Como registrar todas as chamadas do sistema feitas por um programa, digamos, chrome, usando a auditoria do Linux?

Question

autrace pode registrar as chamadas do sistema feitas por um programa, executando-o. Eu quero registrar as chamadas do sistema de programas já em execução. Isso pode ser feito encontrando o id do processo, mas existe alguma outra maneira elegante? O que pode estar usando o arquivo executável chrome como um parâmetro para registrar as chamadas do sistema geradas por ele?

    

Answer 1

Como o @Patrick declarou nos comentários, você pode usar a ferramenta de linha de comando strace para produzir um despejo das chamadas do sistema feitas por um programa durante a execução.

Exemplo

Veja um exemplo mostrando o comando echo hi sendo executado.

$ strace echo "hi"
execve("/usr/bin/echo", ["echo", "hi"], [/* 94 vars */]) = 0
brk(0)                                  = 0xf73000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9996cf2000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=206010, ...}) = 0
mmap(NULL, 206010, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f9996cbf000
close(3)                                = 0
open("/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "7ELF
$ strace -s 2000 -o strace.log echo "hi" 
hi
$ cat strace.log 
execve("/usr/bin/echo", ["echo", "hi"], [/* 94 vars */]) = 0
brk(0)                                  = 0x1061000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f78bdab3000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=206010, ...}) = 0
mmap(NULL, 206010, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f78bda80000
close(3)                                = 0
open("/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "7ELF
$ strace echo "hi"
execve("/usr/bin/echo", ["echo", "hi"], [/* 94 vars */]) = 0
brk(0)                                  = 0xf73000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9996cf2000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=206010, ...}) = 0
mmap(NULL, 206010, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f9996cbf000
close(3)                                = 0
open("/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "7ELF
$ strace -s 2000 -o strace.log echo "hi" 
hi
$ cat strace.log 
execve("/usr/bin/echo", ["echo", "hi"], [/* 94 vars */]) = 0
brk(0)                                  = 0x1061000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f78bdab3000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=206010, ...}) = 0
mmap(NULL, 206010, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f78bda80000
close(3)                                = 0
open("/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "7ELF%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%>%pre%%pre%%pre%%pre%P23?%pre%%pre%%pre%@%pre%%pre%%pre%%pre%%pre%%pre%%pre%\" %pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%@%pre%08%pre%\n%pre%@%pre%+%pre%*%pre%%pre%%pre%%pre%%pre%%pre%%pre%@%pre%%pre%%pre%%pre%%pre%%pre%%pre%@%pre%03?%pre%%pre%%pre%@%pre%03?%pre%%pre%%pre%00%pre%%pre%%pre%%pre%%pre%%pre%00%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%0%pre%%pre%%pre%%pre%%pre%003?%pre%%pre%%pre%003?%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%03?%pre%%pre%%pre%%pre%%pre%03?%pre%%pre%%pre%4W%pre%%pre%%pre%%pre%%pre%4W%pre%%pre%%pre%%pre%%pre%%pre%%pre% %pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre% g%pre%%pre%%pre%%pre%%pre% g33?%pre%%pre%%pre% g33?%pre%%pre%%pre%0Q%pre%%pre%%pre%%pre%%pre%%pre%@3%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre% %pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%03%pre%%pre%%pre%%pre%%pre%0333?%pre%%pre%%pre%0333?%pre%%pre%%pre%0%pre%%pre%%pre%%pre%%pre%%pre%0%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%p%pre%%pre%%pre%%pre%%pre%%pre%p03?%pre%%pre%%pre%p03?%pre%%pre%%pre%D%pre%%pre%%pre%%pre%%pre%%pre%%pre%D%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre% g%pre%%pre%%pre%%pre%%pre% g33?%pre%%pre%%pre% g33?%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%0%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%P5td%pre%%pre%%pre%\f%pre%%pre%%pre%%pre%%pre%\f03?%pre%%pre%%pre%\f03?%pre%%pre%%pre%\h%pre%%pre%%pre%%pre%%pre%%pre%\h%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%Q5td%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%R5td%pre%%pre%%pre% g%pre%%pre%%pre%%pre%%pre% g33?%pre%%pre%%pre% g33?%pre%%pre%%pre%08%pre%%pre%%pre%%pre%%pre%%pre%08%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%GNU%pre%63)37p036F6.Tkn3R2%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%GNU%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre% %pre%%pre%%pre%%pre%%pre%%pre%%pre%3%pre%%pre%\t%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%00D0 0605E4%pre%0%pre%%pre%0%pre%'00%pre%\r2\f%pre%%pre%0D2.@0P<, 62H&404%pre%14f0%pre%02%pre%0%pre%P 14\v  ($%pre% P%pre%X02DB(%pre%0B%pre% @0%pre%\tP%pre%Q2@%pre%%pre%%pre%%pre%%pre%%pre%", 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=2108632, ...}) = 0
mmap(0x3f8ba00000, 3932768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x3f8ba00000
mprotect(0x3f8bbb6000, 2097152, PROT_NONE) = 0
mmap(0x3f8bdb6000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1b6000) = 0x3f8bdb6000
mmap(0x3f8bdbc000, 16992, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3f8bdbc000
close(3)                                = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f78bda7f000
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f78bda7d000
arch_prctl(ARCH_SET_FS, 0x7f78bda7d740) = 0
mprotect(0x606000, 4096, PROT_READ)     = 0
mprotect(0x3f8bdb6000, 16384, PROT_READ) = 0
mprotect(0x3f8b820000, 4096, PROT_READ) = 0
munmap(0x7f78bda80000, 206010)          = 0
brk(0)                                  = 0x1061000
brk(0x1082000)                          = 0x1082000
brk(0)                                  = 0x1082000
open("/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=106055264, ...}) = 0
mmap(NULL, 106055264, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f78b7558000
close(3)                                = 0
fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 2), ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f78bdab2000
write(1, "hi\n", 3)                     = 3
close(1)                                = 0
munmap(0x7f78bdab2000, 4096)            = 0
close(2)                                = 0
exit_group(0)                           = ?
+++ exited with 0 +++
%pre%%pre%%pre%%pre%%pre%%pre%%pre%>%pre%%pre%%pre%%pre%P23?%pre%%pre%%pre%"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=2108632, ...}) = 0
mmap(0x3f8ba00000, 3932768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x3f8ba00000
