path: root/ltrace.1

.\" -*-nroff-*-
.\" Copyright (c) 2012 Petr Machata, Red Hat Inc.
.\" Copyright (c) 1997-2005 Juan Cespedes <cespedes@debian.org>
.\"
.\" This program is free software; you can redistribute it and/or
.\" modify it under the terms of the GNU General Public License as
.\" published by the Free Software Foundation; either version 2 of the
.\" License, or (at your option) any later version.
.\"
.\" This program is distributed in the hope that it will be useful, but
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
.\" General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program; if not, write to the Free Software
.\" Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
.\" 02110-1301 USA
.\"
.TH LTRACE "1" "October 2012" "" "User Commands"
.SH NAME
ltrace \- A library call tracer

.SH SYNOPSIS
.B ltrace
.I "[-bCfghiLrStttV] [-a column] [-A maxelts] [-D level] [-e expr] [-l library_pattern] [-n nr] [-o filename] [-p pid] ... [-s strsize] [-u username] [-w count] [-x extern] ... [--align=column] [--debug=level] [--demangle] [--help] [--indent=nr] [--library=library_pattern] [--no-signals] [--output=filename] [--version] [--where=NR] [command [arg ...]]"

.SH DESCRIPTION
.B ltrace
is a program that simply runs the specified
.I command
until it exits.  It intercepts and records the dynamic library calls
which are called by the executed process and the signals which are
received by that process.
It can also intercept and print the system calls executed by the program.
.PP
Its use is very similar to
.BR strace(1) .

.SH OPTIONS
.TP
.I \-a, \-\-align column
Align return values in a specific
.IR column
(default column is 5/8 of screen width).
.TP
.I \-A maxelts
Maximum number of array elements to print before suppressing the rest with an ellipsis ("...")
.TP
.I \-b, \-\-no-signals
Disable printing of signals recieved by the traced process.
.TP
.I \-c
Count time and calls for each library call and report a summary on program exit.
.TP
.I \-C, \-\-demangle
Decode (demangle) low-level symbol names into user-level names.
Besides removing any initial underscore prefix used by the system,
this makes C++ function names readable.
.TP
.I \-D, \-\-debug level
Show debugging output of
.B ltrace
itself.
.I level
must be a sum of some of the following numbers:
.RS
.TP
.B 01
DEBUG_GENERAL.  Shows helpful progress information
.TP
.B 010
DEBUG_EVENT.  Shows every event received by a traced program
.TP
.B 020
DEBUG_PROCESS.  Shows every action
.B ltrace
carries upon a traced process
.TP
.B 040
DEBUG_FUNCTION.  Shows every entry to internal functions
.RE
.TP
.I \-e filter
A qualifying expression which modifies which library calls to trace.
The format of the filter expression is described in the section
\fBFILTER EXPRESSIONS\fR.  If more than one \-e option appears on the
command line, the library calls that match any of them are traced.  If
no \-e is given, \fB@MAIN\fR is assumed as a default.
.TP
.I \-f
Trace child processes as they are created by
currently traced processes as a result of the fork(2)
or clone(2) system calls.
The new process is attached immediately.
.TP
.I \-g
Do not place breakpoints on PLT entries. This option reduces
the output of ltrace. This is commonly used to avoid tracing
libc functions.
.TP
.I \-F
Load an alternate config file. Normally, /etc/ltrace.conf and
~/.ltrace.conf will be read (the latter only if it exists).
Use this option to load the given file or files instead of
those two default files.
.TP
.I \-h, \-\-help
Show a summary of the options to ltrace and exit.
.TP
.I \-i
Print the instruction pointer at the time of the library call.
.TP
.I \-l, \-\-library library_pattern
Display only the symbols implemented by libraries that match
.I library_pattern.
Multiple library patters can be specified with several instances of
this option.  Syntax of library_pattern is described in section
\fBFILTER EXPRESSIONS\fR.
.TP
.I \-L
When no -e option is given, don't assume the default action of
\fB@MAIN\fR.
.TP
.I \-n, \-\-indent nr
Indent trace output by
.I nr
number of spaces for each new nested call. Using this option makes
the program flow visualization easy to follow.
.TP
.I \-o, \-\-output filename
Write the trace output to the file
.I filename
rather than to stderr.
.TP
.I \-p pid
Attach to the process with the process ID
.I pid
and begin tracing.
.TP
.I \-r
Print a relative timestamp with each line of the trace.
This records the time difference between the beginning of
successive lines.
.TP
.I \-s strsize
Specify the maximum string size to print (the default is 32).
.TP
.I \-S
Display system calls as well as library calls
.TP
.I \-t
Prefix each line of the trace with the time of day.
.TP
.I \-tt
If given twice, the time printed will include the microseconds.
.TP
.I \-ttt
If given thrice, the time printed will include the microseconds and
the leading portion will be printed as the number of seconds since the
epoch.
.TP
.I \-T
Show  the  time  spent inside each call. This records the time difference
between the beginning and the end of each call.
.TP
.I \-u username
Run command with the userid, groupid and supplementary groups of
.IR username .
This option is only useful when running as root and enables the
correct execution of setuid and/or setgid binaries.
.TP
.I \-w, --where NR
Show backtrace of NR stack frames for each traced function. This option enabled
only if libunwind support was enabled at compile time.
.TP
.I \-x filter
A qualifying expression which modifies which symbol table entry points
to trace.  The format of the filter expression is described in the
section \fBFILTER EXPRESSIONS\fR.  If more than one \-x option appears
on the command line, the symbols that match any of them are traced.
No entry points are traced if no \-x is given.
.TP
.I \-V, \-\-version
Show the version number of ltrace and exit.

