strace only one child process - Linux

This is a discussion on strace only one child process - Linux ; Hello, Thanks for your time. In the sytem I'm working, one server process creates one child process for each client request. I like to strace one of these child process. strace without specific options only traces the parent, and with ...

+ Reply to Thread
Results 1 to 15 of 15

Thread: strace only one child process

  1. strace only one child process

    Hello,

    Thanks for your time.

    In the sytem I'm working, one server process creates one child process
    for each client request. I like to strace one of these child process.
    strace without specific options only traces the parent, and with the
    "-f" option traces all childs, overloading the system.

    Knows someone any trick to trace only one (or a few ones) childs?

    Thanks again.


  2. Re: strace only one child process

    On 20 Oct 2006 01:10:40 -0700 tmp123 wrote:

    | In the sytem I'm working, one server process creates one child process
    | for each client request. I like to strace one of these child process.
    | strace without specific options only traces the parent, and with the
    | "-f" option traces all childs, overloading the system.
    |
    | Knows someone any trick to trace only one (or a few ones) childs?

    How do you know which child you want to trace? What is your means to
    identify which to trace and which not to trace?

    --
    |---------------------------------------/----------------------------------|
    | Phil Howard KA9WGN (ka9wgn.ham.org) / Do not send to the address below |
    | first name lower case at ipal.net / spamtrap-2006-10-20-0809@ipal.net |
    |------------------------------------/-------------------------------------|

  3. Re: strace only one child process


    phil-news-nospam@ipal.net wrote:
    > On 20 Oct 2006 01:10:40 -0700 tmp123 wrote:
    >
    > | In the sytem I'm working, one server process creates one child process
    > | for each client request. I like to strace one of these child process.
    > | strace without specific options only traces the parent, and with the
    > | "-f" option traces all childs, overloading the system.
    > |
    > | Knows someone any trick to trace only one (or a few ones) childs?
    >
    > How do you know which child you want to trace? What is your means to
    > identify which to trace and which not to trace?
    >


    Hello,

    Thanks for your help.

    Any child is valid. That means, the first (or one of the firsts, or a
    few of them) child after type the "strace" command will be ok.

    Kind regards.


  4. Re: strace only one child process

    > In the sytem I'm working, one server process creates one child process
    > for each client request. I like to strace one of these child process.
    > strace without specific options only traces the parent, and with the
    > "-f" option traces all childs, overloading the system.
    >
    > Knows someone any trick to trace only one (or a few ones) childs?


    Attach to the desired child after it has been created.
    See the documentation for "strace -p ".

    --

  5. Re: strace only one child process

    On Fri, 20 Oct 2006 07:19:49 -0700 John Reiser wrote:
    |> In the sytem I'm working, one server process creates one child process
    |> for each client request. I like to strace one of these child process.
    |> strace without specific options only traces the parent, and with the
    |> "-f" option traces all childs, overloading the system.
    |>
    |> Knows someone any trick to trace only one (or a few ones) childs?
    |
    | Attach to the desired child after it has been created.
    | See the documentation for "strace -p ".

    He might be wanting to see what the child does with the incoming connection
    right when it forks. The child may only live long enough to do something
    and then exit. I have a daemon that, upon TCP connection, spits out a file
    to whatever connects, then exits. If it's a short file, the child is gone
    in quite a hurry.

    --
    |---------------------------------------/----------------------------------|
    | Phil Howard KA9WGN (ka9wgn.ham.org) / Do not send to the address below |
    | first name lower case at ipal.net / spamtrap-2006-10-20-1248@ipal.net |
    |------------------------------------/-------------------------------------|

  6. Re: strace only one child process

    phil-news-nospam@ipal.net wrote:
    > |> Knows someone any trick to trace only one (or a few ones) childs?
    > |
    > | Attach to the desired child after it has been created.
    > | See the documentation for "strace -p ".
    >
    > He might be wanting to see what the child does with the incoming connection
    > right when it forks. The child may only live long enough to do something
    > and then exit. I have a daemon that, upon TCP connection, spits out a file
    > to whatever connects, then exits. If it's a short file, the child is gone
    > in quite a hurry.


    The suggestion to attach after the child exists does help in some
    cases. In some others, the child can be modified to wait long enough.

    When both of those fail, what did _you_ suggest that works?

    --


  7. Re: strace only one child process

    In comp.os.linux.development.system tmp123 :
    > Hello,


    > Thanks for your time.


    Please cross-post if you think it is needed, just tried to answer
    your question in colm...

