Linux strace使用

男娘i 2022-05-12 15:46 174阅读 0赞

## 1、简介 ##

strace是Linux环境下的一款程序调试工具，用来监察一个应用程序所使用的系统呼叫及它所接收的系统信息。

Strace是一个基础的调试工具，strace常用来跟踪进程执行时的系统调用和所接收的信号。 在Linux世界，进程不能直接访问硬件设备，当进程需要访问硬件设备(比如读取磁盘文件，接收网络数据等等)时，必须由用户态模式切换至内核态模式，通过系统调用访问硬件设备。strace可以跟踪到一个进程产生的系统调用,包括参数，返回值，执行消耗的时间。

## 2、下载 ##

下载地址：[http://sourceforge.net/projects/strace/][http_sourceforge.net_projects_strace]

\[oracle@xml-ora1 ~\]$ wgethttp://nchc.dl.sourceforge.net/project/strace/strace/4.7/strace-4.7.tar.xz

## 3、解压安装 ##

这种文件是使用tar打包后再压缩生成的。解压方法是：

1、xz -d \*\*.tar.xz

2、tar -xvf \*\*.tar

如没有按照xz工具，则首先需要下载、安装xz工具：[http://tukaani.org/xz/][http_tukaani.org_xz]

\[oracle@xml-ora1 ~\]$ wget http://tukaani.org/xz/xz-5.0.4.tar.gz

\[oracle@xml-ora1 ~\]$ tar -zxvf xz-5.0.4.tar.gz

\[oracle@xml-ora1 ~\]$ cd xz-5.0.4

\[oracle@xml-ora1 xz-5.0.4\]$ ./configure

\[oracle@xml-ora1 xz-5.0.4\]$ make

\[oracle@xml-ora1 xz-5.0.4\]$ sudo make install

\[oracle@xml-ora1 ~\]$ xz --help

Usage: xz \[OPTION\]... \[FILE\]...

Compress or decompress FILEs in the .xzformat.

-z,--compress      force compression

**-d, --decompress    force decompression**

-t,--test          test compressed fileintegrity

-l,--list          list information about.xz files

-k,--keep          keep (don't delete) inputfiles

-f,--force         force overwrite of outputfile and (de)compress links

-c,--stdout        write to standard outputand don't delete input files

-0... -9           compression preset;default is 6; take compressor \*and\*

decompressor memory usageinto account before using 7-9!

-e,--extreme       try to improvecompression ratio by using more CPU time;

does not affectdecompressor memory requirements

-q,--quiet         suppress warnings;specify twice to suppress errors too

-v,--verbose       be verbose; specify twicefor even more verbose

-h,--help          display this short helpand exit

-H,--long-help     display the long help(lists also the advanced options)

-V,--version       display the versionnumber and exit

With no FILE, or when FILE is -, readstandard input.

Report bugs to<lasse.collin@tukaani.org> (in English or Finnish).

XZ Utils home page:<http://tukaani.org/xz/>

\[oracle@xml-ora1 ~\]$ xz -d strace-4.7.tar.xz

\[oracle@xml-ora1 ~\]$ ls

strace-4.7.tar

\[oracle@xml-ora1 ~\]$ tar -xvf strace-4.7.tar

\[oracle@xml-ora1 strace-4.7\]$ ./configure

\[oracle@xml-ora1 strace-4.7\]$ make

\[oracle@xml-ora1 strace-4.7\]$ sudo make install

## 4、命令说明 ##

\[oracle@xml-ora1 strace-4.7\]$ strace --help

strace: invalid option -- -

usage: strace \[-CdffhiqrtttTvVxxy\] \[-I n\] \[-eexpr\]...

\[-a column\] \[-o file\] \[-sstrsize\] \[-P path\]...

-p pid... / \[-D\] \[-E var=val\]...\[-u username\] PROG \[ARGS\]

or: strace -c\[df\] \[-I n\] \[-e expr\]... \[-O overhead\] \[-S sortby\]

-p pid... / \[-D\] \[-E var=val\]...\[-u username\] PROG \[ARGS\]

\-c -- count time, calls, and errors foreach syscall and report summary统计每一系统调用的所执行的时间,次数和出错的次数等.

\-C -- like -c but also print regular output和-c参数意义，但是输出更多信息

\-d -- enable debug output to stderr   输出strace关于标准错误的调试信息.

\-D -- run tracer process as a detachedgrandchild, not as parent

\-f -- follow forks, -ff -- with output intoseparate files   告诉strace同时跟踪fork出来的进程

\-F -- attempt to follow vforks (deprecated,use -f)  告诉strace同时跟踪vfork出来的进程

\-i -- print instruction pointer at time ofsyscall     输出系统调用的入口指针.

