See Everything Beneath the Surface

Every system call your process makes to the kernel — open(), read(), write(), mmap(), fork(), socket(), and hundreds more. Arguments are decoded symbolically, structures are dereferenced, flags are broken down into their bitwise components. Signals received by the process are also captured.

Yes — tracing introduces overhead because every syscall must cross through ptrace. However, the --seccomp-bpf option dramatically reduces overhead by using the kernel's seccomp facility to filter at the kernel level, only stopping for syscalls you actually want to trace.

You need appropriate permissions. Root can trace any process. For non-root users, ptrace scope settings (/proc/sys/kernel/yama/ptrace_scope) may restrict attachment to child processes only. Substrate can be installed setuid for controlled environments.

The -c flag suppresses normal output and instead prints a statistical summary when the process exits: percentage of time, total time, average time, call count, and error count for each system call. It's perfect for identifying which syscalls are causing performance bottlenecks.

The --inject option lets you inject errors (error=ENOENT), return values (retval=0), signals (signal=SIGSEGV), and delays (delay_enter=100ms) into specific system calls. You can target specific invocations with when=3+ to only affect the 3rd and subsequent calls.

-D runs strace as a grandchild of the tracee (reduces visibility). -DD also puts strace in a separate process group (survives kill signals). -DDD runs in a completely separate session — true daemonisation for production tracing.