truss

truss is a command to trace system calls and signals

SYNOPSIS
truss [-fcaeildDE] [- [tTvx] [!] syscall ,...]
[- [sS] [!] signal ,...] [- [mM] [!] fault ,...]
[- [rw] [!] fd ,...]
[- [uU] [!] lib ,... : [:] [!] func ,...]
[-o outfile] command | -p pid[/lwps]...

DESCRIPTION
The truss utility executes the specified command and produces a trace ofthe system calls it performs, the signals it receives, and the machine faults it incurs. Each line of the trace output reports either the fault or signal name or the system call name with its arguments and return value(s).
System call arguments are displayed symbolically when possible using defines from relevant system headers. For any path name pointer argument, the pointed-to string is displayed.
Error returns are reported using the error code names described in intro(3). If, in the case of an error, the kernel reports a missing privilege, a privilege name as described in privileges(5) is reported in square brackets ([
]) after the error code name.
Optionally (see the -u option), truss also produce an entry/exit trace of user-level function calls executed by the traced process, indented to indicate nesting.

Why to know about truss?

In the day today admin job, you may want to see what a process is doing? or you may want to check an installation process. Or ur installation process is failing, you want check whats going on. You use truss in such conditions.

Some examples:

truss -p pid
gives you that specific pids systemcalls
$ truss -p 883
/14: lwp_cond_wait(0x0193BFF8, 0x0193BFE0, 0xD287F710, 0) Err#62 ETIME
/14: lwp_cond_broadcast(0x016BA688) = 0
/14: lwp_cond_broadcast(0x01299A98) = 0
/205: lwp_cond_wait(0x016BA688, 0x016BA670, 0xD187F748, 0) = 0
/205: lwp_cond_broadcast(0x0193BFF8) = 0
/14: lwp_cond_wait(0x0193BFF8, 0x0193BFE0, 0x00000000, 0) = 0
/205: lwp_mutex_wakeup(0x0193BFE0) = 0
/14: lwp_mutex_timedlock(0x0193BFE0, 0x00000000) = 0
/205: lwp_mutex_wakeup(0x000F8AD8) = 0
/14: lwp_mutex_timedlock(0x000F8AD8, 0x00000000) = 0
/14: lwp_cond_broadcast(0x000D2E80) = 0
/205: stat64("/software/IBM/WebSphere/AppServer/profiles/AppSrv01/installedApps/hornblowerNode01Cell/FRPApp.ear/FRPApp-WebModule.war/WEB-INF/classes/us/ny/state/oag/model/OrganizationDetail.class", 0xD187F628) = 0

883 is a WebSphere pid.

$ truss -o example.out -p 883
truss traces pid 883 and outputs to example.out

$truss -o example.out install.sh
install.sh is an installer of a software. truss traces the installation process's system calls and outputs to example.out