Postmodern strace

Discover the postmodern uses of strace, extending its capabilities for process attachment, system call tracing, and more, with enhanced features, improved readability, and a modern output.

Key takeaways
  • Strace can include the state of process attachments and system call tracing.
  • Strace has now been colorized for several years, which helps with readability and debugging.
  • Strace can be used with the BPF (Berkeley Packet Filter) protocol to trace system calls.
  • Strace can now be used with the --utc option to format timestamps in a more consistent way.
  • Strace supports filtering system calls by their return status.
  • Strace can be used to trace specific process groups.
  • Strace can also be used to follow forked processes, provided the user is privileged.
  • Strace can be used to show the arguments passed to system calls.
  • Strace supports attaching to detached processes and following forks.
  • Strace can also be used to debug programs that use system calls in non-standard ways.
  • Strace has support for PLT (Procedure Linkage Table) tracing and can display this in a more readable format.
  • Strace also has a feature to print system call invocation with pretty printing.
  • Strace is now using a more modern and structured output.
  • Strace can also be used to trace new system calls that are added to the Linux kernel.
  • Strace is now under the GPLv2 license.
  • Strace is still improving with new features and bug fixes.