knowledge base

Strace is really nice command to see what system calls are being used, it’s primary used as debugging tools for linux system calls

Q: What is a “system call” ?

A: System calls are interface via which user-space program interact with system using linux kernel.

So kernel is core that manages the system and talks and knows about hardware. Application don’t directly talk to hardware, they talk to kernel via some exposed interfaces(open, exec etc.).

Q: What is user-space and are there any other spaces ?

A: Yes we have user-space and kernel-space

• Kernel-space where only kernel is privileged to access memory or perform operation similarly
• User-space where user is allowed to access memory or perform operation

For longer and more accurate answer https://unix.stackexchange.com/a/368313

Below are some samples

• First sample usage: strace ls -l

• To dump output to a file: strace -o output.txt ls -l

• To get count of syscall: strace -c ls -l

• To get specific syscall: strace -e open ls -l

• To get timestamp for each syscall: strace -t ls -l

Reference:

• https://strace.io/
• https://www.youtube.com/watch?v=EG0ihttnEJI