Attach strace to a running process with `-p`

When a program hangs or hits a mysterious error, `strace -p PID` shows the exact syscalls it makes right now — the debugging tool people know but whose flags they forget.

LinuxstracedebuggingperformancesyscallsMedium risk

Run `sudo strace -p 1234` to attach to PID 1234 and watch its system calls live; detach with Ctrl+C without killing the process.

01Command

Command

$ sudo strace -p 1234 -e trace=openat,read,write

02What it does

Unfiltered output scrolls too fast, so combine `-p` with `-e trace=file` (all file-related calls), `-e trace=network` (sockets), or a comma list of names. The forgotten analysis flag is `-c`: `strace -c -p 1234` runs for a while and then prints a count-and-time table per syscall, which is how you find out a process is hammering stat() thousands of times. Add `-f` if the process spawns threads or children, and `-s 200` to stop long strings from being truncated.

03Risk

RiskMedium risk

RequirementsRequires strace (apt install strace / dnf install strace) and ptrace permission (root or same-UID process; kernel.yama.ptrace_scope may apply)

!Warning: The traced process runs much slower while attached — avoid strace on latency-critical production processes.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

strace(1) — trace system calls and signals
man7.org · technical · 2026-09-17
Evidence: Documents -p PID attach mode, -e trace= filter expressions, -c summary counting, and -f for following forks

Last verified: 2026-09-17 · Category: Developer

06Related solutions

Snapshot System Health with vmstat

Linuxvmstatmonitoringperformance

vmstat gives a compact one-line-per-interval view of CPU usage, swap activity, and I/O waits that top doesn't summarize as clearly.

Low risk ✓ 2026-09-17