agis / gtrace

Experimental system call tracer for Linux x86-64, written in Go

gtrace

A system call tracer for Linux x86-64.

DISCLAIMER: This software is experimental and not considered stable. Do not use it in mission-critical environments.

Installation

$ go get -u github.com/agis/gtrace

Usage

Currently only attaching to an already running process is supported. Also, arguments are not decoded yet.

Attach to a process by specifying its pid:

$ ./gtrace -p 2602
Attached to process 2602...
futex = 0
write = 2
write = 1
futex = 0
write = 2
^C

Feature work

• Decode arguments
• terminal GUI with live statistics/counters
• filter for certain syscalls
• ARM support

Building

$ go generate
$ go build

gtrace's Issues

Decode arguments

Filter syscalls by name

Also update counters/table live in the terminal.

Colorize output

Based on the return values of each syscall. Red for failures etc.

Count occurences of each syscall

Decode syscall names

Convert to a tui

Use rivo/tview or something similar.