Strace Ltrace

When your binary misbehaves but doesn't crash, strace and ltrace show you exactly what it's doing under the hood. This skill walks you through tracing syscalls to find missing config files, permission errors, or network issues, and using ltrace to catch library calls when you can't attach a debugger. The filtering examples are solid: trace just file operations, decode ENOENT errors to see which path failed, or use strace -c to profile where time gets spent. Especially helpful for diagnosing dynamic linking failures and seccomp policy kills. The comparison table between strace and ltrace is a nice touch for knowing which tool fits your problem.

skills.sh installs: 711
GitHub stars: 279
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add mohitmishra786/low-level-dev-skills --skill strace-ltrace --agent claude-code

Installs into .claude/skills of the current project.

Files

strace / ltrace

Purpose

Guide agents through tracing system calls with strace and library calls with ltrace — the most effective tools for diagnosing incorrect binary behaviour without a crash or debugger.

Triggers

"My program behaves incorrectly — how do I trace what it's doing?"
"How do I find what files a binary is opening?"
"strace shows ENOENT — how do I interpret it?"
"How do I trace network calls with strace?"
"What is ltrace and how does it differ from strace?"
"How do I trace a running process?"

Workflow

1. Basic strace usage

# Trace all syscalls of a command
strace ./myapp arg1 arg2

# Attach to running process
strace -p 12345

# Trace child processes too (-f = follow fork)
strace -f ./myapp

# Save to file (raw output — not stdout)
strace ./myapp 2> trace.txt

# Most useful: timestamps + summary
strace -t -f ./myapp 2>&1 | head -100

2. Filter by syscall category

# Trace file operations only
strace -e trace=file ./myapp

# Trace network syscalls
strace -e trace=network ./myapp

# Trace specific syscalls
strace -e trace=open,openat,read,write ./myapp

SKILL.md on GitHub