如:
strace -s 200 -f -o /var/tmp/trace.log -p <process pid>
-s strsize Specify the maximum string size to print (the default is 32). Note that filenames are not considered strings and are always printed
in full. 打处理的最大字符串长度
-p pid Attach to the process with the process ID pid and begin tracing. The trace may be terminated at any time by a keyboard interrupt
signal (CTRL-C). strace will respond by detaching itself from the traced process(es) leaving it (them) to continue running. Multi-
ple -p options can be used to attach to up to 32 processes in addition to command (which is optional if at least one -p option is
given).
-o file 输出到文件
-f Trace child processes as they are created by currently traced processes as a result of the fork(2) system call.
On non-Linux platforms the new process is attached to as soon as its pid is known (through the return value of fork(2) in the parent
process). This means that such children may run uncontrolled for a while (especially in the case of a vfork(2)), until the parent is
scheduled again to complete its (v)fork(2) call. On Linux the child is traced from its first instruction with no delay. If the par-
ent process decides to wait(2) for a child that is currently being traced, it is suspended until an appropriate child process either
terminates or incurs a signal that would cause it to terminate (as determined from the child’s current signal disposition).
On SunOS 4.x the tracing of vforks is accomplished with some dynamic linking trickery.