TRUSS(1)

NAME
truss - system call process tracer

SYNOPSIS
truss [-DHSacdefx] [-o OUTPUT] [-s #] [-p | command [arg ...]]

DESCRIPTION
truss enables syscall trace logging for the specified processes. Trace data is logged to the file OUTPUT, otherwise if not specified to stderr. The operations that are traced include system call entry and exit, exec(3), signal delivery, forking, vforking, LWP creation, LWP exiting and process exiting.

Once tracing is enabled on a process, trace data will be logged until either the process exits or the trace point is cleared. A traced process can generate large amounts of log data quickly.

truss supports two modes of execution:

counting
    Print summary of reported syscalls on truss termination.

events
    Register and report all of the supported events on the output.

The trace output is in plain text, human readable.

The options are as follows:

-D  Print relative timestamp, calculated since the previous event.

-H  Print LWP ID (thread id).

-S  Print information about signals.

-a  Print arguments passed to exec(3).

-c  Execute in the counting mode.

-e  Print environment variables passed to exec(3).

-d  Print absolute timestamp, calculated since the truss start.

-f  Track children newly spawned by the traced process.

-o OUTPUT
    Log trace records to outfile. Without this option truss will print its output to standard error.

-p PID
    Enable tracing on the indicated process id (only one -p flag is permitted).

-s #
    Set maximum length of a decoded string that is associated with a decoded syscall argument.

-x  Print AUX vector passed to exec(3).

command [args ...]
    Execute command with the specified trace flags.

The -p and command options are mutually exclusive.

The -c option changes the mode to counting and ignores unrelated arguments to truss.

IMPLEMENTATION NOTES
The tracer uses the ptrace(2) system call to perform the tracing process.

truss is a fork and extension of picotrace(1).

EXAMPLES
# trace the events of process id 34
    $ truss -p 34

# spawn and trace process sh(1) with all of its children and log the record to "trace.txt"
    $ truss -o trace.txt -i sh

SEE ALSO
coredumper(1), ktruss(1), picotrace, ptrace(2)

HISTORY
truss is a reimplementation of truss from FreeBSD for NetBSD.

Tn truss command was designed for NetBSD 9.

AUTHORS
Kamil Rytarowski <kamil@NetBSD.org>