http://www.perlmonks.org?node_id=629326

Anonymous Monk has asked for the wisdom of the Perl Monks concerning the following question:

This node falls below the community's threshold of quality. You may see it by logging in.
  • Comment on (OT) Logging open calls from a C program

Replies are listed 'Best First'.
Re: (OT) Logging open calls from a C program (system call tracing tools)
by almut (Canon) on Jul 28, 2007 at 21:38 UTC

    Not exactly a Perl question... (please at least mark as OT).   Anyway, use one of strace, truss, tusc, StraceNT, ... depending on platform.

    Update: This node has gotten a higher reputation than I expected :)   So, as a kind of 'thank you!', and as there apparently exists some interest in the issue, I decided to add some more value (well, hopefully so). Sure, Google knows it all, too, but for easy quick reference...

    • strace — Linux

      There is a companion tool ltrace for tracing calls to dynamic/shared libraries

    • truss — Solaris, AIX (newer versions)

      Can trace library calls as well.

      (On older versions of AIX (< v5.1, IIRC), you had to enable kernel tracing, i.e. use some combination of trace, trcon, trcstop and trcrpt. This was logging all system calls of the entire system, so you had to postprocess the log to filter out what you were interested in.)

    • tusc — HP-UX

      For older HP-UX boxen (10.20), there is a tool trace

    • par — IRIX

      You almost always want the options par -s -SS  — But who uses IRIX these days, anyways?

    • StraceNT — Windows

      Despite the 'NT' in its name, this also works on other versions.  Highly recommended.

    • ktrace, kdump — MacOS X

      (thanks aufflick! — I immediately added that to my mental collection of syscall tracers, without which my daytime job would be much harder...)

    BTW, several 'classical' Unices do feature an unrelated strace command... so, just because there is a program called strace, don't be fooled into believing that this is what you're looking for... (that's 'STREAMS trace', rather than syscall tracing).

    Corrections, additions welcome.

[reply]
[d/l]
[select]
      lsof would work, too. (LiSt Open Files). Comes default with linux, can be compiled for other unix-es.
[reply]
        I don't think lsof can replace a call trace in this case. The requirement is

        I need to see what files a program is opening,...

        which I read as "List all files the program opens during its lifetime". With lsof you get a snapshot of the files that are open at the moment. You'll miss files that were open but have been closed again, as well as those the program hasn't opened yet.

        Anno

[reply]
[d/l]
[select]

        Very few things come as defaults with Linux - it will depend upon your distribution ..

        Steve
        --
[reply]
      ktrace is also used on OpenBSD. Check for it on other BSD platforms if you happen to be use one.

      Solaris 10 has a new tool called dtrace but as far as I know truss still works.

      Update: You might also be able to use a debugger like gdb but I would use one of the tracing tools.
[reply]
[d/l]
[select]
Logging system file calls from any Unix program
by aufflick (Deacon) on Jul 29, 2007 at 08:18 UTC
    As almut suggested, there are a number of tools (varying by flavour of Un*x) which let you watch the system calls made by a running program, regardless of what language it may be.

    For Linux, the program is strace, and you do something like this:

    $ strace perl -e 'open FOO, ">/tmp/foo"; print FOO "bar";'

...snip...

open("/tmp/foo", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = 3
ioctl(3, SNDCTL_TMR_TIMEBASE, 0xbfffe2f0) = -1 ENOTTY (Inappropriate i
+octl for device)
_llseek(3, 0, [0], SEEK_CUR)            = 0
fstat64(3, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
fcntl64(3, F_SETFD, FD_CLOEXEC)         = 0
brk(0)                                  = 0x8143000
brk(0x8144000)                          = 0x8144000
write(3, "bar", 3)                      = 3
close(3)                                = 0
exit_group(0)                           = ?

    [download]
    See the open in the first line? That's a call to the system function open. You can find out what all the arguments mean by running man 2 open in your shell. The 3 at the end of that line is the return of that function - it is the file handle for that opened file. You can then follow the write and close functions that relate to that file.

    You can use strace to watch what a running program is doing with the -p option, but be careful of doing this on a production box as some older versions of the linux kernel have a bug that could cause your program to halt when you exit strace.

    The equivalent of strace on Solaris is truss. On MacOS X you need a combination of ktrace and kdump (read both man pages).

[reply]
[d/l]
[select]

Back to Seekers of Perl Wisdom