freebsd-dev/usr.bin/truss/truss.1

.\" $FreeBSD$
.\"
.Dd May 12, 2009
.Dt TRUSS 1
.Os
.Sh NAME
.Nm truss
.Nd trace system calls
.Sh SYNOPSIS
.Nm
.Op Fl facedDS
.Op Fl o Ar file
.Op Fl s Ar strsize
.Fl p Ar pid
.Nm
.Op Fl facedDS
.Op Fl o Ar file
.Op Fl s Ar strsize
.Ar command Op Ar args
.Sh DESCRIPTION
The
.Nm
utility traces the system calls called by the specified process or program.
Output is to the specified output file, or standard error by default.
It does this by stopping and restarting the process being monitored via
.Xr ptrace 2 .
.Pp
The options are as follows:
.Bl -tag -width indent
.It Fl f
Trace descendants of the original traced process created by
.Xr fork 2 ,
.Xr vfork 2 ,
etc.
.It Fl a
Show the argument strings that are passed in each
.Xr execve 2
system call.
.It Fl c
Do not display individual system calls.
Instead, before exiting, print a summary containing for each system call:
the total system time used,
the number of times the call was invoked,
and the number of times the call returned with an error.
.It Fl e
Show the environment strings that are passed in each
.Xr execve 2
system call.
.It Fl d
Include timestamps in the output showing the time elapsed
since the trace was started.
.It Fl D
Include timestamps in the output showing the time elapsed
since the last recorded event.
.It Fl S
Do not display information about signals received by the process.
(Normally,
.Nm
displays signal as well as system call events.)
.It Fl o Ar file
Print the output to the specified
.Ar file
instead of standard error.
.It Fl s Ar strsize
Display strings using at most
.Ar strsize
characters.
If the buffer is larger,
.Dq Li ...
will be displayed at the end of the string.
The default
.Ar strsize
is 32.
.It Fl p Ar pid
Follow the process specified by
.Ar pid
instead of a new command.
.It Ar command Op Ar args
Execute
.Ar command
and trace the system calls of it.
(The
.Fl p
and
.Ar command
options are mutually exclusive.)
.El
.Sh EXAMPLES
# Follow the system calls used in echoing "hello"
.Dl $ truss /bin/echo hello
# Do the same, but put the output into a file
.Dl $ truss -o /tmp/truss.out /bin/echo hello
# Follow an already-running process
.Dl $ truss -p 34
.Sh SEE ALSO
.Xr kdump 1 ,
.Xr ktrace 1 ,
.Xr ptrace 2
.Sh HISTORY
The
.Nm
command was written by
.An Sean Eric Fagan
for
.Fx .
It was modeled after
similar commands available for System V Release 4 and SunOS.
Add $FreeBSD$ lines to man pages that are missing them to make it easier for translation teams. PR: docs/13418 Submitted by: Alexey Zelkin <phantom@cris.net> 1999-08-28 23:23:38 +00:00			`.\" $FreeBSD$`
			`.\"`
Add -c option to summarize number of calls, errors, and system time. Reviewed by: alfred 2009-05-12 20:42:12 +00:00			`.Dd May 12, 2009`
Truss program. Requires procfs. 1997-12-06 05:23:12 +00:00			`.Dt TRUSS 1`
mdoc(7) police: removed HISTORY info from the .Os call. 2001-07-10 14:16:33 +00:00			`.Os`
Truss program. Requires procfs. 1997-12-06 05:23:12 +00:00			`.Sh NAME`
Sort Xrefs. Use err(3). Remove uneeded #include. Correct usage: one of {-p pid, command} is required. Open output file when command line is fully analyzed: incorrect `truss -o f' command does not create an empty file anymore. 1998-01-05 07:30:26 +00:00			`.Nm truss`
Truss program. Requires procfs. 1997-12-06 05:23:12 +00:00			`.Nd trace system calls`
Sort Xrefs. Use err(3). Remove uneeded #include. Correct usage: one of {-p pid, command} is required. Open output file when command line is fully analyzed: incorrect `truss -o f' command does not create an empty file anymore. 1998-01-05 07:30:26 +00:00			`.Sh SYNOPSIS`
