truss - trace system calls and signals.
The truss utility executes the specified command and pro-
duces a trace of the system calls it performs, the signals
it receives, and the machine faults it incurs. Each line of
the trace output reports either the fault or signal name or
the system call name with its arguments and return value(s).
System call arguments are displayed symbolically when possi-
ble using defines from relevant system headers. For any path
name pointer argument, the pointed-to string is displayed.
Error returns are reported using the error code names
described in Intro(3). If, in the case of an error, the ker-
nel reports a missing privilege, a privilege name as
described in privileges(5) is reported in square brackets ([
]) after the error code name.
To know more about System calls type man truss.
Suppose you want to track whats going my terminal window, if you want to do that then open a Terminal window then type
_______________________________
ensilage@ensilage$echo $$
768
ensilage@ensilage$_______________________________
Then again open another Terminal window then type truss -p 768
if you do some work in the previous Terminal then it will be trace back here ie in the second terminal.
______________________________________________________
ensilage@ensilage$truss -p 768
read(0, 0x08047130, 1) (sleeping...)
read(0, " l", 1) = 1
write(2, " l", 1) = 1
read(0, " s", 1) = 1
write(2, " s", 1) = 1
read(0, "\r", 1) = 1
write(2, "\n", 1) = 1
lwp_sigmask(SIG_SETMASK, 0x00000002, 0x00000000) = 0xFFBFFEFF [0x0000FFFF]
ioctl(0, TCSETSW, 0x0810EA08) = 0
lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF]
sigaction(SIGINT, 0x08047110, 0x08047170) = 0
sigaction(SIGTERM, 0x08047110, 0x08047170) = 0
sigaction(SIGQUIT, 0x08047110, 0x08047170) = 0
sigaction(SIGALRM, 0x08047110, 0x08047170) = 0
sigaction(SIGTSTP, 0x08047110, 0x08047170) = 0
sigaction(SIGTTOU, 0x08047110, 0x08047170) = 0
sigaction(SIGTTIN, 0x08047110, 0x08047170) = 0
sigaction(SIGWINCH, 0x08047110, 0x08047170) = 0
sigaction(SIGINT, 0x08047104, 0x08047180) = 0
time() = 1238806919
lwp_sigmask(SIG_SETMASK, 0x00020002, 0x00000000) = 0xFFBFFEFF [0x0000FFFF]
lwp_sigmask(SIG_SETMASK, 0x00020002, 0x00000000) = 0xFFBFFEFF [0x0000FFFF]
lwp_sigmask(SIG_SETMASK, 0x00020002, 0x00000000) = 0xFFBFFEFF [0x0000FFFF]
[Output Truncated]
_______________________________________________________________________________
You can refer the image also.
