strace
strace is a diagnostic tool that traces and displays all system calls and signals made by a process, showing what the kernel is doing on behalf of a running program.
strace intercepts and records every system call a process executes, along with the arguments passed to each call and the return values. This reveals exactly what a program is doing at the kernel level—opening files, allocating memory, creating threads, or communicating with the network.
To trace a command, simply run strace command. For example, strace ls /tmp shows all the system calls made by the ls command. The output displays each call like open("/tmp", O_RDONLY), helping you understand which files are accessed or why a program might be hanging.
strace is invaluable for debugging mysterious behavior: finding missing files, discovering permission issues, or optimizing performance by identifying expensive system calls. You can filter output with -e trace=open,read to focus on specific calls, or attach to a running process with strace -p PID.