Re: (OT) Logging open calls from a C program (system call tracing tools)

[almut]

Not exactly a Perl question... (please at least mark as OT).   Anyway, use one of strace, truss, tusc, StraceNT, ... depending on platform.

Update: This node has gotten a higher reputation than I expected :)   So, as a kind of 'thank you!', and as there apparently exists some interest in the issue, I decided to add some more value (well, hopefully so). Sure, Google knows it all, too, but for easy quick reference...

• strace — Linux

  There is a companion tool ltrace for tracing calls to dynamic/shared libraries

• truss — Solaris, AIX (newer versions)

  Can trace library calls as well.

  (On older versions of AIX (< v5.1, IIRC), you had to enable kernel tracing, i.e. use some combination of trace, trcon, trcstop and trcrpt. This was logging all system calls of the entire system, so you had to postprocess the log to filter out what you were interested in.)

• tusc — HP-UX

  For older HP-UX boxen (10.20), there is a tool trace

• par — IRIX

  You almost always want the options par -s -SS  — But who uses IRIX these days, anyways?

• StraceNT — Windows

  Despite the 'NT' in its name, this also works on other versions.  Highly recommended.

• ktrace, kdump — MacOS X

  (thanks aufflick! — I immediately added that to my mental collection of syscall tracers, without which my daytime job would be much harder...)

BTW, several 'classical' Unices do feature an unrelated strace command... so, just because there is a program called strace, don't be fooled into believing that this is what you're looking for... (that's 'STREAMS trace', rather than syscall tracing).

Corrections, additions welcome.

[archfool]

lsof would work, too. (LiSt Open Files). Comes default with linux, can be compiled for other unix-es.

[Anno]

I don't think lsof can replace a call trace in this case. The requirement is

I need to see what files a program is opening,...

which I read as "List all files the program opens during its lifetime". With lsof you get a snapshot of the files that are open at the moment. You'll miss files that were open but have been closed again, as well as those the program hasn't opened yet.

Anno

[skx]

Very few things come as defaults with Linux - it will depend upon your distribution ..

[superfrink]

ktrace is also used on OpenBSD. Check for it on other BSD platforms if you happen to be use one.

Solaris 10 has a new tool called dtrace but as far as I know truss still works.

Update: You might also be able to use a debugger like gdb but I would use one of the tracing tools.