# Strace

> Auth/lab ref: Linux syscall tracer for observing file, process, network, memory, and signal behavior at runtime.

- Skill: `aeondave/strace` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aeondave/strace`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/strace/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/strace

---


# strace

Runtime truth serum for Linux programs: if the kernel saw it, `strace` can usually tell you.

## When to use strace

Use strace when you need to:

- see opened files, sockets, child processes, and exec chains
- debug missing libraries, bad paths, permission failures, or seccomp kills
- observe exact syscall arguments around exploit or malware activity
- confirm environment assumptions before touching the target in a debugger

## Quick Start

```bash
# Trace a process and its syscalls
strace ./chall

# Follow children and save output
strace -f -o trace.log ./chall

# Show more string data
strace -f -s 256 ./chall
```

## High-Value Workflows

### Scope the trace to what matters

```bash
strace -f -e trace=file ./chall
strace -f -e trace=network,process ./chall
strace -f -e trace=openat,execve,connect ./chall
```

### Attach to an existing process

```bash
strace -p 1234
strace -f -p 1234 -e trace=file,network
```

### Timing and descriptor-aware logging

```bash
strace -ff -tt -yy -o trace ./chall
```

## Practical Notes

- Start with `-f -s 256 -o trace.log` for a readable baseline that survives noisy runs.
- `-e trace=file` is excellent for loader and path debugging.
- `-yy` helps map file descriptors and socket addresses to something human-friendly.
- Pair with `ltrace` when libc-level behavior matters more than raw syscalls.

## Caveats

- `strace` slows programs down and can perturb timing-sensitive targets.
- Anti-debug or ptrace-restricted environments may block attach or distort behavior.
- Syscall visibility does not automatically reveal higher-level intent; correlate with binary context.

## Resources

No bundled `scripts/`, `references/`, or `assets/`.
Use the `strace` man page for class filters, decoding controls, and fault-injection features.