strace: How to ascertain if a system call has called another system call?

Question

"strace is a system call tracer, i.e. a debugging tool which prints out a trace of all the system calls made by a another process/program." What if the systems calls works recursively or one system call calls another system call. How can I get this information?

Possible Solution - We can create a simple variable indent, which we increment when we enter a system call and decrement when we exit. Now just print "indent" number of spaces before each call. So we can get something like this -

05:31:09.449402 getpriority(PRIO_PROCESS, 0) = 20
05:31:09.450514 ioctl(7, 0xc0186201, 0xbef86ac0) = 0
05:31:09.451817  ioctl(7, 0xc0186201, 0xbef86c10) = 0
05:31:09.524328 writev(4, [{"\4", 1}, {"ServiceManager\0", 15}, {"ServiceManager: addService(SMS, 0x15988)\n\0", 42}], 3) = 58
05:31:09.526862  futex(0x134ac, FUTEX_WAKE, 2147483647) = 0
05:31:09.527847   getpriority(PRIO_PROCESS, 0) = 20
05:31:09.528758 ioctl(7, 0xc0186201, 0xbef86ac0) = 0
05:31:09.529847 ioctl(7, 0xc0186201, 0xbef86c10) = 0

Does strace or some other tool already provides this functionality or do I need to change the source code for achieving this?

You may have been thinking of library calls calling each other. In this case, you want ltrace. Or, if you actually want to look at which kernel functions are calling each other, you want ftrace. — Robin Green
– Robin Green, Commented Apr 9, 2011 at 17:50

Simon Richter · Accepted Answer · 2011-03-17 13:27:48Z

6

System calls are defined as the boundary between kernel and user space, so any recursion there happens inside the kernel and cannot be intercepted.

strace works by attaching to the process as a debugger, letting it run free except when a system call is triggered, at which point the parameters and return values are printed. It has no knowledge of what goes on inside the kernel.

answered Mar 17, 2011 at 13:27

Simon Richter

29.7k1 gold badge49 silver badges70 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Bruce Over a year ago

strace can tell when a system call was requested and when did it complete. "-T" option records the time difference between the beginning and the end of each system call. So we can at least tell whether a system call was called from another system call. Please correct me if I am wrong.

jschmier Over a year ago

@Bruce - The strace utility records the time when the application requested system call transfers control to the kernel and the time when control is returned. While the kernel is servicing the requested system call, the requesting application has no knowledge of what the kernel is doing. If the kernel were to request an additional system call prior to returning control to the application, it would not show up in the strace output.

Simon Richter Over a year ago

Also, the kernel does not need to use a system call to talk to itself -- this is only necessary at the boundary between user and kernel space.

Leo · Accepted Answer · 2015-11-24 00:58:29Z

0

If you have root access, you can use ftrace to trace kernel function calls, and filter by the names of the kernel-side syscall interfaces. Use function_graph as the tracer (see https://lwn.net/Articles/366796/ for an explanation). Since the "original syscall" also passed through such a call, you would clearly see a post-syscall call within a post-syscall call. Fair warning: I'm not sure how frequent is this scenario.

answered Nov 24, 2015 at 0:58

Leo

1,0021 gold badge9 silver badges11 bronze badges

Collectives™ on Stack Overflow

strace: How to ascertain if a system call has called another system call?

2 Answers 2

3 Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Related