truss(1)

NAME

truss - trace system calls

truss [-faedDS] [-o file] -p pid
truss [-faedDS] [-o file] command [args]

The truss utility traces the system calls called by the
specified process or program. Output is to the specified output file, or
standard error by default. It does this by stopping and restarting the pro
cess being monitored via procfs(5).
The options are as follows:
-f Trace descendants of the original traced process
created by: fork(2), vfork(2), etc.
-a Show the argument strings that are passed in each
execve(2) sys: tem call.
-e Show the environment strings that are passed in each
execve(2): system call.
-d Include timestamps in the output showing the time
elapsed since: the trace was started.
-D Include timestamps in the output showing the time
elapsed since: the last recorded event.
-S Do not display information about signals received by
the process.: (Normally, truss displays signal as well as system; call events.)
-o file: Print the output to the specified file instead of; standard error.
-p pid Follow the process specified by pid instead of a new
command.
command [args]: Execute command and trace the system calls of it.; (The -p and
command options are mutually exclusive.)
The procctl(8) utility can be used to clear tracepoints in a
stuck process left behind if truss terminates abnormally.

# Follow the system calls used in echoing "hello": $ truss /bin/echo hello
# Do the same, but put the output into a file: $ truss -o /tmp/truss.out /bin/echo hello
# Follow an already-running process: $ truss -p 1