5

I am using strace to capture calls to open(), close() and read() on Linux. The target process is the jetty web server. As far as I can tell, strace is not logging all calls to open(). Maybe the others too, I have not tried to correlate the file descriptors to open() calls.

For example, starting strace:

strace -f -e trace=open,close,read -o/tmp/strace.out -p62881

I then use wget to fetch 100 static files; all were retrieved successfully. In one run, only 56 open events were logged; on another run of 100 different files, I got 66 open events.

I believe that using "-f" results in strace attaching to all the LWPIDs for the threads ("Process 62881 attached with 25 threads - interrupt to quit "); when I try to explicitly attach to all using multiple "-p" options, I get a single "attach" success message, but multiple "Operation not permitted messages", one for each child PID.

I restarted Jetty to clear its cache before my tests.

Kernel version is 2.6.32-504.3.3.el6.x86_64 (Red Hat). Strace package version is strace-4.5.19-1.19.el6.x86_64.

What am I missing?

Thanks

Jim Gallagher
  • 51
  • 2

2 Answers2

8

On some systems you have to use openat() instead of open().

Try: strace -f -e trace=openat,close,read -o/tmp/strace.out -p62881

Abhijeet Pathak
  • 1,948
  • 3
  • 20
  • 28
0

Try -ff (in addition to -f):

-ff: If the -o filename option is in effect, each processes trace is written to filename.pid  where  pid  is
     the  numeric process id of each process.  This is incompatible with -c, since no per-process counts are
     kept.
Kedar Mhaswade
  • 4,535
  • 2
  • 25
  • 34