truss

truss [options] arguments

Trace system calls, signals, and machine faults while executing arguments. arguments is either a Unix command to run or, if -p is specified, a list of process IDs representing the already running processes to trace. The options -m, -r, -s, -t, -v, -w, and -x accept a comma-separated list of arguments. A ! reverses the sense of the list, telling truss to ignore those elements of the list during the trace. (In the C shell, use a backslash before !.) The keyword all can include/exclude all possible elements for the list. The optional ! and corresponding description are shown in brackets.

The Solaris truss also provides tracing of user-level function calls in dynamically loaded shared libraries.

This command is particularly useful for finding missing files when a third-party application fails. By watching the access and open system calls, you can find where, and which, files the application program expected to find, but did not.

Many systems have similar programs named trace or strace. These programs are worth learning how to use.

Options

-a

Display parameters passed by each exec(2) call.

-c

Count the traced items and print a summary rather than listing them as they happen.

-d

Print a timestamp in the output, of the form seconds.fraction, indicating the time relative to the start of the trace. Times are when the system call completes, not starts. Solaris only.

-D

Print a delta timestamp in the output, of the form seconds.fraction, indicating the time between events (i.e., the time not inside system calls). Solaris only.

-e

Display values of environment variables passed by each exec(2) call.

-f

Follow child processes. Useful for tracing shell scripts.

-i

List sleeping system calls only once, upon completion.

-m[!]faults

Trace [exclude from trace] the list of machine faults. faults are names or numbers, as listed in <sys/fault.h> (default is -mall -m!fltpage).

-M[!]faults

When the traced process receives one of the named faults, truss leaves the process in a stopped state and detaches from it (default is -M!all). The process can subsequently be attached to with a debugger, or with another invocation of truss using different options. Solaris only.

-l

Show the lightweight process ID for a multithreaded process. Solaris only.

-o outfile

Send trace output to outfile, not standard error.

-p

Trace one or more running processes instead of a command.

-r[!]file_descriptors

Display [don't display] the full I/O buffer of read system calls for file_descriptors (default is -r!all).

-s[!]signals

Trace [exclude from trace] the list of signals. signals are names or numbers, as listed in <sys/signal.h> (default is -sall).

-S[!]signals

When the traced process receives one of the named signals, truss leaves the process in a stopped state and detaches from it (see -M) (default is -S!all). Solaris only.

-t[!]system_calls

Trace [exclude from trace] the list of system_calls. system_calls are names or numbers, as listed in Section 2, "System Calls," of the UNIX Programmer's Reference Manual (see Bibliography); default is -tall.

-T[!]system_calls

When the traced process executes one of the named system calls, truss leaves the process in a stopped state and detaches from it (see -M) (default is -T!all). Solaris only.

-u[!]lib,...:[:][!]func,...

Trace user-level function calls, not just system calls. lib is a comma-separated list of dynamic library names, without the .so.n suffix. func is a comma-separated list of names. Shell wildcard syntax may be used to specify many names. (Such use should be quoted to protect it from expansion by the shell.) The leading ! indicates libraries and/or functions to exclude. With :, only calls into the library from outside it are traced; with ::, all calls are traced. Solaris only.

-U[!]lib,...:[:][!]func,...

When the traced process executes one of the named user-level functions, truss leaves the process in a stopped state and detaches from it (see -M). Solaris only.

-v[!]system_calls

Verbose mode. Same as -t, but also list the contents of any structures passed to system_calls (default is -v!all).

-w[!]file_descriptors

Display [don't display] the full I/O buffer of write system calls for file_descriptors (default is -w!all).

-x[!]system_calls

Same as -t, but display the system call arguments as raw code (hexadecimal) (default is -x!all).

Examples

Trace system calls access, open, and close for the lp command:

truss -t access,open,close lp files > truss.out

Trace the make command, including its child processes, and store the output in make.trace:

truss -f -o make.trace make target