21

I want to trace system calls with strace. There are too many read and write, so I want to exclude them.

Here is my test:

strace -e trace=!read ls

My PC (Ubuntu 14) failed to run this command. The error message is !open: event not found. I have read the man carefully and I can't understand why it failed.

Vertexwahn
  • 7,709
  • 6
  • 64
  • 90
bucherren
  • 223
  • 1
  • 2
  • 5

1 Answers1

23

Your shell interprets ! as a special symbol and thus fails to run the command. Use quotes:

strace -e 'trace=!read' ls

or escape with \:

strace -e trace=\!read ls
GreyCat
  • 16,622
  • 18
  • 74
  • 112
  • 1
    Is strace filter ignoring other syscall, or is the overhead the same? – mvorisek Dec 14 '17 at 08:46
  • 1
    The overhead will be the same as strace is still stopping the traced process for every syscall. There's work underway to change that using seccomp-bpf though (see the strace mailing list). – pchaigno Aug 05 '19 at 07:45
  • 8
    To ignore multiple system calls: `strace -e 'trace=!read,write' ls` – Chih-Hsuan Yen May 19 '20 at 15:23