TRUSS(1)

💅 TRUSS(1) — like, the trace system calls manual, bestie

okay so you know how a program does a million tiny things you can't see? truss is the nosy bestie who follows it around and writes down every single system call it makes. it's giving surveillance but make it ✨educational✨. this is truss(1), general commands manual, and it's gonna eat, i promise.

---

✨ NAME ✨

truss — trace system calls 🕵️‍♀️

---

🎀 SYNOPSIS 🎀

truss [-facedDHS] [-o file] [-s strsize] -p pid
truss [-facedDHS] [-o file] [-s strsize] command [args]

two whole ways to run it, pick your fighter 🫶

---

🌸 DESCRIPTION 🌸

The truss utility traces the system calls called by the specified process or program. Output goes to whatever output file you named, or to standard error if you didn't. How does it do this little magic trick? By stopping and restarting the process being monitored via ptrace(2). yes bestie, ptrace(2), the icon herself.

The options are as follows:

• -f — Trace descendants of the original traced process created by fork(2), vfork(2), etc. and to tell whose event is whose, the process ID (PID) of the process gets included in the output of each event. whole family tree, monitored 💖
• -a — Show the argument strings that are passed in each execve(2) system call. what did you say to it, huh
• -c — Do not display individual system calls or signals. Instead, before exiting, print a summary containing for each system call: the total system time used, the number of times the call was invoked, and the number of times the call returned with an error. receipts only, no play-by-play 💀
• -e — Show the environment strings that are passed in each execve(2) system call. the vibes it was raised in, essentially
• -d — Include timestamps in the output showing the time elapsed since the trace was started. clock starts at zero, go ✨
• -D — Include timestamps in the output showing the time elapsed since the last recorded event. delta time, very main character
• -H — Include the thread ID of in the output of each event. (yes that's exactly how the original says it, no cap, i'm not editing the queen)
• -S — