
|
|
.Op Fl facedDHS
|
|
.Op Fl o Ar file
|
|
.Op Fl s Ar strsize
|
|
.Op Fl t Ar expr
|
|
.Ar command Op Ar args
|
|
.Nm
|
|
.Fl t
|
|
.Sh DESCRIPTION
|
|
The
|
|
.Nm
|
|
utility traces the system calls called by the specified process or program.
|
|
Output is to the specified output file, or standard error by default.
|
|
It does this by stopping and restarting the process being monitored via
|
|
.Xr ptrace 2 .
|
|
.Pp
|
|
By default,
|
|
.Nm
|
|
enters the capability mode
|
|
.Pq see Xr capsicum 4
|
|
after opening the output file and creating and
|
|
attaching to the target process.
|
|
An error to enter the mode is not fatal, but a warning is
|
|
issued to the standard error.
|
|
.Pp
|
|
The options are as follows:
|
|
.Bl -tag -width indent
|
|
.It Fl f
|
|
Trace descendants of the original traced process created by
|
|
.Xr fork 2 ,
|
|
.Xr vfork 2 ,
|
|
etc.
|
|
To distinguish events between processes,
|
|
the process ID
|
|
.Pq PID
|
|
of the process is included in the output of each event.
|
|
.It Fl a
|
|
Show the argument strings that are passed in each
|
|
.Xr execve 2
|
|
system call.
|
|
.It Fl c
|
|
Do not display individual system calls or signals.
|
|
Instead, before exiting, print a summary containing for each system call:
|
|
the total system time used,
|
|
the number of times the call was invoked,
|
|
and the number of times the call returned with an error.
|
|
.It Fl e
|
|
Show the environment strings that are passed in each
|
|
.Xr execve 2
|
|
system call.
|
|
.It Fl d
|
|
Include timestamps in the output showing the time elapsed
|
|
since the trace was started.
|
|
.It Fl D
|
|
Include timestamps in the output showing the time elapsed
|
|
since the last recorded event.
|
|
.It Fl H
|
|
Include the thread ID of in the output of each event.
|
|
.It Fl S
|
|
Do not display information about signals received by the process.
|
|
(Normally,
|
|
.Nm
|
|
displays signal as well as system call events.)
|
|
.It Fl y
|
|
Use the
|
|
.Sq classic
|
|
combination of
|
|
.Xr ptrace 2
|
|
and
|
|
.Xr waitpid 2
|
|
system calls to control the traced processes, instead of the
|
|
process descriptors and kqueue PROCDESC filter
|
|
.Pq see Xr pdfork 2 and Xr kqueue 2.
|
|
Do not try to enter capability mode.
|
|
.It Fl o Ar file
|
|
Print the output to the specified
|
|
.Ar file
|
|
instead of standard error.
|
|
.It Fl s Ar strsize
|
|
Display strings using at most
|
|
.Ar strsize
|
|
characters.
|
|
If the buffer is larger,
|
|
.Dq Li ...
|
|
will be displayed at the end of the string.
|
|
The default
|
|
.Ar strsize
|
|
is 32.
|
|
.It Fl t Ar expr
|
|
Report only the system calls selected by
|
|
.Ar expr ,
|
|
a comma-separated list of terms.
|
|
Whatever follows
|
|
.Fl t
|
|
is taken to be the
|
|
.Ar expr ,
|
|
so one must be given;
|
|
the sole exception is the third form shown above,
|
|
.Ql truss -t
|
|
with nothing after it,
|
|
which prints the groups described below and exits.
|
|
That is not the same as giving an empty
|
|
.Ar expr :
|
|
.Ql truss -t \(dq\(dq
|
|
is an expression with no terms in it,
|
|
and so filters nothing.
|
|
.Pp
|
|
Each term takes one of three forms:
|
|
.Bl -tag -width "@group" -offset indent
|
|
.It Ar name
|
|
The name of a system call,
|
|
as
|
|
.Nm
|
|
prints it,
|
|
for example
|
|
.Ql read .
|
|
A name may also contain the wildcards
|
|
.Ql * ,
|
|
.Ql \&?
|
|
and
|
|
.Ql []
|
|
described in
|
|
.Xr fnmatch 3 ,
|
|
in which case it selects every system call whose name it matches:
|
|
.Ql read*
|
|
selects
|
|
.Xr read 2 ,
|
|
.Xr readv 2
|
|
and
|
|
.Xr readlink 2
|
|
alike.
|
|
.It Ar number
|
|
A system call number in decimal,
|
|
for example
|
|
.Ql 3 .
|
|
The number is the one the ABI of the traced process uses,
|
|
so
|
|
.Ql 3
|
|
selects
|
|
.Xr read 2
|
|
from a native process but
|
|
.Fn close
|
|
from a Linux one.
|
|
.It Cm @ Ns Ar group
|
|
One of the groups of related system calls listed below,
|
|
for example
|
|
.Ql @file .
|
|
.El
|
|
.Pp
|
|
A term prefixed with
|
|
.Ql \&!
|
|
excludes the system calls it matches instead of including them.
|
|
The
|
|
.Ql \&!
|
|
applies only to the term it prefixes,
|
|
not to the terms that follow it.
|
|
.Pp
|
|
An expression whose terms are all negated subtracts from the set of
|
|
every system call;
|
|
any other expression selects from an empty set.
