I want a log or live data that discloses the system calls an application makes. I have used strace but can't find a guide for it that is decent. I'm interested in knowing the calls made after user intervention like opening a menu and so on. If you run (strace application_name) it is static. What good is this? When does strace make this file? When is this log produced?

Thanks in advance!

Not sure what you mean by 'static'.

If you use strace you will get continuous output to stderr of all the system calls being made, eg from a terminal:
Alternatively you can run strace in the background and redirect the output to a file:
and you can then watch the file updates whenever you want using tail.

Can you give an example of the type of application you are trying to trace?

1 members found this post helpful.

"Static" -monitors the application opening and then exits. I'm doubt I'm using the correct option.I have noticed that Strace opens up the command or application when you use the Strace command. If I do (strace -f gedit) I can witness strace still working but if I do it in most other applications it exits. Right now I primarily want to witness gnome-sessions scroll through the locations that the mouse cursor is pointing to on the desktop. If I run (strace -f gnome-sessions it logs for maybe 3 seconds and crashed the desktop, (reboot). I'm going in the direction of investaging Linux through feedback so I'm attempting to learn some of the basics and straight-forward ways to do this.


Other than adding an option after a hyphen I don't know how to redirect output to a different file.
Any links or advise on how to do this would be great.
Thanks again!

Are you starting gnome-session from a terminal (ie, before the display manager starts), or are you already inside the gnome desktop and are starting it again? Note that by default strace starts a new process, doesn't attach to an existing one; and you don't want to be running two copies of gnome-session.

If you just want to attach to an existing process id and trace it, you can use the '-p' flag (you will need to use ps to find the id).

You may have some issues trying to view the output in real time on the same screen as gnome-session is using. You should redirect the output (using the '-o' flag is the easiest, though you can use '2>'), since tracing gnome-session may interfere with normal X output (and your strace will be trying to update the screen with the trace data). If you really need to see it in real time, I would suggest using ssh to log in from a second machine, so that you can view the trace on the second machine and leave the main machine to do its thing in peace.

Also, you may want to log child processes of gnome-session using the '-f' flag (I think you are already doing that).

strace will work easily on most application level processes like gedit, it just gets a bit more complicated when you are tracing the code that you are running strace under!

1 members found this post helpful.

I found a decent website that has info on how to put in arguments but I had to use a site that would not use my non-windows browser for something else, so I'll have to get back to it later. Thanks for the info on running two gnome-sessions . That makes sense. I think I read to use the P option but I can't remember off the top of my head. The ssh thing is out of my league at this point but maybe sometime down the line.