Using Strace to Trace Problems

Sadly, it's "forbidden" to strace /sbin/init, says the manual.

Naughty as I am, I tried out, and found one _can_ strace init, even if forbidden! The sentence for doing the forbidden thing is weird behaviour.

Also, sadly, the 'recursive' strace mode only traces 'direct' child processes. So, if you recursively strace 'rc' instead of sbin, only new 'rc' processes are traced, and not any process the rc process spawns.

Therefore, as I found out, strace is not a suitable tool to find out which bunch of files is accessed during boot (to perform "predictive readahead")

Nonetheless, it's still a very useful and interesting tool.

Quoting:Also, sadly, the 'recursive' strace mode only traces 'direct' child processes.

I just did an strace on a recursive shell script that called itself four extra times. "strace" clearly followed every fork/exec.

Only if it calls itself, if the script calls 'lsof' for example, strace doesn't trace 'lsof' as well, it seems.

My script calls itself, and also calls "ps", which is also traced, as seen in the kernel calls to write(). Here, try it out:

#!/bin/bash

if [ "$1" == "5" ] ; then echo "At the bottom" ps afx | grep bash else eval $0 `expr $1 + 1` fi

Oh you serious geeks anyway. Here is a more useful bash script, and you can time it for singing along by adjusting the 'sleep' value (in seconds):

x="bottles of beer";y="on the wall";for b in {99..1};do echo "$b $x $y, $b $x. Take one down pass it around, $(($b-1)) $x $y"; sleep 3;done

You partypooper! I just thought we had a new record of 4 posts on topic without digressing, and then you start tracing beer.

gus3: Interesting, but I'm not sure if it can help me finding out all files needed for a default boot. Seems auditctl is a better idea for such, but I never tried it. I think I should!