\-q -- suppress messages about attaching,detaching, etc.   禁止输出关于脱离的消息

\-r -- print relative timestamp, -t --absolute timestamp, -tt -- with usecs  打印出时间，tt表示微妙

\-T -- print time spent in each syscall  打印出每个系统调用的耗费时间

\-v -- verbose mode: print unabbreviatedargv, stat, termios, etc. args输出strace的版本信息

\-x -- print non-ascii strings in hex, -xx-- print all strings in hex以十六进制形式输出非标准字符串

\-y -- print paths associated with filedescriptor arguments

\-h -- print help message, -V -- printversion输出简要的帮助信息.

\-a column -- alignment COLUMN for printingsyscall results (default 40)设置结果的输出默认位置40

\-e expr -- a qualifying expression:  指定一个表达式,用来控制如何跟踪.格式如下

option=\[!\]all or option=\[!\]val1\[,val2\]...

options: trace, abbrev, verbose, raw, signal, read, or write

\-e trace=set

只跟踪指定的系统调用.例如:-e trace=open,close,rean,write表示只跟踪这四个系统调用.默认的为set=all

\-e trace=file

只跟踪有关文件操作的系统调用.

\-e trace=process

只跟踪有关进程控制的系统调用.

\-e trace=network

跟踪与网络有关的所有系统调用.

\-estrace=signal

跟踪所有与系统信号有关的系统调用

\-e trace=ipc

跟踪所有与进程通讯有关的系统调用

\-eabbrev=set

设定 strace输出的系统调用的结果集.-v 等与 abbrev=none.默认为abbrev=all.

\-e raw=set

将指 定的系统调用的参数以十六进制显示.

\-esignal=set

指定跟踪的系统信号.默认为all.如signal=!SIGIO(或者signal=!io),表示不跟踪SIGIO信号.

\-e read=set

输出从指定文件中读出的数据.例如:

\-e read=3,5

\-e write=set

输出写入到指定文件中的数据.

\-I interruptible --

1:no signals are blocked

2:fatal signals are blocked while decoding syscall (default)

3:fatal signals are always blocked (default if '-o FILE PROG')

4:fatal signals and SIGTSTP (^Z) are always blocked

(useful to make 'strace -o FILE PROG' not stop on ^Z)

\-o file -- send trace output to FILEinstead of stderr  将strace的输出写入文件filename

\-O overhead -- set overhead for tracingsyscalls to OVERHEAD usecs

\-p pid -- trace process with process idPID, may be repeated跟踪指定的进程pid.

\-s strsize -- limit length of print stringsto STRSIZE chars (default 32)  指定输出的字符串的最大长度.默认为32.文件名一直全部输出

\-S sortby -- sort syscall counts by: time,calls, name, nothing (default time)

\-u username -- run command as usernamehandling setuid and/or setgid以username 的UID和GID执行被跟踪的命令

\-E var=val -- put var=val in theenvironment for command输出变量值

\-E var -- remove var from the environmentfor command

\-P path -- trace accesses to path

## 5、实例使用 ##

### 5.1 一个简单的跟踪 ###

有个文件a.txt，我们跟踪下cat文件的系统调用过程：

\[oracle@xml-ora1 ~\]$ cat a.txt

hello welcome!

12344

\[oracle@xml-ora1 ~\]$ strace -o cat.log cat a.txt

hello welcome!

12344

\[oracle@xml-ora1 ~\]$ cat cat.log

execve("/bin/cat",\["cat", "a.txt"\], \[/\* 30 vars \*/\]) = 0

open("/lib/libc.so.6",O\_RDONLY)        = 3

open("/etc/ld.so.cache",O\_RDONLY)      = 3

open("/lib64/libc.so.6",O\_RDONLY)      = 3

open("a.txt", O\_RDONLY)                 = 3

fstat(3, \{st\_mode=S\_IFREG|0644, st\_size=21,...\}) = 0

read(3, "hellowelcome!\\n12344\\n", 4096) = 21

write(1, "hellowelcome!\\n12344\\n", 21) = 21

read(3, "", 4096)                       = 0

close(3)                                = 0

close(1)                                = 0

exit\_group(0)                           = ?

