ktrace – FreeBSD / Mac OS X Process Tracing and Reporting Tool

Under Linux you can use strace or valgrind tool for reporting and finding a bug. However, under *BSD / Mac OS X you need to use ktrace as replacement for strace tool.

ADVERTISEMENTS

kreace runs on the following platforms:
=> FreeBSD
=> OpenBSD
=> Mac OS X
=> NetBSD

The ktrace utility enables kernel trace logging for the specified processes. Kernel trace data is logged to the file ktrace.out. The kernel operations that are traced include system calls, namei translations, sig nal processing, and I/O. Once tracing is enabled on a process, trace data will be logged until either the process exits or the trace point is cleared. A traced process can generate enormous amounts of log data quickly; It is strongly suggested that users memorize how to disable tracing before attempting to trace a process.

To trace all kernel operations for process id # 2546, enter:
$ ktrace -p 2546
To disable all tracing of process # 2546, enter:
$ ktrace -cp 2546
To disable tracing on all user-owned processes, and, if executed by root, all processes in the system:
# ktrace -C
Attach to process id # 123 and log trace records to myapp.dbg.log instead of ktrace.out.
$ ktrace -p 123 -f myapp.dbg.log
To enable tracing of I/O on process # 123
$ ktrace -ti -p 123
The -t option is very useful to trace various kernel trace points, one per letter. The following table equates the letters with the trace points:

  • c : trace system calls
  • n : trace namei translations
  • i : trace I/O
  • s : trace signal processing
  • u : userland traces
  • w : context switches
  • + : trace the default set of trace points – c, n, i, s, u

Run the command called myapp and track only system calls, enter:
$ ktrace -tc ./myapp
Please note that the output of ktrace is not as informative as strace, but it does help to solve many problems.

truss: trace system calls

FreeBSD has another tool called truss. It traces the system calls called by the specified process or program. Output is to the specified output file, or standard error by default.
Attach to an already-running process # 123, enter
$ truss -p 123
Follow the system calls used myapp
$ truss ./myapp -d /tmp -f 120
Same as above, but put the output into a file called /tmp/myapp.dbg
$ truss -o /tmp/truss.out ./myapp -d /tmp -f 120

strace under FreeBSD

You can install strace under FreeBSD and other *BSD like oses.

Further readings:

  • ktrace man page
  • truss man page
🐧 Get the latest tutorials on SysAdmin, Linux/Unix, Open Source & DevOps topics via:
CategoryList of Unix and Linux commands
File Managementcat
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network Utilitiesdig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04

ADVERTISEMENTS
2 comments… add one
  • Bob Apr 29, 2008 @ 17:12

    Please somebody, port strace to AMD64! 🙂

  • macdet Aug 25, 2008 @ 2:23

    i will try ist at once. thx

Leave a Reply

Your email address will not be published. Required fields are marked *

Use HTML <pre>...</pre>, <code>...</code> and <kbd>...</kbd> for code samples.