Lesson 1.61: Tracing a failing program with strace
'cannot load configuration' while the configuration file is right there: a vague error message hides which file, which path, which permission. strace shows every request a program makes to the kernel and every answer, so the real cause appears as one line ending in ENOENT or EACCES. In the lab Northwind's nightly report job fails three times for three different reasons. You trace each failure to a single system call, fix it and confirm the report is written.
18 min
You will learn to
- Explain what a system call is
- Run a program under strace and save the trace
- Filter a trace with -e trace=
- Read openat and connect results (ENOENT, EACCES, ECONNREFUSED)
- Tell normal noise from the real error
Key terms
- System call
- A request from a program to the kernel: open a file, connect a socket, start a program.
- strace
- A tool that runs a program (or attaches to one) and prints each system call with its arguments and result.
- errno
- The error code a failed call returns, shown as -1 plus a name.
- ENOENT / EACCES
- No such file or directory / permission denied.
- ECONNREFUSED
- Nothing listens on that address and port (or a firewall rejects it).
- -e trace=
- Shows only the named calls or classes such as %file and %network.
← Timers instead of cron · All lessons · Shell history and tool artifacts →