strace-ltrace

strace / ltrace

用途

指导 Agent 使用 strace 跟踪系统调用，并使用 ltrace 跟踪库调用——这是在程序没有崩溃、也没有调试器的情况下，诊断二进制程序行为异常最有效的工具。

触发条件

• “我的程序行为异常，如何跟踪它的操作？”
• “如何查找二进制程序正在打开哪些文件？”
• “strace 显示 ENOENT，该如何解读？”
• “如何使用 strace 跟踪网络调用？”
• “ltrace 是什么？它与 strace 有何不同？”
• “如何跟踪正在运行的进程？”

工作流

1. strace 基本用法

# Trace all syscalls of a command
strace ./myapp arg1 arg2

# Attach to running process
strace -p 12345

# Trace child processes too (-f = follow fork)
strace -f ./myapp

# Save to file (raw output — not stdout)
strace ./myapp 2> trace.txt

# Most useful: timestamps + summary
strace -t -f ./myapp 2>&1 | head -100

2. 按系统调用类别筛选

# Trace file operations only
strace -e trace=file ./myapp

# Trace network syscalls
strace -e trace=network ./myapp

# Trace specific syscalls
strace -e trace=open,openat,read,write ./myapp

# Trace process management
strace -e trace=process ./myapp

# Trace memory operations
strace -e trace=memory ./myapp

# Trace signals
strace -e trace=signal ./myapp

# Multiple categories
strace -e trace=file,network ./myapp

类别	包含的系统调用
file	open、openat、stat、access、unlink、rename，……
network	socket、connect、bind、accept、send、recv，……
process	fork、exec、wait、clone、exit，……
memory	mmap、munmap、mprotect、brk，……
signal	kill、sigaction、sigprocmask，……
ipc	pipe、socket pair、shmget，……
desc	close、dup、poll、select、epoll，……

3. 解读常见错误

# See return values and errors
strace -e trace=file ./myapp 2>&1 | grep -E "ENOENT|EPERM|EACCES|ENOTSUP"

错误	含义	常见原因
ENOENT	文件或目录不存在	配置文件缺失、路径错误
EACCES	权限被拒绝	文件权限、SELinux
EPERM	操作不被允许	缺少 capability、需要 suid
EADDRINUSE	地址已被占用	端口已绑定
ETIMEDOUT	连接超时	网络不可达、防火墙
ECONNREFUSED	连接被拒绝	服务端未在监听
EAGAIN	资源暂时不可用	非阻塞 I/O，请重试
ENOMEM	内存不足	分配失败
EBADF	文件描述符无效	使用了已关闭或无效的 fd
ENOEXEC	执行格式错误	二进制格式与架构不匹配

# Find what file is not found
strace ./myapp 2>&1 | grep 'ENOENT'
# Example output:
# openat(AT_FDCWD, "/etc/myapp.conf", O_RDONLY) = -1 ENOENT (No such file or directory)
# → Config file expected at /etc/myapp.conf

4. 实用的 strace 标志

# Show strings fully (default truncates at 32 chars)
strace -s 256 ./myapp

# Timestamps
strace -t ./myapp     # wall clock time
strace -T ./myapp     # time spent in each syscall
strace -r ./myapp     # relative timestamps

# System call count summary
strace -c ./myapp
# Shows count, time, errors per syscall — great for profiling

# Trace with PIDs in output (for -f)
strace -f -p ./myapp
# Output: [pid 12346] open("/etc/passwd", O_RDONLY) = 3

# Decode numerical arguments
strace -e verbose=all ./myapp

# Print instruction pointer at each syscall
strace -i ./myapp

5. ltrace——库调用跟踪

# Trace all library calls
ltrace ./myapp

# Trace specific library function
ltrace -e malloc,free,fopen ./myapp

# Trace nested calls (lib → lib)
ltrace -n 2 ./myapp   # indent nested calls

# Trace with syscalls too
ltrace -S ./myapp

# Attach to running process
ltrace -p 12345

# Summary statistics
ltrace -c ./myapp

典型的 ltrace 输出：

malloc(1024) = 0x55a1b2c3d000
fopen("/etc/myapp.conf", "r") = 0
free(0x55a1b2c3d000) = <void>

strace 与 ltrace 的对比：

	strace	ltrace
跟踪对象	内核系统调用	用户空间库调用
开销	较低	较高（PLT 钩子）
显示内容	open()、read()、write()	fopen()、malloc()、printf()
适用场景	二进制程序与操作系统、文件或网络交互	二进制程序调用了你无法看到的库函数

6. 实用诊断工作流

# Find missing config file
strace -e trace=openat,open ./myapp 2>&1 | grep ENOENT

# Find what network connections are made
strace -e trace=network -f ./myapp 2>&1 | grep connect

# Debug dynamic library loading failures
strace -e trace=openat ./myapp 2>&1 | grep "\.so"

# Find permission issues
strace -e trace=file ./myapp 2>&1 | grep -E "EACCES|EPERM"

# Debug slow startup (find where time is spent)
strace -c ./myapp 2>&1
# Look for high % time in unexpected syscalls

# Watch IPC/shared memory
strace -e trace=ipc,shm ./myapp

# Find what the binary exec's
strace -e trace=execve -f ./myapp

7. seccomp 过滤器调试

如果程序被 seccomp 策略终止，strace 会显示触发该策略的系统调用：

strace -e trace=all ./myapp 2>&1 | tail -5
# Often shows the last syscall before SIGSYS

有关 strace 输出模式和 ltrace 筛选示例，请参阅 references/strace-patterns.md。

相关技能

• 当 strace 显示了故障位置，且你需要检查内部细节时，使用 skills/debuggers/gdb
• 使用 skills/binaries/elf-inspection 了解二进制程序使用了哪些库和符号
• 使用 skills/binaries/dynamic-linking 诊断 LD_* 和库加载问题
• 使用 skills/profilers/linux-perf 进行性能分析（strace 的开销对于性能分析来说过高）