.SH FILTER EXPRESSIONS

Filter expression is a chain of glob- or regexp-based rules that are
used to pick symbols for tracing from libraries that the process uses.
Most of it is intuitive, so as an example, the following would trace
calls to malloc and free, except those done by libc:

-e malloc+free-@libc.so*

This reads: trace malloc and free, but don't trace anything that comes
from libc.  Semi-formally, the syntax of the above example looks
approximately like this:

{[+-][\fIsymbol_pattern\fR][@\fIlibrary_pattern\fR]}

\fISymbol_pattern\fR is used to match symbol names,
\fIlibrary_pattern\fR to match library SONAMEs.  Both are implicitly
globs, but can be regular expressions as well (see below).  The glob
syntax supports meta-characters \fB*\fR and \fB?\fR and character
classes, similarly to what basic bash globs support.  \fB^\fR and
\fB$\fR are recognized to mean, respectively, start and end of given
name.

Both \fIsymbol_pattern\fR and \fIlibrary_pattern\fR have to match the
whole name.  If you want to match only part of the name, surround it
with one or two *'s as appropriate.  The exception is if the pattern
is not mentioned at all, in which case it's as if the corresponding
pattern were \fB*\fR.  (So \fBmalloc\fR is really \fBmalloc@*\fR and
\fB@libc.*\fR is really \fB*@libc.*\fR.)

In libraries that don't have an explicit SONAME, basename is taken for
SONAME.  That holds for main binary as well: \fB/bin/echo\fR has an
implicit SONAME of \fBecho\fR.  In addition to that, special library
pattern \fBMAIN\fR always matches symbols in the main binary and never
a library with actual SONAME \fBMAIN\fR (use e.g. \fB^MAIN\fR or
\fB[M]AIN\fR for that).

If the symbol or library pattern is surrounded in slashes (/like
this/), then it is considered a regular expression instead.  As a
shorthand, instead of writing \fB/x/@/y/\fR, you can write
\fB/x@y/\fR.

If the library pattern starts with a slash, it is not a SONAME
expression, but a path expression, and is matched against the library
path name.

The first rule may lack a sign, in which case \fB+\fR is assumed.  If,
on the other hand, the first rule has a \fB-\fR sign, it is as if
there was another rule \fB@*\fR in front of it.

The above rules are used to construct the set of traced symbols.  Each
candidate symbol is passed through the chain of above rules.
Initially, the symbol is \fIunmarked\fR.  If it matches a \fB+\fR
rule, it becomes \fImarked\fR, if it matches a \fB-\fR rule, it
becomes \fIunmarked\fR again.  If, after applying all rules, the
symbol is \fImarked\fR, it will be traced.

.SH BUGS
It has most of the bugs stated in
.BR strace(1) .
.LP
Manual page and documentation are not very up-to-date.
.LP
Option -f sometimes fails to trace some children.
.LP
It only works on Linux and in a small subset of architectures.
.LP
.PP
If you would like to report a bug, send a message to the mailing list
(ltrace-devel@lists.alioth.debian.org), or use the
.BR reportbug(1)
program if you are under the Debian GNU/Linux distribution.

.SH FILES
.TP
.I /etc/ltrace.conf
System configuration file
.TP
.I ~/.ltrace.conf
Personal config file, overrides
.I /etc/ltrace.conf

.SH AUTHOR
Juan Cespedes <cespedes@debian.org>
.br
Petr Machata <pmachata@redhat.com>

.SH "SEE ALSO"
.BR ltrace.conf(5),
.BR strace(1) ,
.BR ptrace(2)