Linux Labs

Inside the system: resources, kernel, processes / Stage 7 of 12

strace and /proc: what a process is doing

Not running Starting usually ~20 s
Leave the lesson

Step 2 of 8 · on a machine · 6 min

System calls

nightsync did not name the cause, but everything it managed to do went through the kernel. That is what strace shows.

A program does not open files, read the disk or talk to the network by itself — it asks the kernel to. Each such request is a system call: openat opens a file, read and write read and write, connect connects to an address, exit_group ends the process.

strace runs a program and prints each of its calls as a line: the name, the arguments and, after =, the result. Here are two lines from the nightsync trace:

openat(AT_FDCWD, "/usr/local/bin/nightsync", O_RDONLY|O_CLOEXEC) = 3
close(3)                                = 0

A successful openat returns the number of the opened file — a descriptor; from then on the program refers to the file by that number. A failure is -1 plus the error name with an explanation: ENOENT (No such file or directory) — no such file, EACCES (Permission denied) — no permission.

strace writes to the error stream, and the output is long: over 500 lines for nightsync. A program exits right after a failure, so look for the cause at the end — the last call with -1 before exit_group.

Exercise · look

Look at the end of the trace

In ~/sync-lab, run nightsync under strace and look at the last eight lines of the output.

First, predict

nightsync sends orders to the archive server. Which call will be the last one with the result -1 before the exit?

Now start the exercise, run the command and compare your prediction with the output.

Sign in and start The machine is available after signing in
Ubuntu 24.04
Loading…