mdoc(7) police: use the new features of the Nm macro. 2000-11-20 19:21:22 +00:00			`.Nm`
Add -c option to summarize number of calls, errors, and system time. Reviewed by: alfred 2009-05-12 20:42:12 +00:00			`.Op Fl facedDS`
Sort Xrefs. Use err(3). Remove uneeded #include. Correct usage: one of {-p pid, command} is required. Open output file when command line is fully analyzed: incorrect `truss -o f' command does not create an empty file anymore. 1998-01-05 07:30:26 +00:00			`.Op Fl o Ar file`
Add a -s flag for the same functionality as strace. Introduce a Name type which is a String type that has no -s limitations applied to it. Change most Strings in the code to Names and add a few extra syscalls, namely munmap, read, rename and symlink. This was enough to facilitate following file descriptor allocations in the code more easily and getting a hint at what's being read/written from/to files. More syscalls should really be added. While here, fix an off-by-one bug in the buffer truncation code and add a fflush so that truss's output reflects the syscall that the program is stuck in. Sponsored by: Sophos/Activestate MFC after: 2 weeks 2006-01-02 08:36:25 +00:00			`.Op Fl s Ar strsize`
Sort Xrefs. Use err(3). Remove uneeded #include. Correct usage: one of {-p pid, command} is required. Open output file when command line is fully analyzed: incorrect `truss -o f' command does not create an empty file anymore. 1998-01-05 07:30:26 +00:00			`.Fl p Ar pid`
mdoc(7) police: use the new features of the Nm macro. 2000-11-20 19:21:22 +00:00			`.Nm`
Add -c option to summarize number of calls, errors, and system time. Reviewed by: alfred 2009-05-12 20:42:12 +00:00			`.Op Fl facedDS`
Truss program. Requires procfs. 1997-12-06 05:23:12 +00:00			`.Op Fl o Ar file`
Add a -s flag for the same functionality as strace. Introduce a Name type which is a String type that has no -s limitations applied to it. Change most Strings in the code to Names and add a few extra syscalls, namely munmap, read, rename and symlink. This was enough to facilitate following file descriptor allocations in the code more easily and getting a hint at what's being read/written from/to files. More syscalls should really be added. While here, fix an off-by-one bug in the buffer truncation code and add a fflush so that truss's output reflects the syscall that the program is stuck in. Sponsored by: Sophos/Activestate MFC after: 2 weeks 2006-01-02 08:36:25 +00:00			`.Op Fl s Ar strsize`
Add missing markup bits. 2006-12-11 11:34:44 +00:00			`.Ar command Op Ar args`
Truss program. Requires procfs. 1997-12-06 05:23:12 +00:00			`.Sh DESCRIPTION`
Use `The .Nm utility' 2002-04-20 12:18:28 +00:00			`The`
			`.Nm`
			`utility traces the system calls called by the specified process or program.`
Truss program. Requires procfs. 1997-12-06 05:23:12 +00:00			`Output is to the specified output file, or standard error by default.`
			`It does this by stopping and restarting the process being monitored via`
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred 2007-04-10 04:03:34 +00:00			`.Xr ptrace 2 .`
Truss program. Requires procfs. 1997-12-06 05:23:12 +00:00			`.Pp`
			`The options are as follows:`
Sort Xrefs. Use err(3). Remove uneeded #include. Correct usage: one of {-p pid, command} is required. Open output file when command line is fully analyzed: incorrect `truss -o f' command does not create an empty file anymore. 1998-01-05 07:30:26 +00:00			`.Bl -tag -width indent`
Allow tracking fork()ed children. PR: bin/25587 (in part) MFC after: 3 weeks 2002-08-04 01:02:52 +00:00			`.It Fl f`
