Unix and Linux Stack Exchange
Unix and Linux Stack Exchange

Questions tagged [ltrace]

17 questions
10
votes
2 answers

Which file in kernel specifies fork(), vfork()... to use sys_clone() system call

When ltrace is used for tracing the system calls, I could see that fork() uses sys_clone() rather than sys_fork(). But I couldn't find the linux source where it is defined. My program is: #include main() { int pid,i=0,j=0; …
user3539
  • 4,288
  • 9
  • 34
  • 44
8
votes
2 answers

How to determine what instructions a process is executing?

I know about strace and ltrace, but that only tells me what system calls and library calls a process is executing, respectively. I would like to know exactly what instructions a process is executing. Either assembly, or some sort of middle ground…
cat pants
  • 753
  • 5
  • 23
  • 38
6
votes
1 answer

ltracing shared libraries, how?

I would like to trace the function calls to a particular library, call it libfoo. Unfortunately the documentation I have found on it is sparse, so I have a lot of questions. In the documentation of libfoo, it lists the calls foo_a, foo_b, foo_c ..…
Mouse.The.Lucky.Dog
  • 2,027
  • 2
  • 26
  • 37
5
votes
2 answers

How do I hide TracerPID from a process?

I'm conjecturing SQL Server on Linux is checking /proc/self/status for TracerPID and then dying if it's not 0. I want to test that. Playing around, here is the strace, ... lots of stuff openat(AT_FDCWD, "/proc/self/status", O_RDONLY) = 5 fstat(5,…
Evan Carroll
  • 28,578
  • 45
  • 164
  • 290
4
votes
0 answers

Is there any solution to ltrace calls made by libs opened using dlopen()?

I wrote different two different types of queues. Bundled them in different .sos. I have a driver main.c which tests functions offered by those queues. main.c makes use dlfcn.h to load, unload required library at run-time. Both the implementations of…
Vishwajith.K
  • 45
  • 6
3
votes
1 answer

Why do strace and ltrace cause EINTR to happen?

Consider this program: #include #include int main(void) { int epfd = epoll_create1(0); struct epoll_event event; event.events = EPOLLIN; event.data.fd = 0; epoll_ctl(epfd, EPOLL_CTL_ADD, 0,…
Joseph Sible-Reinstate Monica
  • 3,298
  • 14
  • 27
3
votes
1 answer

System-wide monitoring of calls to a library function

I have a modern Linux desktop with lots of processes running concurrently. One of those processes, and I don't know which one, calls a function some_func from a popular dynamic library some_lib (think libc or libx11, so a lot of processes use it),…
undercat
  • 1,827
  • 1
  • 11
  • 19
3
votes
1 answer

Can getauxval be used to determine whether or not you're being traced?

Coming off of this question, I patched my kernel in a quest to get SQL Server 2017 on Linux to start up. Now I'm getting further but I'm being shut down, strstr("TracerPid:\t0\n", "TracerPid:") …
Evan Carroll
  • 28,578
  • 45
  • 164
  • 290
2
votes
1 answer

why does ltrace produce no output

For several days I have left this command running in a terminal emulator ltrace -p `pgrep xfwm4` while using the system normally, and I'm yet to see any output from ltrace. Note: xfwm4 is Xfce's window manager. Is this expected? A busy window…
Ernest A
  • 1,833
  • 4
  • 20
  • 28
2
votes
0 answers

How to trace at runtime the symbols of loaded shared library?

I want to be able to know what are the symbols that are used from a certain shared library at runtime. I use gdb and I set the solib-search-path to the user defined shared library. I am not sure if there is another way with ltrace
Bionix1441
  • 297
  • 6
  • 14
2
votes
0 answers

How to trace calls to library from library?

I have an program that calls libcurl, and libcurl calls libgssapi_krb5. If I want to debug calls to libcurl, then ltrace works. But now I want to debug calls to libgssapi_krb5, then ltrace my_program does not give out anything.
Magicloud
  • 733
  • 1
  • 6
  • 17
1
vote
1 answer

Timing system call with ltrace: Adding `syscall` + `clock_gettime`?

I'm looking for some clarity in terms of the system calls. I tried avoiding the vDSO by calling a system call clock_gettime directly. Here is a snippet of a program named sys_clock_gettime. int clock = CLOCK_MONOTONIC; struct timespec ts; if…
Xavier Merino
  • 177
  • 6
1
vote
1 answer

Are there any alternatives to ltrace that does the same job?

ltrace doesn't work on binaries linked with the -z now option—Check this question—which is the default on my Ubuntu 19.10 system. It only works on binaries linked with -z lazy. Is there any alternative to ltrace that does the same job, but works on…
SkullTech
  • 161
  • 5
1
vote
0 answers

Systemtap causes a segfault, why?

I'm trying to monitor library calls system-wide. I've written this script to trace library calls for libguestfs: probe begin { printf("ok\n") } probe process("/usr/lib64/libguestfs.so.0.471.0").function("*") { …
MoeKav
  • 31
  • 3
1
vote
2 answers

vfork() calls SYS_vfork but fork() calls SYS_clone?

After running ltrace -S on two programs that were compiled by gcc (version 5.4.0), one that calls vfork() and one that calls fork(), I find that vfork() calls SYS_vfork whilst fork() calls SYS_clone.  I could not find any information about this…
user2108462
  • 113
  • 5
1
2