strace for Syscall Debugging

strace shows what a process is actually doing.

Attach

strace -p PID attaches to a running process.

strace -f follows forks.

Filter

strace -e trace=open,read shows just file IO.

strace -c summarises by syscall.

Careful

Slows the process. Don't leave running.

In production, prefer briefer attaches.