Fix all the spelling mistakes I could find in the man pages for words that have at least 3 characters. MFC after: 1 week Thanks to: Music band ``Chingon'' for keeping me company while searching for these. 2005-07-31 03:30:48 +00:00			`Trace descendants of the original traced process created by`
mdoc(7) police: markup polishing. Approved by: re 2002-11-26 17:33:37 +00:00			`.Xr fork 2 ,`
			`.Xr vfork 2 ,`
			`etc.`
Add options to print the argument and environment string parameters to execve(). This could be done in a more general manner but it still wouldn't be very pretty. MFC after: 3 weeks 2002-08-04 02:24:21 +00:00			`.It Fl a`
mdoc(7) police: markup polishing. Approved by: re 2002-11-26 17:33:37 +00:00			`Show the argument strings that are passed in each`
			`.Xr execve 2`
			`system call.`
Add -c option to summarize number of calls, errors, and system time. Reviewed by: alfred 2009-05-12 20:42:12 +00:00			`.It Fl c`
			`Do not display individual system calls.`
			`Instead, before exiting, print a summary containing for each system call:`
			`the total system time used,`
			`the number of times the call was invoked,`
			`and the number of times the call returned with an error.`
Add options to print the argument and environment string parameters to execve(). This could be done in a more general manner but it still wouldn't be very pretty. MFC after: 3 weeks 2002-08-04 02:24:21 +00:00			`.It Fl e`
mdoc(7) police: markup polishing. Approved by: re 2002-11-26 17:33:37 +00:00			`Show the environment strings that are passed in each`
			`.Xr execve 2`
			`system call.`
Add options to print absolute and relative timestamps. PR: bin/25587 (in part) MFC after: 3 weeks 2002-08-04 01:27:31 +00:00			`.It Fl d`
			`Include timestamps in the output showing the time elapsed`
			`since the trace was started.`
			`.It Fl D`
			`Include timestamps in the output showing the time elapsed`
			`since the last recorded event.`
Truss program. Requires procfs. 1997-12-06 05:23:12 +00:00			`.It Fl S`
			`Do not display information about signals received by the process.`
			`(Normally,`
Sort Xrefs. Use err(3). Remove uneeded #include. Correct usage: one of {-p pid, command} is required. Open output file when command line is fully analyzed: incorrect `truss -o f' command does not create an empty file anymore. 1998-01-05 07:30:26 +00:00			`.Nm`
Truss program. Requires procfs. 1997-12-06 05:23:12 +00:00			`displays signal as well as system call events.)`
Sort Xrefs. Use err(3). Remove uneeded #include. Correct usage: one of {-p pid, command} is required. Open output file when command line is fully analyzed: incorrect `truss -o f' command does not create an empty file anymore. 1998-01-05 07:30:26 +00:00			`.It Fl o Ar file`
			`Print the output to the specified`
			`.Ar file`
			`instead of standard error.`
Add a -s flag for the same functionality as strace. Introduce a Name type which is a String type that has no -s limitations applied to it. Change most Strings in the code to Names and add a few extra syscalls, namely munmap, read, rename and symlink. This was enough to facilitate following file descriptor allocations in the code more easily and getting a hint at what's being read/written from/to files. More syscalls should really be added. While here, fix an off-by-one bug in the buffer truncation code and add a fflush so that truss's output reflects the syscall that the program is stuck in. Sponsored by: Sophos/Activestate MFC after: 2 weeks 2006-01-02 08:36:25 +00:00			`.It Fl s Ar strsize`
			`Display strings using at most`
			`.Ar strsize`
			`characters.`
			`If the buffer is larger,`