mprotect(0x3f8bbb6000, 2097152, PROT_NONE) = 0
mmap(0x3f8bdb6000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1b6000) = 0x3f8bdb6000
mmap(0x3f8bdbc000, 16992, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3f8bdbc000
close(3)                                = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9996cbe000
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9996cbc000
arch_prctl(ARCH_SET_FS, 0x7f9996cbc740) = 0
mprotect(0x606000, 4096, PROT_READ)     = 0
mprotect(0x3f8bdb6000, 16384, PROT_READ) = 0
mprotect(0x3f8b820000, 4096, PROT_READ) = 0
munmap(0x7f9996cbf000, 206010)          = 0
brk(0)                                  = 0xf73000
brk(0xf94000)                           = 0xf94000
brk(0)                                  = 0xf94000
open("/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=106055264, ...}) = 0
mmap(NULL, 106055264, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f9990797000
close(3)                                = 0
fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 2), ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9996cf1000
write(1, "hi\n", 3hi
)                     = 3
close(1)                                = 0
munmap(0x7f9996cf1000, 4096)            = 0
close(2)                                = 0
exit_group(0)                           = ?
+++ exited with 0 +++
%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%>%pre%%pre%%pre%%pre%P23?%pre%%pre%%pre%@%pre%%pre%%pre%%pre%%pre%%pre%%pre%\" %pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%@%pre%08%pre%\n%pre%@%pre%+%pre%*%pre%%pre%%pre%%pre%%pre%%pre%%pre%@%pre%%pre%%pre%%pre%%pre%%pre%%pre%@%pre%03?%pre%%pre%%pre%@%pre%03?%pre%%pre%%pre%00%pre%%pre%%pre%%pre%%pre%%pre%00%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%0%pre%%pre%%pre%%pre%%pre%003?%pre%%pre%%pre%003?%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%03?%pre%%pre%%pre%%pre%%pre%03?%pre%%pre%%pre%4W%pre%%pre%%pre%%pre%%pre%4W%pre%%pre%%pre%%pre%%pre%%pre%%pre% %pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre% g%pre%%pre%%pre%%pre%%pre% g33?%pre%%pre%%pre% g33?%pre%%pre%%pre%0Q%pre%%pre%%pre%%pre%%pre%%pre%@3%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre% %pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%03%pre%%pre%%pre%%pre%%pre%0333?%pre%%pre%%pre%0333?%pre%%pre%%pre%0%pre%%pre%%pre%%pre%%pre%%pre%0%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%p%pre%%pre%%pre%%pre%%pre%%pre%p03?%pre%%pre%%pre%p03?%pre%%pre%%pre%D%pre%%pre%%pre%%pre%%pre%%pre%%pre%D%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre% g%pre%%pre%%pre%%pre%%pre% g33?%pre%%pre%%pre% g33?%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%0%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%P5td%pre%%pre%%pre%\f%pre%%pre%%pre%%pre%%pre%\f03?%pre%%pre%%pre%\f03?%pre%%pre%%pre%\h%pre%%pre%%pre%%pre%%pre%%pre%\h%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%Q5td%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%R5td%pre%%pre%%pre% g%pre%%pre%%pre%%pre%%pre% g33?%pre%%pre%%pre% g33?%pre%%pre%%pre%08%pre%%pre%%pre%%pre%%pre%%pre%08%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%GNU%pre%63)37p036F6.Tkn3R2%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%GNU%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre% %pre%%pre%%pre%%pre%%pre%%pre%%pre%3%pre%%pre%\t%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%%pre%00D0 0605E4%pre%0%pre%%pre%0%pre%'00%pre%\r2\f%pre%%pre%0D2.@0P<, 62H&404%pre%14f0%pre%02%pre%0%pre%P 14\v  ($%pre% P%pre%X02DB(%pre%0B%pre% @0%pre%\tP%pre%Q2@%pre%%pre%%pre%%pre%%pre%%pre%", 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=2108632, ...}) = 0
mmap(0x3f8ba00000, 3932768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x3f8ba00000
mprotect(0x3f8bbb6000, 2097152, PROT_NONE) = 0
mmap(0x3f8bdb6000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1b6000) = 0x3f8bdb6000
mmap(0x3f8bdbc000, 16992, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3f8bdbc000
close(3)                                = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f78bda7f000
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f78bda7d000
arch_prctl(ARCH_SET_FS, 0x7f78bda7d740) = 0
mprotect(0x606000, 4096, PROT_READ)     = 0
mprotect(0x3f8bdb6000, 16384, PROT_READ) = 0
mprotect(0x3f8b820000, 4096, PROT_READ) = 0
munmap(0x7f78bda80000, 206010)          = 0
brk(0)                                  = 0x1061000
brk(0x1082000)                          = 0x1082000
brk(0)                                  = 0x1082000
open("/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=106055264, ...}) = 0
mmap(NULL, 106055264, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f78b7558000
close(3)                                = 0
fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 2), ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f78bdab2000
write(1, "hi\n", 3)                     = 3
close(1)                                = 0
munmap(0x7f78bdab2000, 4096)            = 0
close(2)                                = 0
exit_group(0)                           = ?
+++ exited with 0 +++
%pre%%pre%%pre%%pre%%pre%%pre%%pre%>%pre%%pre%%pre%%pre%P23?%pre%%pre%%pre%"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=2108632, ...}) = 0
mmap(0x3f8ba00000, 3932768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x3f8ba00000
mprotect(0x3f8bbb6000, 2097152, PROT_NONE) = 0
mmap(0x3f8bdb6000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1b6000) = 0x3f8bdb6000
mmap(0x3f8bdbc000, 16992, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3f8bdbc000
close(3)                                = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9996cbe000
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9996cbc000
arch_prctl(ARCH_SET_FS, 0x7f9996cbc740) = 0
mprotect(0x606000, 4096, PROT_READ)     = 0
mprotect(0x3f8bdb6000, 16384, PROT_READ) = 0
mprotect(0x3f8b820000, 4096, PROT_READ) = 0
munmap(0x7f9996cbf000, 206010)          = 0
brk(0)                                  = 0xf73000
brk(0xf94000)                           = 0xf94000
brk(0)                                  = 0xf94000
open("/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=106055264, ...}) = 0
mmap(NULL, 106055264, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f9990797000
close(3)                                = 0
fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 2), ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9996cf1000
write(1, "hi\n", 3hi
)                     = 3
close(1)                                = 0
munmap(0x7f9996cf1000, 4096)            = 0
close(2)                                = 0
exit_group(0)                           = ?
+++ exited with 0 +++

