How to use ltrace?

  • library call tracer

  • executes the specified program until it ends
  • intercepts and records
    • dynamic library and system calls issued by the executed program
    • the signals received by the process
  • debugging tool for Linux
  • shows the calls user space applications make to shared libraries
  • hooks into the dynamic loading system
  • inserts shims

  • root privileges are not needed to run ltrace

Using ltrace is really simple. Run the following command to execute the program under test with ltrace:

ltrace ./program <parameters>

The next command attaces ltrace to an existing process using the PID (Process ID):

ltrace -p <PID>

Here is a sample output from ltrace executing the date tool:

$ ltrace date
strrchr("date", '/')                                                                         = nil
setlocale(LC_ALL, "")                                                                        = "C"
bindtextdomain("coreutils", "/usr/share/locale")                                             = "/usr/share/locale"
textdomain("coreutils")                                                                      = "coreutils"
__cxa_atexit(0x55a09ae6b440, 0, 0x55a09b080288, 0x736c6974756572)                            = 0
getopt_long(1, 0x7ffce7fd1f88, "d:f:I::r:Rs:u", 0x55a09b07f1a0, nil)                         = -1
nl_langinfo(0x2006c, 0x7ffce7fd1f88, 0, 0)                                                   = 0x7f921b1c6808
getenv("TZ")                                                                                 = nil
malloc(128)                                                                                  = 0x55a09beb9060
clock_gettime(0, 0x7ffce7fd1dc0, 0x55a09beb9060, 0x7f921b3feb00)                             = 0
tzset(0x7f921b1c6808, 0x59dc4457, 0x1a8d7131, 0x55a09beb9060)                                = 1
getenv("TZ")                                                                                 = nil
strcmp("", "UTC")                                                                            = -85
strlen("UTC")                                                                                = 3
memcpy(0x55a09beb9069, "UTC\0", 4)                                                           = 0x55a09beb9069
strftime(" Tue", 1024, " %a", 0x7ffce7fd1d10)                                                = 4
fwrite("Tue", 3, 1, 0x7f921b3ff600)                                                          = 1
fputc(' ', 0x7f921b3ff600)                                                                   = 32
strftime(" Oct", 1024, " %b", 0x7ffce7fd1d10)                                                = 4
...
fflush(0x7f921b3ff520)                                                                       = 0
fclose(0x7f921b3ff520)                                                                       = 0
+++ exited (status 0) +++

As you can see ltrace prints out calls to libraries. The first line, for example, is a call to strrchr() which is used to locate the first occurrence of a certain character in a string. The call is printed together with the parameters used to invoke it. strrchr() requires two parameters: a string and a character. In this case the string is date and the character to locate is the character call forward slash /. The return value is also printed by ltrace after the equal sign. Here ltrace prints nil which is essentially NULL. strrchr() returns NULL if the character does not appear in the string. This seems to be correct because there is no forward slash in the input string.