What does -e trace= accept?

It takes a comma-separated list of category names (like file,network), individual syscall names (like openat,read), or qualifiers such as %file. Categories are shorthand for related groups of syscalls.

What is the difference between file and desc?

The file category covers syscalls that take a path argument, such as open, stat and unlink. The desc (descriptor) category covers syscalls operating on file descriptors, such as read, write, close and dup. Many programs need both.

How do I trace a running process?

Use strace -p PID to attach to an existing process by its PID, instead of launching a new command. Combine with -f to also follow threads and children, and press Ctrl-C to detach.

How do I follow child processes?

Add -f so strace follows fork, vfork and clone and traces the children too. Without it, only the initial process is traced and activity in forked workers is missed.

Can I see timing and counts instead of every call?

Yes. strace -c suppresses the per-call output and instead prints a summary table of call counts, errors and time spent per syscall when the program exits, which is ideal for finding hotspots.

strace System Call Categories

Email me this result

Get this tool's output sent to your inbox, plus one useful tool a week. No spam, unsubscribe any time.

Build strace trace filters by syscall category

strace can flood the terminal, so its -e trace= option lets you limit output to families of system calls. This reference lists the category names strace accepts — file, process, network, memory, signal, ipc and descriptor — with example syscalls, and assembles the full command for you. It runs entirely in your browser.

How it works

strace -e trace=CATS command traces only the chosen call families. CATS is a comma-separated list of category names, individual syscall names, or % qualifiers. The most useful categories are file (path-based calls), desc (descriptor calls), network, process, memory, signal and ipc:

strace -e trace=network,desc -f curl https://example.com
strace -e trace=file -p 4821
strace -c ./myprogram

Tips and examples

Combine file and desc to see both the open and the subsequent read/write on the resulting descriptor.
-f follows forked children and threads — essential for tracing servers and shells that spawn workers.
-c replaces the per-call log with a summary of counts, errors and time per syscall, perfect for spotting the most-called or slowest call.
Use -o trace.log to write output to a file and keep it off the program’s own stderr, and -y to print the path behind each file descriptor.