strace -q -f -c -p strace -f verbose=all -e write=all -o /tmp/strace.log -p [pid] strace -T -t -q -f -e trace=file,open,close,read -o /tmp/prod.strace.log -p <oms or ui pid> -f traces all child processes as they are created byt he currently traced process as a result of the fork() system call. -e is a qualifying expression which modifies which events to trace or how to race them verbose=all dereferences structures for all system calls write=all performs a full hexadecimal and ASCII dump of all the data written to all file descriptors -o output file -p process id to trace Replace -p [pid] with [command] to trace a specific command.