CODEWITHSUNDEEP
linuxsystem-calls
Bruce
Bruce

Reputation: 35233

strace: How to ascertain if a system call has called another system call?

"strace is a system call tracer, i.e. a debugging tool which prints out a trace of all the system calls made by a another process/program." What if the systems calls works recursively or one system call calls another system call. How can I get this information?

Possible Solution - We can create a simple variable indent, which we increment when we enter a system call and decrement when we exit. Now just print "indent" number of spaces before each call. So we can get something like this - 

05:31:09.449402 getpriority(PRIO_PROCESS, 0) = 20
05:31:09.450514 ioctl(7, 0xc0186201, 0xbef86ac0) = 0
05:31:09.451817  ioctl(7, 0xc0186201, 0xbef86c10) = 0
05:31:09.524328 writev(4, [{"\4", 1}, {"ServiceManager\0", 15}, {"ServiceManager: addService(SMS, 0x15988)\n\0", 42}], 3) = 58
05:31:09.526862  futex(0x134ac, FUTEX_WAKE, 2147483647) = 0
05:31:09.527847   getpriority(PRIO_PROCESS, 0) = 20
05:31:09.528758 ioctl(7, 0xc0186201, 0xbef86ac0) = 0
05:31:09.529847 ioctl(7, 0xc0186201, 0xbef86c10) = 0

Does strace or some other tool already provides this functionality or do I need to change the source code for achieving this?

Upvotes: 1

Views: 854

Answers (2)

Leo
Leo

Reputation: 962

If you have root access, you can use ftrace to trace kernel function calls, and filter by the names of the kernel-side syscall interfaces. Use function_graph as the tracer (see https://lwn.net/Articles/366796/ for an explanation). Since the "original syscall" also passed through such a call, you would clearly see a post-syscall call within a post-syscall call. Fair warning: I'm not sure how frequent is this scenario.

Upvotes: 0

Simon Richter
Simon Richter

Reputation: 29586

System calls are defined as the boundary between kernel and user space, so any recursion there happens inside the kernel and cannot be intercepted.

strace works by attaching to the process as a debugger, letting it run free except when a system call is triggered, at which point the parameters and return values are printed. It has no knowledge of what goes on inside the kernel.

Upvotes: 6

Related Questions