0

So I wanted to know how files are opened by zsh like .xinitrc, .xprofile, .zprofile, and exactly in which order. So I have decided to strace on zsh process with the grep command to see how the open system call is called and eventually I can decide and order how these files are loaded.

My command:

strace zsh | grep open

but as soon as I ran this it kept showing me the output for zsh and grep is not working. when I end the process with ctrl+d also nothing happens.

So is there any way to get this grep output on this kind of process?

Visrut
  • 135
  • 3
  • Related: [how to keep stty sane after piping `strace` to `vim`?](https://unix.stackexchange.com/q/588518/108618) See my answer there. I think `-o` will help you. – Kamil Maciorowski Mar 08 '23 at 12:24
  • 1
    Read the [documentation of `strace`](https://linux.die.net/man/1/strace). It has options to limit the output to selected calls, e.g. `strace -e trace=open` or ...`-e trace=file` – Bodo Mar 08 '23 at 12:24
  • @Bodo so I have used this command `strace zsh -e trace=open` but it also outputs some other stuff and I can't see any `.zprofile`, `.zshrc` in output, so does it also manipulate execution flow of a process? – Visrut Mar 08 '23 at 12:42
  • `strace -e trace=open -o output.txt zsh` – Bodo Mar 08 '23 at 12:49
  • @Bodo I ran it, and it gives me this kind of lines ` --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=276345, si_uid=1002, si_status=0, si_utime=0, si_stime=0} --- --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=276346, si_uid=1002, si_status=0, si_utime=0, si_stime=0} --- ` – Visrut Mar 08 '23 at 12:51
  • 1
    `xinitrc` has nothing to do with zsh, that's a config file for `xinit`, not `zsh`. – Stéphane Chazelas Mar 08 '23 at 12:51
  • You can search or filter the outout file. If you don't see any `open` you might have to specify options to `zsh` because not all files will be used in all situations, e.g. only for login shells or interactive shells, or the shell might have used other calls to check if the file is present before it would call `open`. `-e trace=file` will trace all calls that contain a filename. – Bodo Mar 08 '23 at 13:05

1 Answers1

0

strace sends its output to stderr by default.

Here, you could do:

strace -o >(grep --color open >&2) zsh

To run zsh while seeing all system calls that have open anywhere in the name or arguments or return value or:

strace -e /open zsh

(short for strace -e trace=/open zsh) or:

To see the system calls that have open in their name (such as open, openat, pidfd_open, mq_open, open_by_handle_at, perf_event_open list might not be accurate depending on what system and version thereof you're on).

Or:

strace -e open,openat zsh

For only those two system calls.

That output goes to the terminal along with the shell's prompt and command outputs. You may prefer to send it to a file that you can inspect later on or live in a separate terminal or screen/tmux pane:

strace -o >(grep --color open > strace.log) zsh
strace -e /open -o strace.log zsh

To also strace calls made in child processes (including by commands executed there and their children), you'd need the -f option.

So see what opens your ~/.xinitrc (which has nothing to do with zsh) and when, you can use the audit system (may not be installed/enabled by default on your system).

Stéphane Chazelas
  • 522,931
  • 91
  • 1,010
  • 1,501
  • thanks this works, but for some reason, it also corrupts my `tty` and does not end the `zsh` process is there any solution for that as well? – Visrut Mar 08 '23 at 12:43
  • 1
    @Visrut, why would it end `zsh`? When should it end it? If you don't want the strace output to go to the tty, redirect it to a file. – Stéphane Chazelas Mar 08 '23 at 12:46