Stracing附加到一个多线程的过程

Question

如果我想跨过一个多线程的进程（其所有线程），我应该怎么做？

我知道你可以做strace -f跟随分叉过程吗？但是，当我开始进行stracing时，如何连接已经是多线程的进程呢？是否可以告诉strace跟踪属于此进程的所有线程的所有系统调用？

Answer 1

我只是通过列举每个要跟踪的tid来做到这一点。

您可以通过ps找到他们：

$ ps auxw -T | fgrep program_to_trace 
me pid tid1 ... 
me pid tid2 ... 
me pid tid3 ... 
me pid tid4 ... 

，然后，根据man strace，你可以同时连接到多个的PID：

-p pid  Attach to the process with the process ID pid and begin tracing. The trace may be terminated at any time by a keyboard interrupt 
       signal (CTRL-C). strace will respond by detaching itself from the traced process(es) leaving it (them) to continue running. Mul‐ 
       tiple -p options can be used to attach to up to 32 processes in addition to command (which is optional if at least one -p option is 
       given). 

它说pid，但在Linux上IIRC pid和tid共享相同的命名空间，并且这似乎工作：

$ strace -f -p tid1 -p tid2 -p tid3 -p tid4 

我认为这可能是你现在可以做的最好的。但我想有人可以扩大strace与一个标志扩大潮汐。在找到流程并附加到他们之间可能还会有一场竞赛，其中一个新开始的流程将被错过。它会适合与现有的警告有关strace -f：

-f   Trace child processes as they are created by currently traced processes as a result of the fork(2) system call. 

       On non-Linux platforms the new process is attached to as soon as its pid is known (through the return value of fork(2) in the par‐ 
       ent process). This means that such children may run uncontrolled for a while (especially in the case of a vfork(2)), until the par‐ 
       ent is scheduled again to complete its (v)fork(2) call. On Linux the child is traced from its first instruction with no delay. If 
       the parent process decides to wait(2) for a child that is currently being traced, it is suspended until an appropriate child 
       process either terminates or incurs a signal that would cause it to terminate (as determined from the child's current signal dispo‐ 
       sition). 

       On SunOS 4.x the tracing of vforks is accomplished with some dynamic linking trickery. 

Answer 2

可作为多发性评论回答，strace -fp <pid>将显示该进程所拥有的所有线程的痕迹 - 即使是进程已经催生strace开始前的。