Advanced · Module 9 · Lesson 3 of 13
Dynamic System Call and Userspace Tracing: strace, ltrace, and kprobes
Trace runtime kernel and library boundaries using ptrace, diagnose blocking system calls with strace, inspect dynamic link calls with ltrace, and attach live kernel probes with kprobes.
By the end you can
- Trace process-kernel system call interactions and arguments using strace
- Inspect dynamic shared library calls and parameter payloads using ltrace
- Trace low-level breakpoint traps and register inspection via the ptrace system call
- Inject dynamic kernel probes and return hooks using Linux kprobes and tracefs
Builds on Hardware Performance Counters: PMU Profiling with Linux perf and Flame Graphs.
01 · A question first
Why does a running production service suddenly hang at 0% CPU with no log output, and how can you inspect every system call, file path, and kernel function argument it touches without restarting the process or attaching a heavy debugger?
Make a guess before you read on.
02 · The idea
Members only
Unlock the full lesson
This lesson is part of the membership. Join to read it in full, along with every other premium deep dive.
What's inside
- Start with the problem
- How the idea works
- Production Diagnostic Workflows with strace
- Production Implementation: Using kprobes via tracefs
- Complete Working C Program: Building a Custom ptrace Syscall Interceptor
- Why it is correct
- What it costs
- Pitfalls and variations
03 · Practice
Asked in interviews
Something wrong with this lesson? Report a problem