Welcome to the most active Linux Forum on the web.
Go Back > Forums > Linux Forums > Linux - Newbie
User Name
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!


  Search this Thread
Old 01-16-2019, 08:16 AM   #1
LQ Newbie
Registered: Nov 2018
Posts: 6

Rep: Reputation: Disabled
Question Question about = vs strace

I have been working on to capture open and fopen. Following code is my own c code that is compiled to .so
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <dlfcn.h>
#include <limits.h>
#include <errno.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <string.h>
#include <stdarg.h>
#include <sys/syscall.h>
#include <unistd.h>

//this will be used for logging to a file
static void log_it(const char *fmt, ...) {
    int test_val = 0;
    static int initialized;
    static int logfd = -1;
    va_list ap;
    static int (*open_orig)(const char *, int, mode_t);
    if (access("/usr/filelog.txt", F_OK) != -1) {
        if (logfd == -1 && !initialized) {
	    open_orig = dlsym(RTLD_NEXT, "open");
	    initialized = 1;
	    if(test_val == 1) {
		logfd = open_orig("./filelog.txt", O_WRONLY|O_APPEND|O_CREAT, 0666);
	    } else {
		logfd = open_orig("/usr/filelog.txt", O_WRONLY|O_APPEND|O_CREAT, 0666);
	if (logfd != -1) {
	    va_start(ap, fmt);
	    vdprintf(logfd, fmt, ap);

static const char *redirect_name(const char *name) {
    return name;

int open(const char *pathname, int flags, ...){
    static int (*open_orig)(const char *, int, mode_t);
    int ret;
    va_list ap;
    mode_t mode;
    extern char *program_invocation_name;
    extern char *program_invocation_short_name;

    if (!open_orig) {
        open_orig = dlsym(RTLD_NEXT, "open");

    va_start(ap, flags);
    mode = va_arg(ap, mode_t);
    ret = open_orig(redirect_name(pathname), flags, mode);

    log_it("%s is being opened by %s\n", pathname, program_invocation_short_name);

    return ret;

FILE *fopen(const char *pathname, const char *mode) {
    extern char *program_invocation_name;
    FILE *(*original_fopen)(const char*, const char*);
    original_fopen = dlsym(RTLD_NEXT, "fopen");

    log_it("%s is being fopened by %s\n", pathname, program_invocation_name);
    return (*original_fopen)(pathname, mode);
Furthermore I moved this compiled .so file into /lib64/ and created inside of /etc/ folder
However, When I run following command

$openstack server create --flavor m1.tiny --image cirros-0.3.6-x86_64-disk --nic net-id=9453c04e-d739-403e-b5e5-06fed3f4e7e2 --security-group default vm
and looks at the /usr/filelog.txt (since my custom will capture open and fopen call and save process name inside of the filelog.txt.
I wanted to to be sure so I also ran following line to verify that my actually loads up and captures all the open and fopen calls

$strace -f -o ./log.txt openstack server create --flavor m1.tiny --image cirros-0.3.6-x86_64-disk --nic net-id=9453c04e-d739-403e-b5e5-06fed3f4e7e2 --security-group default vm
I also did following command to extract only the open system call from strace output ./log.txt

$cat ./log.txt | grep "open" >> ./log_open.txt
I compared ./log_open.txt and filelog.txt (created by seems like doesn't actually captures open and fopen calls. It is missing out a lot of the calls.


So the question is that why can't capture some of the open call but strace can?


Tags, strace

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] strace question poll taking a long time on an open command ALB Linux - Server 4 04-23-2012 07:06 PM
strace question ronopolis Linux - Software 0 01-19-2005 10:41 AM
Squid: how to preload cached objects & can restrict size of logs? dravya Linux - General 0 06-04-2004 09:23 AM
Library not found bruce1271 Linux - Software 1 09-25-2003 03:46 PM
JavaScript PreLoad Image andrewt Programming 1 08-25-2003 03:12 AM > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 03:36 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration