library function call tracer
enables shared library function calls issued
by the specified processes to be traced using the
user tracing facility.
By default, call trace data is logged to the file
, unless overridden by the
option. Each function call is traced as a pair
entries; the first entry
contains the shared library containing the symbol being called, and the second
entry contains the symbol name.
Once tracing is enabled on a process, trace data will be logged until either the
process exits or the trace point is cleared with
. A traced process can
generate enormous amounts of log data quickly; it is strongly suggested that
users memorize how to disable tracing before attempting to trace a process.
The following command is sufficient to disable tracing on all user owned
processes and, if executed by root, all processes:
$ ktrace -C
The trace file is not human-readable; use
to decode it.
The options are as follows:
- Append to the trace file instead of recreating it.
- Log trace records to
trfile instead of
- Inherit; pass the trace flags to all future children of the
- The string argument represents the kernel trace points, one
per letter. The default is just u. The
following table equates the letters with the trace points:
- trace system calls
- trace I/O
- trace namei translations
- trace violation of
- trace signal processing
- trace various structures
- trace user data coming from
- trace argument vector in
- trace environment in
- trace the default points
- Restrict the trace to a list of shared objects and/or
function names, as specified by the
trspec argument. The trace specification
is a comma-separated list of library names, followed by a colon (:), and a
comma-separated list of function names. Each list can be empty. Each list
member may end with a star (*) to only match the beginning of a name. An
exclamation mark at the beginning of a list turns it into a rejection
list, causing all unmatched names to be traced. Library names are compared
without their version number and ‘.so’ suffix.
- Execute command with the
specified trace flags.
- Default ltrace dump file.
Trace all shared library function calls from
reading the message of the
$ ltrace wc -lh /etc/motd
Trace only the shared library function calls in
$ ltrace -u libutil wc -lh
Trace all the shared library function calls but those in
$ ltrace -u "!libc" wc -lh
Trace all the shared library function calls with names starting
$ ltrace -u ":fmt*" wc -lh
Trace all shared library function calls, as well as all system calls:
$ ltrace -t cu wc -lh /etc/motd
command appeared in