My Workday

strace -q -f -c -p

strace -f verbose=all -e write=all -o /tmp/strace.log -p [pid]

strace -T -t -q -f -e trace=file,open,close,read -o /tmp/prod.strace.log -p <oms or ui pid>

-f traces all child processes as they are created byt he currently traced process as a result of the fork() system call.

-e is a qualifying expression which modifies which events to trace or how to race them

verbose=all dereferences structures for all system calls

write=all performs a full hexadecimal and ASCII dump of all the data written to all file descriptors

-o output file

-p process id to trace

Replace -p [pid] with [command] to trace a specific command.