What does -e trace= accept?

It takes a comma-separated list of category names (like file,network), individual syscall names (like openat,read), or qualifiers such as %file. Categories are shorthand for related groups of syscalls.

What is the difference between file and desc?

The file category covers syscalls that take a path argument, such as open, stat and unlink. The desc (descriptor) category covers syscalls operating on file descriptors, such as read, write, close and dup. Many programs need both.

How do I trace a running process?

Use strace -p PID to attach to an existing process by its PID, instead of launching a new command. Combine with -f to also follow threads and children, and press Ctrl-C to detach.

How do I follow child processes?

Add -f so strace follows fork, vfork and clone and traces the children too. Without it, only the initial process is traced and activity in forked workers is missed.

Can I see timing and counts instead of every call?

Yes. strace -c suppresses the per-call output and instead prints a summary table of call counts, errors and time spent per syscall when the program exits, which is ideal for finding hotspots.

What is the strace System Call Categories?

Reference for strace -e trace= system call category names — file, process, network, memory, signal, ipc, desc — with example syscalls and the full strace invocation. It runs free in your browser on Gera Tools, with nothing uploaded.

strace System Call Categories

Name: strace System Call Categories
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

Get one useful tool a week

Like this tool? Enter your email and we'll send you one genuinely useful Gera tool a week — plus a link to come back to this one. No spam, one-click unsubscribe any time.

Build strace trace filters by syscall category

strace can flood the terminal, so its -e trace= option lets you limit output to families of system calls. This reference lists the category names strace accepts — file, process, network, memory, signal, ipc and descriptor — with example syscalls, and assembles the full command for you. It runs entirely in your browser.

How it works

strace -e trace=CATS command traces only the chosen call families. CATS is a comma-separated list of category names, individual syscall names, or % qualifiers. The most useful categories are file (path-based calls), desc (descriptor calls), network, process, memory, signal and ipc:

strace -e trace=network,desc -f curl https://example.com
strace -e trace=file -p 4821
strace -c ./myprogram

Category reference

Category	What it includes	Typical debugging use
`file`	`open`, `stat`, `unlink`, `rename` — path-based calls	Missing files, wrong paths, permission denials
`desc`	`read`, `write`, `close`, `dup`, `select` — fd-based calls	I/O throughput, hanging reads, leaked fds
`network`	`socket`, `connect`, `bind`, `sendto`, `recvfrom`	Connection refusals, bind failures
`process`	`fork`, `clone`, `execve`, `wait4`, `exit`	Process spawning issues, zombie tracking
`memory`	`mmap`, `mprotect`, `brk`, `munmap`	Heap growth, memory-mapping problems
`signal`	`kill`, `sigaction`, `pause`, `sigreturn`	Unexpected termination, signal handling
`ipc`	`pipe`, `shmget`, `msgget`, `semop`	Inter-process communication issues

Combining file,desc is the most common pairing: you see which path is opened and then what happens to the resulting file descriptor.

Worked debugging scenario

A service fails silently on startup. To find which file it cannot open:

strace -e trace=file -o /tmp/strace.log ./myservice
grep "ENOENT\|EACCES" /tmp/strace.log

ENOENT means a path does not exist; EACCES means a permissions problem. Redirecting to a file with -o keeps the trace clean of the program’s own output, making it much easier to grep.

Tips

Combine file and desc to see both the open and the subsequent read/write on the resulting descriptor.
-f follows forked children and threads — essential for tracing multi-process servers.
-c replaces the per-call log with a summary of counts, errors and time per syscall — ideal for finding the most-called or slowest syscall quickly.
Use -y to annotate file descriptors with their resolved paths, so you see the actual filename next to each read or write call.

Reading strace output

Each line in strace output follows the pattern syscall(args) = return_value. Return values of −1 indicate failure, followed by the errno name and a description:

openat(AT_FDCWD, "/etc/missing.conf", O_RDONLY) = -1 ENOENT (No such file or directory)
read(5, "hello", 4096)                          = 5
write(1, "hello\n", 6)                          = 6

The first line shows a failed open — the file does not exist. The second shows a 5-byte read on file descriptor 5. The third shows a 6-byte write to stdout (fd 1). For unknown file descriptors, -y resolves them to their path, making the trace far easier to follow in real programs.