Linux 要附加到多线程进程的Stracing

如果我想扫射一个多线程进程（它的所有线程），我应该怎么做

我知道一个人可以用strace-f来遵循分叉过程？但是，当我开始扫描时，附加到一个已经是多线程的进程怎么样？是一种让strace跟踪属于此进程的所有线程的所有系统调用的方法吗？

2021更新

strace-fp-PID

在我的系统上做了正确的事情（Ubuntu 20.04.1 LTS）。

strace

手册页面指出：

       -f          Trace  child  processes  as  they are created by currently traced processes as a result of the fork(2), vfork(2) and clone(2) system
                   calls.  Note that -p PID -f will attach all threads of process PID if it is multi-threaded, not only thread with thread_id = PID.

看起来这段文字是。如果当时

-f

在我的系统上有这种行为，我没有意识到。不过现在是这样了

2013年原始答复 我只是以一种笨拙的方式做了这件事，列出了要跟踪的每个tid

您可以通过

ps

找到它们：

$ ps auxw -T | fgrep program_to_trace
me pid tid1 ...
me pid tid2 ...
me pid tid3 ...
me pid tid4 ...

然后，根据

man strace

，您可以一次连接到多个PID：

   -p pid      Attach to the process with the process ID pid and begin tracing.  The trace may be terminated at any time by a  keyboard  interrupt
               signal  (CTRL-C).  strace will respond by detaching itself from the traced process(es) leaving it (them) to continue running.  Mul‐
               tiple -p options can be used to attach to up to 32 processes in addition to command (which is optional if at least one -p option is
               given).

它说的是

pid

，但Linux上的iirc pid和tid共享同一名称空间，这似乎是可行的：

$ strace -f -p tid1 -p tid2 -p tid3 -p tid4

我想这可能是你目前能做的最好的了。但是我想有人可以用扩展TID的标志来扩展

strace

。在寻找流程和附加流程之间可能仍然存在一场竞赛，在这场竞赛中，新启动的流程将被错过。它符合关于

strace-f

的现有警告：

   -f          Trace child processes as they are created by currently traced processes as a result of the fork(2) system call.

               On non-Linux platforms the new process is attached to as soon as its pid is known (through the return value of fork(2) in the  par‐
               ent process). This means that such children may run uncontrolled for a while (especially in the case of a vfork(2)), until the par‐
               ent is scheduled again to complete its (v)fork(2) call.  On Linux the child is traced from its first instruction with no delay.  If
               the  parent  process  decides  to  wait(2)  for  a child that is currently being traced, it is suspended until an appropriate child
               process either terminates or incurs a signal that would cause it to terminate (as determined from the child's current signal dispo‐
               sition).

               On SunOS 4.x the tracing of vforks is accomplished with some dynamic linking trickery.

---

正如在多条注释中回答的那样，

strace-fp

将显示该进程拥有的所有线程的跟踪，即使是那些在

strace

开始之前已经生成的线程。

相同的

strace-f

就足够了（但我不知道如何防止以这种方式跟踪所有线程时跟踪子进程）。我可以确认

strace-fp

连接到所有现有线程。

-p

采用逗号分隔的列表，因此：

sudo strace-t-p$（ls/proc/$（pgrep PROGRAM_to_TRACE）/task-1 |粘贴-sd“，”-）

strace-fp-PID

应该将它们全部选中，您也可以将

pgrep

分隔符设置为逗号：

strace-p$（pgrep PROGRAMNAME-d，）