How to track child process using strace?


Linux Problem Overview

I used strace to attach to a process briefly. The process created 90 threads. When I found the offending thread, I had to tediously search for the parent thread, then the grandparent thread, and so on all the way to the root process.

Is there a trick or tool to quickly figure out which thread created another? Or better yet, print the tree of thread creations like pstree?

Linux Solutions

Solution 1 - Linux

strace -f to trace child process that's fork()ed.

Solution 2 - Linux

I can't see an easy way:

You could use the -ff option with -o filename to produce multiple files (one per pid).


strace -o process_dump -ff ./executable
grep clone process_dump*

that would help you see which parent created what. Maybe that would help you - at least then you could search backwards.

Solution 3 - Linux

There is a perl script called strace-graph. Here is a version from github. It is packaged with crosstool-ng versions of compilers. It works for me even used cross platform.

ARM Linux box.

$ ./strace -f -q -s 100 -o app.trc -p 449
$ tftp -pr app.trc

X86_64 Linux box.

$ ./strace-graph /srv/tftp/app.trc 
  +-- touch /tmp/ppp.sleep
  +-- killall -HUP pppd
  +-- amixer set Speaker 70%
  +-- amixer set Speaker 70%
  +-- amixer set Speaker 70%
  +-- amixer set Speaker 70%
  +-- amixer set Speaker 50%
  +-- amixer set Speaker 70%
  `-- amixer set Speaker 50%

The output can be used to help navigate the main trace log.

Solution 4 - Linux

To capture traffic for a single process you can use strace, as @stackmate suggested.

strace -f -e trace=network -s 10000 -p <PID>;

or output it to a file.

strace -f -e trace=network -s 10000 -o dumpfile -p <PID>

-f for all forked process, -s for string size to print, and -o to dump the output to a file.


All content for this solution is sourced from the original question on Stackoverflow.

The content on this page is licensed under the Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) license.

Content TypeOriginal AuthorOriginal Content on Stackoverflow
QuestionprojectshaveView Question on Stackoverflow
Solution 1 - LinuxJe RogView Answer on Stackoverflow
Solution 2 - LinuxstackmateView Answer on Stackoverflow
Solution 3 - Linuxartless noiseView Answer on Stackoverflow
Solution 4 - LinuxalshabotiView Answer on Stackoverflow