    [ snip multi posted question ]

    --
    Michael Heiming (X-PGP-Sig > GPG-Key ID: EDD27B94)
    mail: echo zvpunry@urvzvat.qr | perl -pe 'y/a-z/n-za-m/'
    #bofh excuse 256: You need to install an RTFM interface.

  8. Re: strace only one child process

    On Fri, 20 Oct 2006 12:26:58 -0700 John Reiser wrote:
    | phil-news-nospam@ipal.net wrote:
    |> |> Knows someone any trick to trace only one (or a few ones) childs?
    |> |
    |> | Attach to the desired child after it has been created.
    |> | See the documentation for "strace -p ".
    |>
    |> He might be wanting to see what the child does with the incoming connection
    |> right when it forks. The child may only live long enough to do something
    |> and then exit. I have a daemon that, upon TCP connection, spits out a file
    |> to whatever connects, then exits. If it's a short file, the child is gone
    |> in quite a hurry.
    |
    | The suggestion to attach after the child exists does help in some
    | cases. In some others, the child can be modified to wait long enough.
    |
    | When both of those fail, what did _you_ suggest that works?

    Filtering the strace output. Or modifying strace.

    --
    |---------------------------------------/----------------------------------|
    | Phil Howard KA9WGN (ka9wgn.ham.org) / Do not send to the address below |
    | first name lower case at ipal.net / spamtrap-2006-10-20-2208@ipal.net |
    |------------------------------------/-------------------------------------|

  9. Re: strace only one child process

    phil-news-nospam@ipal.net wrote:
    > On Fri, 20 Oct 2006 12:26:58 -0700 John Reiser wrote:
    > | phil-news-nospam@ipal.net wrote:
    > |> |> Knows someone any trick to trace only one (or a few ones) childs?
    > |> |
    > |> | Attach to the desired child after it has been created.
    > |> | See the documentation for "strace -p ".
    > |>
    > |> He might be wanting to see what the child does with the incoming connection
    > |> right when it forks. The child may only live long enough to do something
    > |> and then exit. I have a daemon that, upon TCP connection, spits out a file
    > |> to whatever connects, then exits. If it's a short file, the child is gone
    > |> in quite a hurry.
    > |
    > | The suggestion to attach after the child exists does help in some
    > | cases. In some others, the child can be modified to wait long enough.
    > |
    > | When both of those fail, what did _you_ suggest that works?
    >
    > Filtering the strace output. Or modifying strace.
    >



    Hello,

    Thanks for your answers,

    Execution time is less than one second. No time to "ps" and "strace
    -p".

    The problem is the overload if all childs are traced. The overload in
    "strace" seems the same independent of the "-e" options.

    About modify "strace", it is a posibility. I should evaluate the
    necessary effort. The idea will be add to the "-f" option an optional
    numerical argument: maximum number of childs to follow.

    Kind regards.


  10. Re: strace only one child process

    Michael Heiming wrote:
    > In comp.os.linux.development.system tmp123 :
    > > Hello,

    >
    > > Thanks for your time.

    >
    > Please cross-post if you think it is needed, just tried to answer
    > your question in colm...
    >


    Yes, sorry.

    We can continue the post in this one.

    Kind regards.


  11. Re: strace only one child process

    On 21 Oct 2006 03:35:52 -0700 tmp123 wrote:

    | About modify "strace", it is a posibility. I should evaluate the
    | necessary effort. The idea will be add to the "-f" option an optional
    | numerical argument: maximum number of childs to follow.

    I would suggest integrating it with the -e option, allowing _any_ kind
    of specifiable event to be counted to determine when to stop tracing
    that event or to stop strace altogether. Then while you would be using
    it to count a maximum of fork() calls, someone else might find value in
    stopping tracing after some number of open() calls.

    --
    |---------------------------------------/----------------------------------|
    | Phil Howard KA9WGN (ka9wgn.ham.org) / Do not send to the address below |
    | first name lower case at ipal.net / spamtrap-2006-10-21-1837@ipal.net |
    |------------------------------------/-------------------------------------|

  12. Re: strace only one child process

    tmp123 wrote:
    > Hello,
    >
    > Thanks for your time.
    >
    > In the sytem I'm working, one server process creates one child process
    > for each client request. I like to strace one of these child process.
    > strace without specific options only traces the parent, and with the
    > "-f" option traces all childs, overloading the system.
    >
    > Knows someone any trick to trace only one (or a few ones) childs.


