LTRACE(1) | General Commands Manual | LTRACE(1)

# NAME

`ltrace` — shared library function call tracer

# SYNOPSIS

`ltrace` | [`-ai`] [`-f` trfile] [`-t` trstr] [`-u` trspec] command

# DESCRIPTION

`ltrace` enables shared library function calls issued by the specified processes to be traced using the utrace(2) user tracing facility. By default, call trace data is logged to the file ktrace.out, unless overridden by the `-f` option. Each function call is traced as a pair of `KTRFAC_USER` entries; the first entry contains the shared library containing the symbol being called, and the second entry contains the symbol name.

Once tracing is enabled on a process, trace data will be logged until either the process exits or the trace point is cleared with ktrace(1). A traced process can generate enormous amounts of log data quickly; it is strongly suggested that users memorize how to disable tracing before attempting to trace a process. The following command is sufficient to disable tracing on all user owned processes and, if executed by root, all processes:

`$ ktrace -C`

The trace file is not human-readable; use kdump(1) to decode it.

The options are as follows:

`-a`
  Append to the trace file instead of recreating it.
`-f` trfile
  Log trace records to trfile instead of ktrace.out.
`-i`
  Inherit; pass the trace flags to all future children of the designated processes.
`-t` trstr
  The string argument represents the kernel trace points, one per letter. The default is just `u`. The following table equates the letters with the trace points:

  `c`
    trace system calls
  `i`
    trace I/O
  `n`
    trace namei translations
  `p`
    trace violation of pledge(2) restrictions
  `s`
    trace signal processing
  `t`
    trace various structures
  `u`
    trace user data coming from utrace(2)
  `x`
    trace argument vector in execve(2)
  `X`
    trace environment in execve(2)
  `+`
    trace the default points
`-u` trspec
  Restrict the trace to a list of shared objects and/or function names, as specified by the trspec argument. The trace specification is a comma-separated list of library names, followed by a colon (:), and a comma-separated list of function names. Each list can be empty. Each list member may end with a star (*) to only match the beginning of a name. An exclamation mark at the beginning of a list turns it into a rejection list, causing all unmatched names to be traced. Library names are compared without their version number and ‘.so’ suffix.
command
  Execute command with the specified trace flags.

# FILES

ktrace.out
  Default `ltrace` dump file.

# EXAMPLES

Trace all shared library function calls from wc(1) reading the message of the day:

`$ ltrace wc -lh /etc/motd`

Trace only the shared library function calls in libutil.so:

`$ ltrace -u libutil wc -lh /etc/motd`

Trace all the shared library function calls but those in libc.so:

`$ ltrace -u "!libc" wc -lh /etc/motd`

Trace all the shared library function calls with names starting "fmt":

`$ ltrace -u ":fmt*" wc -lh /etc/motd`

Trace all shared library function calls, as well as all system calls:

`$ ltrace -t cu wc -lh /etc/motd`

# SEE ALSO

kdump(1), ktrace(1), ktrace(2), utrace(2)

# HISTORY

The `ltrace` command appeared in OpenBSD 5.4.

September 30, 2023 | Debian