简介

strace常用来跟踪进程执行时的系统调用和所接收的信号。 在Linux世界，进程不能直接访问硬件设备，当进程需要访问硬件设备(比如读取磁盘文件，接收网络数据等等)时，必须由用户态模式切换至内核态模式，通 过系统调用访问硬件设备。strace可以跟踪到一个进程产生的系统调用,包括参数，返回值，执行消耗的时间。

[root@zhanglin-master ~]# strace -p  
strace: option requires an argument -- 'p'
usage: strace [-dDffhiqrtttTvVxx] [-a column] [-e expr] ... [-o file]
              [-p pid] ... [-s strsize] [-u username] [-E var=val] ...
              [command [arg ...]]
   or: strace -c [-D] [-e expr] ... [-O overhead] [-S sortby] [-E var=val] ...
              [command [arg ...]]
-c -- count time, calls, and errors for each syscall and report summary   //-c 统计每一系统调用的所执行的时间,次数和出错的次数等. 
-f -- follow forks, -ff -- with output into separate files                        //-f 跟踪由fork调用所产生的子进程. 
-i -- print instruction pointer at time of syscall                                   //-i 输出系统调用的入口指针. 
-q -- suppress messages about attaching, detaching, etc.                    //-q 禁止输出关于脱离的消息.
-r -- print relative timestamp, -t -- absolute timestamp, -tt -- with usecs  //-r 打印出相对时间关于,,每一个系统调用.
-T -- print time spent in each syscall, -V -- print version                        //-T 显示每一调用所耗的时间. 
-v -- verbose mode: print unabbreviated argv, stat, termio[s], etc. args //-v 输出所有的系统调用.一些调用关于环境变量,状态,输入输出等调用由于使用频繁,默认不输出. 
-x -- print non-ascii strings in hex, -xx -- print all strings in hex                //-x 以十六进制形式输出非标准字符串 
-a column -- alignment COLUMN for printing syscall results (default 40)    //设置返回值的输出位置.默认 为40
-e expr -- a qualifying expression: option=[!]all or option=[!]val1[,val2]...    //-e 指定一个表达式,用来控制如何跟踪
   options: trace, abbrev, verbose, raw, signal, read, or write
-o file -- send trace output to FILE instead of stderr                        //-o filename 将strace的输出写入文件filename 
-O overhead -- set overhead for tracing syscalls to OVERHEAD usecs
-p pid -- trace process with process id PID, may be repeated         //-p pid 跟踪指定的进程pid.
-D -- run tracer process as a detached grandchild, not as parent
-s strsize -- limit length of print strings to STRSIZE chars (default 32)        //-s strsize 指定输出的字符串的最大长度.默认为32.文件名一直全部输出. 
-S sortby -- sort syscall counts by: time, calls, name, nothing (default time)
-u username -- run command as username handling setuid and/or setgid   //-u username 以username 的UID和GID执行被跟踪的命令
-E var=val -- put var=val in the environment for command
-E var -- remove var from the environment for command


举例 查看MySQL进程信息：
[root@zhanglin-master ~]# strace -cfp $(pidof mysqld)
Process 1354 attached with 31 threads - interrupt to quit

^CProcess 1354 detached
Process 1357 detached
Process 1358 detached
Process 1359 detached
Process 1360 detached
Process 1361 detached
Process 1362 detached
Process 1363 detached
Process 1364 detached
Process 1365 detached
Process 1366 detached
Process 1370 detached
Process 1371 detached
Process 1372 detached
Process 1373 detached
Process 1374 detached
Process 1375 detached
Process 1376 detached
Process 1377 detached
Process 1378 detached
Process 1381 detached
Process 1624 detached
Process 1709 detached
Process 1710 detached
Process 1711 detached
Process 1712 detached
Process 2230 detached
Process 2231 detached
Process 2232 detached
Process 2233 detached
Process 2234 detached
% time     seconds  usecs/call     calls    errors syscall
------ ----------- ----------- --------- --------- ----------------
 58.82    0.099990         204       490           io_getevents
 24.71    0.041995         344       122        61 futex
 11.76    0.019998         408        49           select
  4.71    0.008000        1600         5         5 restart_syscall
------ ----------- ----------- --------- --------- ----------------
100.00    0.169983                   666        66 total

具体操作：
strace -o output.txt -T -tt -e trace=all -p 1354

跟踪1354进程的所有系统调用（-e trace=all），并统计系统调用的花费时间，以及开始时间（并以可视化的时分秒格式显示），最后将记录结果存在output.txt文件里面。