Trying to understand why strace failed to attach to child

[Fiedler Roman]

Hello List,

I'm using strace for quite a while, but today I got a quite unexpected
result. Since this was so confusing, I would be glad about feedback, if the
cause for that could be a) human error in operation of strace, b)
misconception of the principles of syscall tracing, c) some strange
interaction between 32bit kernel/binary on single-core CPU:

The output:

# strace -s256 -f /usr/sbin/zabbix_server -c /etc/zabbix/zabbix_server.conf
....
setgroups32(1, [112])                   = 0
setuid32(109)                           = 0
setresgid32(-1, 112, -1)                = 0
setresuid32(-1, 109, -1)                = 0
clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD,
child_tidptr=0xb6340768) = 30111
exit_group(0)                           = ?
+++ exited with 0 +++


What was unexpected: strace failed to attach to the child. What is special
about the traced process: due to an error, the child process performs just
one open-syscall and exit after clone, the parent process performs an exit
immediately after clone. Due to single-core CPU, it seems more likely, that
the parent continues running after the fork before the child process gets
any chance to do so.

Question: Is my strace invocation syntax correct and should it capture the
child system calls also? To my understanding, a tracee should be stopped as
soon as strace is attached, also all children are stopped after clone. So
there should be no way to miss any child?

Kind regards,
Roman


PS: I'm using strace version:
ii  strace                              4.8-1ubuntu5                  i386
A system call tracer


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6344 bytes
Desc: not available
URL: <http://lists.strace.io/pipermail/strace-devel/attachments/20140520/2b032ede/attachment.bin>