AW: Trying to understand why strace failed to attach to child

[Fiedler Roman]

> Von: Florian Kelbert [mailto:florian_kelbert at gmx.de]
> 
> On 20.05.2014 16:36, Fiedler Roman wrote:
> > Hello List,
> >
> > I'm using strace for quite a while, but today I got a quite unexpected
> > result. Since this was so confusing, I would be glad about feedback, if
the
> > cause for that could be a) human error in operation of strace, b)
> > misconception of the principles of syscall tracing, c) some strange
> > interaction between 32bit kernel/binary on single-core CPU:
> >
> > The output:
> >
> > # strace -s256 -f /usr/sbin/zabbix_server -c
/etc/zabbix/zabbix_server.conf
> > ....
> > setgroups32(1, [112])                   = 0
> > setuid32(109)                           = 0
> > setresgid32(-1, 112, -1)                = 0
> > setresuid32(-1, 109, -1)                = 0
> > clone(child_stack=0,
> flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD,
> > child_tidptr=0xb6340768) = 30111
> > exit_group(0)                           = ?
> > +++ exited with 0 +++
> >
> >
> > What was unexpected: strace failed to attach to the child. What is
special
> > about the traced process: due to an error, the child process performs
just
> > one open-syscall and exit after clone, the parent process performs an
exit
> > immediately after clone. Due to single-core CPU, it seems more likely,
that
> > the parent continues running after the fork before the child process
gets
> > any chance to do so.
> >
> > Question: Is my strace invocation syntax correct and should it capture
the
> > child system calls also? To my understanding, a tracee should be stopped
as
> > soon as strace is attached, also all children are stopped after clone.
So
> > there should be no way to miss any child?
> >
> > Kind regards,
> > Roman
> >
> >
> > PS: I'm using strace version:
> > ii  strace                              4.8-1ubuntu5
i386
> > A system call tracer
> >
> 
> It seems that the problem you describe has already been filed, discussed
> and fixed:
> https://www.mail-archive.com/strace-
> devel at lists.sourceforge.net/msg03273.html

Thanks for the pointer. The commit fixing that seems to be [1], but the
packages from Ubuntu seem to be too old to include that change (although LTS
was released 2014-04 and fix is from 2013-07-08).

I've created a bug-report at launchpad about that, see [2].

Kind regards,
Roman


[1]
http://sourceforge.net/p/strace/code/ci/d2e1f42d8a28486484f00739e561a58be480
8b03/
[2] https://bugs.launchpad.net/ubuntu/+source/strace/+bug/1321383
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6344 bytes
Desc: not available
URL: <http://lists.strace.io/pipermail/strace-devel/attachments/20140520/424a26b0/attachment.bin>