|
|
Terms are applied in the order they are given,
|
|
and the last one to match a system call decides whether it is reported.
|
|
Repeating
|
|
.Fl t
|
|
appends to the expression rather than replacing it,
|
|
so that
|
|
.Fl t Ar a Fl t Ar b
|
|
and
|
|
.Fl t Ar a , Ns Ar b
|
|
are equivalent.
|
|
An empty term is ignored,
|
|
which is why an empty
|
|
.Ar expr
|
|
filters nothing,
|
|
and why a stray comma is not an error.
|
|
.Pp
|
|
The groups are:
|
|
.Bl -tag -width ".Cm @signal" -compact -offset indent
|
|
.It Cm @all
|
|
every system call
|
|
.It Cm @creds
|
|
get or set process credentials
|
|
.It Cm @desc
|
|
operate on a file descriptor
|
|
.It Cm @file
|
|
operate on a pathname
|
|
.It Cm @ipc
|
|
System V and POSIX IPC
|
|
.It Cm @memory
|
|
memory mapping and locking
|
|
.It Cm @net
|
|
network and socket operations
|
|
.It Cm @none
|
|
no system call
|
|
.It Cm @proc
|
|
process and thread lifecycle
|
|
.It Cm @read
|
|
read data from a descriptor
|
|
.It Cm @signal
|
|
signal delivery and handling
|
|
.It Cm @time
|
|
clocks, timers and sleeping
|
|
.It Cm @write
|
|
write data to a descriptor
|
|
.El
|
|
.Pp
|
|
A group is itself defined by an expression of the same form as
|
|
.Ar expr ,
|
|
so a group may name other groups and may exclude as well as include:
|
|
.Cm @desc
|
|
is defined to include
|
|
.Cm @read
|
|
and
|
|
.Cm @write ,
|
|
and
|
|
.Cm @none
|
|
is defined as
|
|
.Ql \&!* .
|
|
.Pp
|
|
A system call is matched both under the name
|
|
.Nm
|
|
displays for it and under that name with any prefix naming a
|
|
compatibility layer or a non-native ABI removed,
|
|
so that
|
|
.Fl t Cm @file
|
|
selects
|
|
.Ql compat11.stat
|
|
and
|
|
.Ql linux_newstat
|
|
as well as
|
|
.Ql stat .
|
|
.Pp
|
|
A name or pattern that matches no system call of any ABI that
|
|
.Nm
|
|
understands is reported with a warning,
|
|
since it is almost always a typo,
|
|
but it is not an error:
|
|
the term is kept and simply never matches.
|
|
A number is not checked against any table,
|
|
as a process may issue any system call number the kernel can hold and
|
|
.Nm
|
|
reports the attempt whether or not a system call is implemented behind
|
|
it;
|
|
only a number too large to be one at all is rejected.
|
|
An unknown group is an error.
|
|
.It Fl p Ar pid
|
|
Follow the process specified by
|
|
.Ar pid
|
|
instead of a new command.
|
|
.It Ar command Op Ar args
|
|
Execute
|
|
.Ar command
|
|
and trace the system calls of it.
|
|
(The
|
|
.Fl p
|
|
and
|
|
.Ar command
|
|
options are mutually exclusive.)
|
|
.El
|
|
.Sh EXAMPLES
|
|
Follow the system calls used in echoing "hello":
|
|
.Dl $ truss /bin/echo hello
|
|
.Pp
|
|
Do the same, but put the output into a file:
|
|
.Dl $ truss -o /tmp/truss.out /bin/echo hello
|
|
.Pp
|
|
Follow an already-running process:
|
|
.Dl $ truss -p 34
|
|
.Pp
|
|
List the groups that
|
|
.Fl t
|
|
understands:
|
|
.Dl $ truss -t
|
|
.Pp
|
|
Show only the file and network activity of a command:
|
|
.Dl $ truss -t @file,@net fetch https://www.freebsd.org/
|
|
.Pp
|
|
Show everything a command does except its memory management:
|
|
.Dl $ truss -t '!@memory' make buildworld
|
|
.Pp
|
|
Show the descriptor activity of a running process apart from the
|
|
data transfers themselves:
|
|
.Dl $ truss -t '@desc,!@read,!@write' -p 34
|
|
.Pp
|
|
Count the
|
|
.Xr readlink 2
|
|
and
|
|
.Xr readlinkat 2
|
|
calls made while starting a program:
|
|
.Dl $ truss -c -t 'readlink*' /bin/ls
|
|
.Sh SEE ALSO
|
|
.Xr dtrace 1 ,
|
|
.Xr kdump 1 ,
|
|
.Xr ktrace 1 ,
|
|
.Xr pdfork 2 ,
|
|
.Xr pdtrace 2 ,
|
|
.Xr ptrace 2 ,
|
|
.Xr utrace 2 ,
|
|
.Xr fnmatch 3 ,
|
|
.Xr sysdecode 3 ,
|
|
.Xr capsicum 4
|
|
.Sh HISTORY
|
|
The
|
|
.Nm
|
|
command was written by
|
|
.An Sean Eric Fagan
|
|
for
|
|
.Fx .
|
|
It was modeled after
|
|
similar commands available for System V Release 4 and SunOS.
|