Ltrace Explained

ltrace is a debugging utility in Linux, used to display the calls a userspace application makes to shared libraries. It does this by hooking into the dynamic loading system, allowing it to insert shims which display the parameters which the applications uses when making the call, and the return value which the library call reports. ltrace can also trace Linux system calls. Because it uses the dynamic library hooking mechanism, ltrace cannot trace calls to libraries which are statically linked directly to the target binary. Since 0.7.3, ltrace can also trace calls to libraries which are loaded using dlopen.

Example output

The following is the first few lines of an invocation of . It shows ltrace displaying calls to a variety of libraries, including the C standard library (malloc, strlen), POSIX libraries (getuid), X Toolkit Intrinsics (XtOpenApplication), and the X11 inter-client communication library (IceAddConnectionWatch). A call's return value is shown after the = symbol.[pid 11783] __libc_start_main(0x407420, 1, 0x7fff75b6aad8, 0x443cc0, 0x443d50 [pid 11783] geteuid = 1000[pid 11783] getegid = 1000[pid 11783] getuid = 1000[pid 11783] getgid = 1000[pid 11783] setuid(1000) = 0[pid 11783] malloc(91) = 0x00cf8010[pid 11783] XtSetLanguageProc(0, 0, 0, 0x7f968c9a3740, 1) = 0x7f968bc16220[pid 11783] ioctl(0, 21505, 0x7fff75b6a960) = 0[pid 11783] XtSetErrorHandler(0x42bbb0, 0x44f99c, 0x669f80, 146, 0x7fff75b6a72c) = 0[pid 11783] XtOpenApplication(0x670260, 0x44f99c, 0x669f80, 146, 0x7fff75b6a72c) = 0xd219a0[pid 11783] IceAddConnectionWatch(0x42adc0, 0, 0, 0x7f968c9a3748, 0 [pid 11783] IceConnectionNumber(0xd17ec0, 0, 1, 0xcfb138, 0xd17c00) = 4[pid 11783] <... IceAddConnectionWatch resumed>) = 1[pid 11783] XtSetErrorHandler(0, 0, 1, 0xcfb138, 0xd17c00) = 0[pid 11783] XtGetApplicationResources(0xd219a0, 0x6701c0, 0x66b220, 34, 0) = 0[pid 11783] strlen("off") = 3

See also

• strace – system call tracer for linux
• ktrace – system call tracer for *BSD
• truss – classic system call tracer
• DTrace – Solaris / OS X / BSD / Windows kernel tracing tool
• SystemTap – Linux kernel tracing tool

External links

• • • Rodrigo Rubira Branco, Ltrace Internals, Ottawa Linux Symposium 2007
• latrace, a dynamic library call tracer which operates using the LD_AUDIT libc feature