Strace

Strace on diagnostika ja silumistööriist, mis aitab lahendada programmidega seotud probleeme, mis logidest välja ei tule.

Täpsemalt võimaldab strace järgida, mis operatsioone ehk syscalle programmid täidavad. Linux system call või syscall on suhtlus kasutaja programmi user space ja kernel space vahel. Need vabastavad programeerija keerukatest madala taseme protseduuride kirjutamisest ning suurendavad süsteemi turvalisust

Syscallide tähendused:

read	read bytes from a file descriptor (file, socket)
write	write bytes from a file descriptor (file, socket)
open	open a file (returns a file descriptor)
close	close a file descriptor
fork	create a new process (current process is forked)
exec	execute a new program
connect	connect to a network host
accept	accept a network connection
stat	read file statistics
ioctl	set I/O properties, or other miscellaneous functions
mmap	map a file to the process memory address space
brk	extend the heap pointer
fchmod  change file permissions
fchown  change file ownership
fstat   retrieve details
lseek   move through file
statfs  retrieve file system related details

Paigaldamiseks debianis

apt-get install strace

Vaatame milliseid teeke või programme kasutatakse käsu ls käivitiamisel

# strace ls
execve("/bin/ls", ["ls"], [/* 18 vars */]) = 0
brk(NULL)                               = 0x620000
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=43121, ...}) = 0
mmap(NULL, 43121, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fc6be23a000
close(3)                                = 0
..
close(1)                                = 0
close(2)                                = 0
exit_group(0)                           = ?
+++ exited with 0 +++

Selles väljundis on näha tervet hulka erinevaid syscalle näiteks

open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3

Rida lahtiseletatuna:

• open – system calli tüüp
• (“/etc/ld.so.cache”, O_RDONLY|O_CLOEXEC) – systemcallile esitatud argument
• 3 – system call täitmisele järgnenud väljund

Töötava programmi nt mingi deemoni jälgimiseks tuleb anda käsk

# strace -p <PID>

Väljasta PId-i 24410 puhul vaid connect() ja accept() syscallid

# strace -econnect,accept -p 24410
strace: Process 24410 attached
accept(0, {sa_family=AF_LOCAL, NULL}, [2]) = 5
connect(8, {sa_family=AF_LOCAL, sun_path="/var/run/mysqld/mysqld.sock"}, 29) = 0
accept(0, {sa_family=AF_LOCAL, NULL}, [2]) = 5
connect(8, {sa_family=AF_LOCAL, sun_path="/var/run/mysqld/mysqld.sock"}, 29) = 0

https://www.linuxnix.com/10-strace-command-examples-linuxunix/

https://linux-audit.com/the-ultimate-strace-cheat-sheet/