strace and /proc: what a process is doing

Not running Starting usually ~20 s

Step 8 of 8 · summary · 2 min

Summary

A program works with files and the network through system calls; strace prints each one with its result, and a failure is -1 plus the error name.
The cause of a silent failure is the last call with -1 before exit_group; ENOENT at the start of a trace is a normal search along paths.
sudo strace -p <PID> shows which call a process is waiting in; /proc/<PID>/fd turns a descriptor number into a file name.
lsof <file> finds the process that holds a file and its lock.
nightsync from the start of the lesson was silent because it did not find its settings file: strace showed the result -1 ENOENT for the openat of /etc/nightsync/sync.conf right before the exit.

Ubuntu 24.04