strace: Tracing System Calls to Debug Silent Failures

A process fails with no useful error message, returns exit code 1, or behaves unexpectedly — and there are no application-level logs to diagnose it.

Use strace to trace system calls and signals, revealing what the process is actually doing.

# Trace a new process
strace /usr/bin/myapp arg1 arg2

# Attach to a running process
strace -p 1234

# Filter to specific syscalls (open, read, write)
strace -e trace=openat,read,write myapp

# Filter to just file operations
strace -e trace=file myapp

# Filter to network syscalls
strace -e trace=network myapp

# Follow child processes (forks)
strace -f myapp

# Write output to file (stderr by default)
strace -o /tmp/strace.log myapp

# Show timestamps and elapsed time
strace -t -T myapp

# Count syscall frequency
strace -c myapp

# Common pattern: find why a file open fails
strace -e openat myapp 2>&1 | grep ENOENT

strace intercepts every kernel system call. A process that fails to open a config file, connect to a socket, or find a library will show the exact path it tried and the exact errno returned. This reveals misconfigurations that produce no application-level log.