Modern strace
summary
strace adds concrete tools: --seccomp-bpf uses a seccomp BPF program so traced processes run nearly untraced (example shows ~10% overhead vs historic 40× slowdown), but it’s inheritable across forks and incompatible with daemonize modes. Return-status filtering via --status lets showing only successful or failed syscalls and triggers aggregation. poke_enter/poke_exit memory injection changes syscall arguments and return buffers (works but shows hex blobs). Other additions: PID/comm decoding, --secontext, --syscall-number, %clock/%creds filters, --summary-columns and --tips.
AI-written summary · about
chapters (17)
- 0:00Modern strace intro
- 1:08Process tracing & output control
- 2:12BPF fast tracing with seccomp
- 4:23Detaching tracer & process groups
- 5:47Demonizing strace and process isolation
- 8:19Stop tracing after a specified number of system calls
- 10:08PID & namespace decoding
- 13:06FD info decoding
- 14:30SELinux context mismatches
- 15:40Syscall numbers display
- 16:20Filter by exit status
- 18:51Filter by file descriptors
- 19:38Adding system call filtering groups
- 20:18Injecting into system call arguments and memory
- 22:05Stats output control
- 23:09Tips & tricks
- 26:54Q&A
