linux下用strace追踪bash执行的命令程序

 

1、获取当前bash进程号

[root@yglocal ~]# echo $$
8260
[root@yglocal ~]# ps -ef |grep $$
root       8260   8256  0 10:51 pts/0    00:00:00 -bash
root       8402   8260  0 11:11 pts/0    00:00:00 ps -ef
root       8403   8260  0 11:11 pts/0    00:00:00 grep --color=auto 8260
[root@yglocal ~]# w
 11:11:43 up 22 min,  1 user,  load average: 0.00, 0.01, 0.05
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
root     pts/0    192.168.187.1    10:51    7.00s  0.42s  0.04s w

 

2、是要strace追踪bash进程执行execve的事件

[root@yglocal ~]# strace -f -e execve -p $$ -v &
[1] 8405
[root@yglocal ~]# strace: Process 8260 attached

[root@yglocal ~]# ls
strace: Process 8407 attached
[pid  8407] execve("/usr/bin/ls", ["ls", "--color=auto"], ["XDG_SESSION_ID=2", "HOSTNAME=yglocal", "SELINUX_ROLE_REQUESTED=", "TERM=vt100", "SHELL=/bin/bash", "HISTSIZE=1000", "SSH_CLIENT=192.168.187.1 7314 22", "SELINUX_USE_CURRENT_RANGE=", "SSH_TTY=/dev/pts/0", "USER=root", "LS_COLORS=rs=0:di=01;34:ln=01;36"..., "MAIL=/var/spool/mail/root", "PATH=/usr/local/sbin:/usr/local/"..., "PWD=/root", "LANG=en_US.UTF-8", "SELINUX_LEVEL_REQUESTED=", "HISTCONTROL=ignoredups", "SHLVL=1", "HOME=/root", "LOGNAME=root", "SSH_CONNECTION=192.168.187.1 731"..., "LESSOPEN=||/usr/bin/lesspipe.sh "..., "XDG_RUNTIME_DIR=/run/user/0", "_=/usr/bin/ls"]) = 0
12121       dd_mbr.strace    intel-01.S  linux310  mbr.bin      mbr.bin.bak1      perf.data   stap.log
anaconda-ks.cfg  a.out    flamegraph   kernel_rpm  main.c    mbr.bin.bak  sk-txq.stp  test
[pid  8407] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=8407, si_uid=0, si_status=0, si_utime=0, si_stime=9} ---
[root@yglocal ~]# ll
strace: Process 8408 attached
[pid  8408] execve("/usr/bin/ls", ["ls", "--color=auto", "-l", "--color=auto"], ["XDG_SESSION_ID=2", "HOSTNAME=yglocal", "SELINUX_ROLE_REQUESTED=", "TERM=vt100", "SHELL=/bin/bash", "HISTSIZE=1000", "SSH_CLIENT=192.168.187.1 7314 22", "SELINUX_USE_CURRENT_RANGE=", "SSH_TTY=/dev/pts/0", "USER=root", "LS_COLORS=rs=0:di=01;34:ln=01;36"..., "MAIL=/var/spool/mail/root", "PATH=/usr/local/sbin:/usr/local/"..., "PWD=/root", "LANG=en_US.UTF-8", "SELINUX_LEVEL_REQUESTED=", "HISTCONTROL=ignoredups", "SHLVL=1", "HOME=/root", "LOGNAME=root", "SSH_CONNECTION=192.168.187.1 731"..., "LESSOPEN=||/usr/bin/lesspipe.sh "..., "XDG_RUNTIME_DIR=/run/user/0", "_=/usr/bin/ls"]) = 0
total 167200
-rw-r--r--. 1 root root        90 Mar 31 16:07 12121
-rw-------. 1 root root      1420 Aug  6  2019 anaconda-ks.cfg
-rwxr-xr-x. 1 root root      8552 Apr  2 18:01 a.out
-rw-r--r--. 1 root root     78637 Aug  8  2019 dd_mbr.strace
drwxr-xr-x. 3 root root        24 Apr  3 10:56 flamegraph
-rw-r--r--. 1 root root    902604 Apr  2 17:47 intel-01.S
drwxr-xr-x. 2 root root       129 Mar 26 14:09 kernel_rpm
-rw-r--r--. 1 root root 126439378 Mar 12 15:37 linux310
-rw-r--r--. 1 root root      3039 Aug  6  2019 main.c
-rw-r--r--. 1 root root       512 Aug  8  2019 mbr.bin
-rw-r--r--. 1 root root       512 Aug  8  2019 mbr.bin.bak
-rw-r--r--. 1 root root       512 Aug  8  2019 mbr.bin.bak1
-rw-------. 1 root root    673364 Apr  2 18:04 perf.data
-rw-r--r--. 1 root root       299 Apr  3 10:24 sk-txq.stp
-rw-r--r--. 1 root root  43040602 Mar 30 15:02 stap.log
drwxr-xr-x. 3 root root       180 Jun  2 20:43 test
[pid  8408] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=8408, si_uid=0, si_status=0, si_utime=0, si_stime=1} ---
[root@yglocal ~]# pwd
/root
[root@yglocal ~]# 
[root@yglocal ~]# /bin/pwd
strace: Process 8409 attached
[pid  8409] execve("/bin/pwd", ["/bin/pwd"], ["XDG_SESSION_ID=2", "HOSTNAME=yglocal", "SELINUX_ROLE_REQUESTED=", "TERM=vt100", "SHELL=/bin/bash", "HISTSIZE=1000", "SSH_CLIENT=192.168.187.1 7314 22", "SELINUX_USE_CURRENT_RANGE=", "SSH_TTY=/dev/pts/0", "USER=root", "LS_COLORS=rs=0:di=01;34:ln=01;36"..., "MAIL=/var/spool/mail/root", "PATH=/usr/local/sbin:/usr/local/"..., "PWD=/root", "LANG=en_US.UTF-8", "SELINUX_LEVEL_REQUESTED=", "HISTCONTROL=ignoredups", "SHLVL=1", "HOME=/root", "LOGNAME=root", "SSH_CONNECTION=192.168.187.1 731"..., "LESSOPEN=||/usr/bin/lesspipe.sh "..., "XDG_RUNTIME_DIR=/run/user/0", "_=/bin/pwd"]) = 0
/root
[pid  8409] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=8409, si_uid=0, si_status=0, si_utime=0, si_stime=6} ---
[root@yglocal ~]# 

注意，这里strace的参数说明：

-f参数表示追踪bash fork出的子进程；

-e参数后面跟的是要追踪的系统调用(这里是execve)

-p参数后跟要strace的进程pid(这里是$$，也即是当前终端bash进程的pid)

-v参数输出详细信息

最后 & 参数，让strace在后台运行，不然无法使用终端了。

3、停止追踪

对于后台进程，可以fg将后台进程恢复到前台，然后ctrl + c终止进程。

[root@yglocal ~]# fg
strace -f -e execve -p $$ -v
^Cstrace: Process 8260 detached
[root@yglocal ~]# 
[root@yglocal ~]# ls
12121            dd_mbr.strace    intel-01.S  linux310  mbr.bin      mbr.bin.bak1      perf.data   stap.log
anaconda-ks.cfg  a.out     flamegraph               kernel_rpm  main.c    mbr.bin.bak  sk-txq.stp  test