Kernel monitor and performance tools

To attach strace to an already running process, you need to specify the -p with the
process ID (PID) of the process that you want to monitor:
strace -p `pidof mysqld`
To trace only network related system calls, use -e trace=network:
strace -e trace=network -p 26520

The -c calculates the time the kernel spent on each system call:
strace -c find /etc -name xorg.conf

To trace all child processes of a process, use -f:
strace -f rcapache2 status

If you need to analyze the output of strace and the output messages are too long to
be inspected directly in the console window, use -o. In that case, unnecessary messages,
such as information about attaching and detaching processes, are suppressed. You can
also suppress these messages (normally printed on the standard output) with -q. To
optionally prepend timestamps to each line with a system call, use -t:
strace -t -o strace_sleep.txt sleep 1; more strace_sleep.txt

ltrace traces dynamic library calls of a process. It is used in a similar way to strace,
and most of their parameters have a very similar or identical meaning. By default,
ltrace uses /etc/ltrace.conf or ~/.ltrace.conf configuration files. You
can, however, specify an alternative one with the -F config_file option.
ltrace -S -o ltrace_find.txt find /etc -name \

You can change the type of traced events with the -e option. The following example
prints library calls related to fnmatch and strlen functions:
ltrace -e fnmatch,strlen find /etc -name xorg.conf

kexec and kdump