Trace file-related system calls from a running Linux process
Build a paste-ready command, then review its compatibility and effects before running it.
sudo strace -f -p <process-id> -e trace=%file -s 256Complete required fields to copy the generated command.
cautionrequires privileges Compatibility
Linux ptraceUse on a controlled diagnostic window because tracing a busy process adds overhead.
Operational knowledgereview due 2027-01-19
Requirementsstracestrace must be installed and available on PATH.Elevated accessReview the exact scope before using an elevated account.
Version supportstrace Current supported releasesVerified for linux using posix, bash, zsh syntax; consult compatibility notes for platform-specific differences.
Expected signalsstrace: Process 1842 attachedRepresentative successful output; values vary with the selected target and system state.
Known errorsstrace: command not foundstrace is missing or is not available on PATH.Permission deniedThe current identity does not have the required access.
Verifysudo strace -f -p {{pid}} -e trace=%file -s 256Re-run the corresponding read-only inspection and confirm the intended state.Rollback noteNo universal automatic rollback is available. Capture the current state and use the tool-specific recovery procedure before applying changes.
Command breakdown
01sudoPrivilege elevationRuns the following command with elevated privileges after authorization.
02straceCommandRuns the strace stage of this one-liner.
03-fOptionFollows child processes and threads created by the traced process.
04-pOptionAttaches strace to the process with the following PID.
05<process-id>ParameterA value supplied in the Fill parameters section.
06-eOptionApplies the following syscall trace or return-status filter expression.
07trace=%fileArgumentPasses trace=%file to strace.
08-sOptionCaptures up to the specified number of bytes from printed strings.
09256ArgumentPasses 256 to strace.
Example input
sudo strace -f -p 1842 -e trace=%file -s 256
Example output
strace: Process 1842 attached
[pid 1842] openat(AT_FDCWD, "/etc/app/config.yml", O_RDONLY|O_CLOEXEC) = 9
[pid 1842] newfstatat(AT_FDCWD, "/srv/app/cache", 0x7ffd…, 0) = -1 ENOENT (No such file or directory)
Illustrative output — exact values vary by system and data.
Official sources
Related commands