What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
At LinuxCon Europe 2014, Harald König’s presentation Use “strace” to Understand Linux showed how to inspect a program’s system calls to discover what it tries to do: which files it opens, which child processes it starts, and where an operation fails. The talk is a useful historical introduction, not a current strace manual; check the documentation for the strace and Linux versions you use before relying on specific options.
What strace shows
strace observes system calls made by a process. A trace line typically records a call, its arguments, and its return value. That can reveal, for example, which configuration files a program tried to read, whether a file-open operation failed, or which process-related calls it made.
As an Amazon Associate I earn from qualifying purchases.
This is evidence of observed system-call activity, not a complete record of everything the program does. Work performed between system calls—including computation in user mode—is not represented as a sequence of calls.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Starting a trace or attaching to a process
König’s 2014 slides demonstrate two basic ways to begin: start a program under strace, or attach to a process that is already running. In the examples below, emacs is the program used in the talk; substitute the target program as appropriate.
strace emacsstarts the program under tracing.strace -p $(pgrep emacs)attaches to a process selected withpgrep. If more than one matching process exists, verify which process ID you intend to trace.
The exact command-line behavior and permissions depend on the installed strace and system configuration. Consult the local manual with man strace.
Filtering calls and saving output
An unrestricted trace can produce a large volume of output. König demonstrates filtering calls with -e and saving output with -o. For example, a file-operation filter can focus attention on file access when the question is which files a program reads or opens. Filter syntax and available call classes should be checked in the installed version’s manual.
Rank #2
- Used Book in Good Condition
Writing trace output to a file can make it easier to review after reproducing a problem. The presentation also warns that synchronous output and excessive tracing can affect the traced program, so collect only the detail needed to answer the question.
Following child processes
A program may launch other processes to do part of its work. Tracing only the initial process can therefore miss relevant activity in its children. The deck shows -f for following child processes and -ff for following them while writing separate output files per process. Confirm current behavior and output naming in your version’s manual.
Rank #3
Reading timing information
The presentation demonstrates timestamp options -t, -tt, and -ttt, relative timing with -r, and call-duration output with -T. These can help establish when calls occur and which calls take longer, but they do not turn a syscall trace into a complete runtime profile.
König specifically distinguishes time spent inside kernel calls from time spent in user mode between calls. A timestamp associated with syscall entry does not, by itself, say when that call returned. Interpret timing fields according to the installed strace documentation and the question being investigated.
Getting call statistics
The talk also shows -c and -C for call statistics. A summary can help identify which system calls account for a large share of observed call time or activity, while the full trace preserves individual arguments and return values. The slides are historical examples; use the local manual to verify the options’ current output and meaning.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesLimitations and operational cautions
Tracing can alter the behavior or timing of the process being observed. The 2014 deck flags ptrace restrictions, tracing SUID programs, publicly readable trace output, and deadlocks as concerns; Brendan Gregg’s separate LinuxCon Europe 2014 performance-tool material also cautions that ptrace-based tracing can impose significant overhead. These are warnings from conference material, not a current benchmark for every workload or system.
Best Value
- Trace only what is needed, and consider whether the observation itself could affect a timing-sensitive failure.
- Protect output files: traces can contain file paths, arguments, and other sensitive details, and the deck specifically warns about publicly readable output.
- Expect permission or ptrace-policy restrictions when attaching to a process. Do not assume that a privileged or SUID program can be traced normally.
- If tracing coincides with a hang or deadlock, treat that possibility as a diagnostic complication rather than assuming the trace is a neutral observer.
What the 2014 talk is—and is not
The presentation is a conference tutorial dated 14 October 2014, attributed to Bosch Sensortec. Its examples illustrate a durable diagnostic idea: system-call activity can expose file access, process creation, return errors, and timing around kernel calls. It should not be treated as documentation for current option semantics or as a modern comparison of tracing tools. The deck points readers to man strace, man gdb, man ptrace, and man ltrace; for practical use, begin with the manuals installed for the system being diagnosed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
