How to see system call that executed in current time by process?

Question

Linux utility "strace" show the list of syscall that started after run of strace. How I can see syscall that run in current moment by process? before start of strace.

You open a console window and start typing /usr/sbin.... dang the current time is over, it's already the next moment! Missed it! Next time start a couple of moments earlier than the current time! — n. m. could be an AI
– n. m. could be an AI, Commented Mar 8, 2017 at 17:20
I agree. I will reformulate my question: how to see the system calls that are currently being executed by the process? — Dmity P.
– Dmity P., Commented Mar 8, 2017 at 18:11

Catalin · Accepted Answer · 2017-08-18 09:03:00Z

8

proc offers some information about what the kernel is currently doing "for" a process
/proc/${pid}/syscall /proc/${pid}/stack

More information:

answered Aug 18, 2017 at 9:03

Catalin

3444 silver badges6 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Mayank Sharma · Accepted Answer · 2018-10-02 23:31:51Z

6

Assuming that you know the PID of the of process, you can simply use strace to track all the syscalls being made in realtime.

strace -p PID

answered Oct 2, 2018 at 23:31

Mayank Sharma

1803 silver badges9 bronze badges

Comments

hek2mgl · Accepted Answer · 2020-10-16 07:26:40Z

You find that out using ps:

ps -p PID_OF_PROC -ocmd,stat,wchan

The wchan is the key here. From man ps:

wchan WCHAN name of the kernel function in which the process is sleeping, a "-" if the process is running, or a "*" if the process is multi-threaded and ps is not displaying threads.

PROCESS STATE CODES Here are the different values that the s, stat and state output specifiers (header "STAT" or "S") will display to describe the state of a process:

           D    uninterruptible sleep (usually IO)
           R    running or runnable (on run queue)
           S    interruptible sleep (waiting for an event to complete)
           T    stopped by job control signal
           t    stopped by debugger during the tracing
           W    paging (not valid since the 2.6.xx kernel)
           X    dead (should never be seen)
           Z    defunct ("zombie") process, terminated but not reaped by its parent

  For BSD formats and when the stat keyword is used, additional characters may be displayed:

          <    high-priority (not nice to other users)
          N    low-priority (nice to other users)
          L    has pages locked into memory (for real-time and custom IO)
          s    is a session leader
          l    is multi-threaded (using CLONE_THREAD, like NPTL pthreads do)
          +    is in the foreground process group

Useful, but kernel function and syscall are not necessarily the same.
PS: Just saw the accepted answer in this thread, looks like that's the way to go
wchan is the top frame of what is shown in /proc/pid/stack (when the process is not in TASK_RUNNING state)

Collectives™ on Stack Overflow

How to see system call that executed in current time by process?

3 Answers 3

Comments

Comments

4 Comments

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

4 Comments

Related