Você também pode aumentar os detalhes gerados, incluindo a opção -s <size> . Eu normalmente usarei -s 2000 para obter 2000 caracteres de saída por chamada. Também incluirei o comutador -o <file> para obter a saída para despejar em um arquivo. É muito mais fácil olhar para essa saída depois do fato.

Exemplo

%pre%

E aqui está o arquivo:

%pre%

Você pode incluir qualquer programa ou comando que você possa executar normalmente em seu shell como um argumento para strace . É provavelmente a ferramenta mais útil incluída no Linux em termos de obter insights sobre como os executáveis funcionam em seu sistema.

Eu estou apenas arranhando a superfície aqui, você pode instruir strace para mostrar apenas as chamadas do sistema ou sinais também. Confira a página man strace para mais informações.

    

Answer 2

Enfrentando a pergunta :

I want to log the system calls of already running programs.

strace pode iniciar um programa pelo nome, mas para "programas já em execução", você deve (como em autrace ) se referir ao id do processo.

Um determinado executável pode ter vários processos associados a ele. Você pode criar um script que verifique todos os links exe em /proc , por exemplo,

/proc/*/exe

para ver qual corresponde ao executável em que você está interessado e (como o nome do diretório intermediário é o ID do processo), execute strace para cada um desses processos.

Para qualquer processo que você possa rastrear, o link exe é o nome do caminho de um executável. Seu script leria o nome do caminho (usando readlink ) e, se ele corresponder, execute strace com a opção -p para o ID do processo correspondente. Claro, você executaria aqueles em segundo plano, para poder lidar com vários processos.

Colecioná-los juntos em um logfile coerente pode (ou não) ser o que você deseja fazer a seguir. Seu script pode canalizar os resultados de strace para logger , tornando o resultado um grande arquivo de log.

Leitura adicional:

• proc - pseudo-sistema de informações do processo , explica /proc/[pid]/exe
• Script Bash Shell - Gravar no arquivo de registro personalizado
• Script do shell: Escrever mensagem em um arquivo syslog / log

bem como as páginas de manual:

• autrace - um programa semelhante ao strace
• strace - rastreia chamadas e sinais do sistema