    I wonder whether the ptrace request PTRACE_TRACEME can be used to wait
    for a tracing program that is not the parent of a process, but just any
    random process doing a PTRACE_ATTACH.

    If that's the case you could implement a little hack whereby one of the
    children simply arranges to be traced, right after it is forked. That
    is to say, it forks off an strace job, passing its own pid in the
    command line, and then calls ptrace with PTRACE_TRACEME to wait for
    strace to attach.

    Such a thing, if possible, could be abstracted into a debugging
    function:

    void traceme(const char *cmd_fmt, ...);

    Then in any process you want, just call

    traceme("strace -o trace_file -p %d", (int) getpid());

    and after this point you are sure that everything is traced, provided
    that strace was launched successfully. Just a hypothetical idea.

    Or you could get the strace code, and hack it into having the filtering
    functionality that you want.


  13. Re: strace only one child process

    phil-news-nospam@ipal.net wrote:
    > On 21 Oct 2006 03:35:52 -0700 tmp123 wrote:
    >
    > | About modify "strace", it is a posibility. I should evaluate the
    > | necessary effort. The idea will be add to the "-f" option an optional
    > | numerical argument: maximum number of childs to follow.
    >
    > I would suggest integrating it with the -e option, allowing _any_ kind
    > of specifiable event to be counted to determine when to stop tracing
    > that event or to stop strace altogether. Then while you would be using
    > it to count a maximum of fork() calls, someone else might find value in
    > stopping tracing after some number of open() calls.
    >



    Yes, is true. A program like "truss" allows 3 lists of independent
    events: the ones to trace, the ones to start the trace and the ones to
    end it.

    I'm wondering why "strace" does not have it.

    Kind regards.


  14. Re: strace only one child process

    On 22 Oct 2006 04:23:48 -0700 tmp123 wrote:
    | phil-news-nospam@ipal.net wrote:
    |> On 21 Oct 2006 03:35:52 -0700 tmp123 wrote:
    |>
    |> | About modify "strace", it is a posibility. I should evaluate the
    |> | necessary effort. The idea will be add to the "-f" option an optional
    |> | numerical argument: maximum number of childs to follow.
    |>
    |> I would suggest integrating it with the -e option, allowing _any_ kind
    |> of specifiable event to be counted to determine when to stop tracing
    |> that event or to stop strace altogether. Then while you would be using
    |> it to count a maximum of fork() calls, someone else might find value in
    |> stopping tracing after some number of open() calls.
    |>
    |
    |
    | Yes, is true. A program like "truss" allows 3 lists of independent
    | events: the ones to trace, the ones to start the trace and the ones to
    | end it.
    |
    | I'm wondering why "strace" does not have it.

    Each programmer can look in the mirror and see the answer. I am as guilty
    as you or anyone else for having not added that feature.

    --
    |---------------------------------------/----------------------------------|
    | Phil Howard KA9WGN (ka9wgn.ham.org) / Do not send to the address below |
    | first name lower case at ipal.net / spamtrap-2006-10-23-0710@ipal.net |
    |------------------------------------/-------------------------------------|

  15. Re: strace only one child process


    phil-news-nospam@ipal.net wrote:
    > On 22 Oct 2006 04:23:48 -0700 tmp123 wrote:
    > | phil-news-nospam@ipal.net wrote:
    > |> On 21 Oct 2006 03:35:52 -0700 tmp123 wrote:
    > |>
    > |> | About modify "strace", it is a posibility. I should evaluate the
    > |> | necessary effort. The idea will be add to the "-f" option an optional
    > |> | numerical argument: maximum number of childs to follow.
    > |>
    > |> I would suggest integrating it with the -e option, allowing _any_ kind
    > |> of specifiable event to be counted to determine when to stop tracing
    > |> that event or to stop strace altogether. Then while you would be using
    > |> it to count a maximum of fork() calls, someone else might find value in
    > |> stopping tracing after some number of open() calls.
    > |>
    > |
    > |
    > | Yes, is true. A program like "truss" allows 3 lists of independent
    > | events: the ones to trace, the ones to start the trace and the ones to
    > | end it.
    > |
    > | I'm wondering why "strace" does not have it.
    >
    > Each programmer can look in the mirror and see the answer. I am as guilty
    > as you or anyone else for having not added that feature.
    >



    Yes, if it is only a problem of made the effort.

    My question was more referred to posible blocking issues in the
    operating system or ptrace librarian.

    Sorry for the misunderstood.


+ Reply to Thread