tracing
also: system call tracing, function tracing, dynamic tracing, execution trace
Tracing is a debugging technique that records and monitors system calls, function calls, or kernel events in real-time to observe program behavior and performance. Tools like strace and ftrace capture detailed execution flows without requiring code modification.
Tracing enables developers and system administrators to see exactly what a program is doing at runtime by intercepting and logging low-level operations. Unlike traditional debugging which pauses execution at breakpoints, tracing runs the program at near-normal speed while recording a detailed log of events.
Common tracing tools include strace (traces system calls), ltrace (traces library calls), and kernel-level tracers like ftrace or perf. For example, strace ls /tmp shows every system call the ls command makes—open, read, write, stat—revealing file access patterns and potential bottlenecks.
Tracing is invaluable for troubleshooting hung processes, understanding performance issues, detecting security problems, and analyzing how programs interact with the operating system. Kernel tracing can capture context switches, interrupt handlers, and memory allocation events across the entire system.