Understanding How strace Works: A Step‑by‑Step Implementation Using ptrace

This article explains the inner workings of the classic strace command by walking through a handcrafted implementation that uses ptrace to attach to a target process, capture its system calls, read the ORIG_RAX register, and print the syscall name, while also detailing the relevant kernel source code.

ptracestracesystem call tracing

0 likes · 15 min read

Understanding How strace Works: A Step‑by‑Step Implementation Using ptrace

OPPO Kernel Craftsman

Jan 8, 2021 · Operations

Understanding eBPF and Its Use on Android for System Call Counting

The article explains eBPF’s evolution from packet filtering to a C‑compiled, sandboxed kernel framework, describes its core concepts of bytecode, JIT, and maps, and walks through building, loading, and using an Android eBPF program that counts system calls per PID via tracepoint hooks.

AndroidBPFLinux kernel

0 likes · 9 min read

Understanding eBPF and Its Use on Android for System Call Counting

Efficient Ops

May 23, 2016 · Operations

Mastering strace: Diagnose Linux Process Issues with Real-World Examples

This article explains what strace is, how it works, and provides step‑by‑step examples—including fixing a failed service start, tracing nginx, diagnosing process crashes, shared‑memory errors, and performance analysis—to help operations engineers quickly locate and resolve Linux system problems.

DebuggingLinuxOperations

0 likes · 18 min read

Mastering strace: Diagnose Linux Process Issues with Real-World Examples