Markup fixes. 2006-09-29 15:20:48 +00:00			`.Dq Li ...`
Add a -s flag for the same functionality as strace. Introduce a Name type which is a String type that has no -s limitations applied to it. Change most Strings in the code to Names and add a few extra syscalls, namely munmap, read, rename and symlink. This was enough to facilitate following file descriptor allocations in the code more easily and getting a hint at what's being read/written from/to files. More syscalls should really be added. While here, fix an off-by-one bug in the buffer truncation code and add a fflush so that truss's output reflects the syscall that the program is stuck in. Sponsored by: Sophos/Activestate MFC after: 2 weeks 2006-01-02 08:36:25 +00:00			`will be displayed at the end of the string.`
			`The default`
			`.Ar strsize`
			`is 32.`
Sort Xrefs. Use err(3). Remove uneeded #include. Correct usage: one of {-p pid, command} is required. Open output file when command line is fully analyzed: incorrect `truss -o f' command does not create an empty file anymore. 1998-01-05 07:30:26 +00:00			`.It Fl p Ar pid`
Remove whitespace at EOL. 2001-07-15 08:06:20 +00:00			`Follow the process specified by`
Truss program. Requires procfs. 1997-12-06 05:23:12 +00:00			`.Ar pid`
			`instead of a new command.`
Add missing markup bits. 2006-12-11 11:34:44 +00:00			`.It Ar command Op Ar args`
Truss program. Requires procfs. 1997-12-06 05:23:12 +00:00			`Execute`
			`.Ar command`
			`and trace the system calls of it.`
			`(The`
			`.Fl p`
			`and`
			`.Ar command`
			`options are mutually exclusive.)`
Prepare for mdoc(7)NG. 2000-12-19 16:00:12 +00:00			`.El`
Truss program. Requires procfs. 1997-12-06 05:23:12 +00:00			`.Sh EXAMPLES`
			`# Follow the system calls used in echoing "hello"`
			`.Dl $ truss /bin/echo hello`
			`# Do the same, but put the output into a file`
			`.Dl $ truss -o /tmp/truss.out /bin/echo hello`
			`# Follow an already-running process`
Attaching to the init process returns EINVAL, so give an example that is more likely to work. Stolen from the ktrace(1) manual page. PR: 128222 Submitted by: Mateusz Guzik <mjguzik@gmail.com> 2009-01-23 00:58:14 +00:00			`.Dl $ truss -p 34`
Truss program. Requires procfs. 1997-12-06 05:23:12 +00:00			`.Sh SEE ALSO`
Sort Xrefs. Use err(3). Remove uneeded #include. Correct usage: one of {-p pid, command} is required. Open output file when command line is fully analyzed: incorrect `truss -o f' command does not create an empty file anymore. 1998-01-05 07:30:26 +00:00			`.Xr kdump 1 ,`
Truss program. Requires procfs. 1997-12-06 05:23:12 +00:00			`.Xr ktrace 1 ,`
Remove duplicate ' 2' manpage section number. Submitted by: Rui Paulo MFC after: 3 days 2007-05-21 20:33:51 +00:00			`.Xr ptrace 2`
Truss program. Requires procfs. 1997-12-06 05:23:12 +00:00			`.Sh HISTORY`
			`The`
Sort Xrefs. Use err(3). Remove uneeded #include. Correct usage: one of {-p pid, command} is required. Open output file when command line is fully analyzed: incorrect `truss -o f' command does not create an empty file anymore. 1998-01-05 07:30:26 +00:00			`.Nm`
			`command was written by`
			`.An Sean Eric Fagan`
			`for`
Fxi various man pages to stop abusing the .Bx macro to generate the string "FreeBSD". Use the .Fx macro instead. Also did some minor re-wording/formatting to work around a deficiency with the .Fx macro when it comes to puncuation characters other than periods and commas. 2000-01-23 01:48:16 +00:00			`.Fx .`
			`It was modeled after`
Truss program. Requires procfs. 1997-12-06 05:23:12 +00:00			`similar commands available for System V Release 4 and SunOS.`