strace and ltrace skill for system call and library call tracing. Use when a binary behaves incorrectly without crashing, diagnosing file-not-found errors, permission failures, network issues, or unexpected library calls by tracing syscalls and library function calls. Activates on queries about stra

strace / ltrace Purpose Guide agents through tracing system calls with strace and library calls with ltrace — the most effective tools for diagnosing incorrect binary behaviour without a crash or debugger. Triggers "My program behaves incorrectly — how do I trace what it's doing?" "How do I find what files a binary is opening?" "strace shows ENOENT — how do I interpret it?" "How do I trace network calls with strace?" "What is ltrace and how does it differ from strace?" "How do I trace a running process?" Workflow 1. Basic strace usage 2. Filter by syscall category Category Syscalls included file open, openat, stat, access, unlink, rename, ... network socket, connect, bind, accept, send, recv, ... process fork, exec, wait, clone, exit, ... memory mmap, munmap, mprotect, brk, ... signal kill, sigaction, sigprocmask, ... ipc pipe, socket pair, shmget, ... desc close, dup, poll, select, epoll, ... 3. Interpreting common errors Error Meaning Common cause ENOENT No such file or directory Config file missing, wrong path EACCES Permission denied File permissions, SELinux EPERM Operation not permitted Missing capability, suid needed EADDRINUSE Address already in use Port already bound ETIMEDOUT Connection timed out Network unreachable, firewall ECONNREFUSED Connection refused Server not listening EAGAIN Resource temporarily unavailable Non blocking I/O, try again ENOMEM Out of memory Allocation failed EBADF Bad file descriptor Using closed/invalid fd ENOEXEC Exec format error Wrong binary format for arch 4. Useful strace flags 5. ltrace — library call tracing Typical ltrace output: strace vs ltrace: strace ltrace Traces Kernel syscalls User space library calls Overhead Lower Higher (PLT hooking) Shows open() , read() , write() fopen() , malloc() , printf() Use when Binary interacts with OS/files/network Binary calls library functions you can't see 6. Practical diagnosis workflows 7. seccomp filter debugging If a program is killed by a seccomp policy, strace reveals which syscall triggered it: For strace output patterns and ltrace filtering examples, see [references/strace patterns.md](references/strace patterns.md). Related skills Use skills/debuggers/gdb when strace shows the failing location and you need to inspect internals Use skills/binaries/elf inspection to understand what libraries and symbols a binary uses Use skills/binaries/dynamic linking for diagnosing LD and library loading issues Use skills/profilers/linux perf for performance profiling (strace overhead is too high for perf)

strace-ltrace