\+++ exited with 0 +++

跟踪文件cat.log里一大堆的东西，前面大部分都是在读取系统环境信息以及库文件，最后才是cat调用系统的信息。同时可以看到一个现象，只有是Open=3的，则说明加载库文件成功，而=-1的加载失败。

### 5.2 oracle sqlplus跟踪 ###

\[oracle@xml-ora1 ~\]$ strace -o sqlplus-trace.txtsqlplus / as sysdba

SQL\*Plus: Release 10.2.0.4.0 - Productionon Wed Dec 19 15:32:39 2012

Connected to:

Oracle Database 10g Enterprise EditionRelease 10.2.0.4.0 - 64bit Production

With the Partitioning, OLAP, Data Miningand Real Application Testing options

SQL> exit

\[oracle@xml-ora1 ~\]$ cat sqlplus-trace.txt | more

加载执行的程序路径，环境变量，系统库信息

execve("/u01/app/oracle/product/10.2/db\_1/bin/sqlplus",\["sqlplus", "/", "as", "sysdba"\], \[/\*30 vars \*/\]) = 0

brk(0)                                  = 0xe747000

mmap(NULL, 4096, PROT\_READ|PROT\_WRITE,MAP\_PRIVATE|MAP\_ANONYMOUS, -1, 0) = 0x2ae1dec57000

uname(\{sys="Linux",node="xml-ora1", ...\}) = 0

open("/u01/app/oracle/product/10.2/db\_1/lib/libsqlplus.so",O\_RDONLY) = 3

open("/u01/app/oracle/product/10.2/db\_1/lib/libclntsh.so.10.1",O\_RDONLY) = 3

open("/u01/app/oracle/product/10.2/db\_1/lib/libnnz10.so",O\_RDONLY) = 3

open("/lib/libdl.so.2",O\_RDONLY)       = 3

open("/etc/ld.so.cache",O\_RDONLY)      = 3

open("/lib64/libdl.so.2",O\_RDONLY)     = 3

open("/lib/libm.so.6",O\_RDONLY)        = 3

open("/lib64/libm.so.6",O\_RDONLY)      = 3

open("/lib/libpthread.so.0", O\_RDONLY)  = 3

open("/lib64/libpthread.so.0",O\_RDONLY) = 3

open("/lib/libnsl.so.1",O\_RDONLY)      = 3

open("/lib64/libnsl.so.1",O\_RDONLY)    = 3

open("/lib/libc.so.6",O\_RDONLY)        = 3

open("/lib64/libc.so.6",O\_RDONLY)      = 3

以下是加载oracle字符集文件

open("/u01/app/oracle/product/10.2/db\_1/nls/data/lx1boot.nlb",O\_RDONLY) = 3

open("/u01/app/oracle/product/10.2/db\_1/nls/data/lx00001.nlb",O\_RDONLY) = 3

open("/u01/app/oracle/product/10.2/db\_1/nls/data/lx20001.nlb",O\_RDONLY) = 3

open("/u01/app/oracle/product/10.2/db\_1/nls/data/lx10001.nlb",O\_RDONLY) = 3

open("/u01/app/oracle/product/10.2/db\_1/nls/data/lx31040.nlb",O\_RDONLY) = 3

open("/u01/app/oracle/product/10.2/db\_1/nls/data/lx40001.nlb",O\_RDONLY) = 3

以下加载sqlplus的一些文件，待研究，有些名字很清晰表达了组件的作用

open("/etc/hosts", O\_RDONLY)            = 8

open("/u01/app/oracle/product/10.2/db\_1/sqlplus/mesg/sp1us.msb",O\_RDONLY) = 3

open("/u01/app/oracle/product/10.2/db\_1/sqlplus/mesg/sp2us.msb",O\_RDONLY) = 4

open("/u01/app/oracle/product/10.2/db\_1/sqlplus/mesg/cpyus.msb",O\_RDONLY) = 5

open("/etc/localtime",O\_RDONLY)        = 6

open("/u01/app/oracle/product/10.2/db\_1/oracore/zoneinfo/timezlrg.dat",O\_RDONLY) = 6

输出交互信息到屏幕

write(1, "\\n", 1)                       = 1

write(1, "SQL\*Plus: Release 10.2.0.4.0- P"..., 70) = 70

write(1, "\\n", 1)                       = 1

初始化sqlplus

getcwd("/home/oracle", 256)             = 13

access("/u01/app/oracle/product/10.2/db\_1/network/admin/sqlnet.ora",F\_OK) = 0

open("/u01/app/oracle/product/10.2/db\_1/network/admin/sqlnet.ora",O\_RDONLY) = 7

open("/etc/passwd",O\_RDONLY)           = 7

open("/u01/app/oracle/product/10.2/db\_1/sqlplus/admin/glogin.sql",O\_RDONLY) = 8

write(1, "SQL> ", 5)

这个就是SQLPLUS初始化的过程，当然可以加上-f选项，此时看到的就是更详细的调用了。

[http_sourceforge.net_projects_strace]: http://sourceforge.net/projects/strace/
[http_tukaani.org_xz]: http://tukaani.org/xz/

Linux strace使用

发表评论取消回复

还没有评论，来说两句吧...

相关阅读

相关 .strace如何使用

相关 Linux strace命令

相关【Linux】strace命令

相关 linux中的strace

相关 Linux strace命令

相关 Linux strace命令

相关 Linux strace使用

相关 Linux strace命令

相关 linux strace命令简介

相关 Linux strace命令案例一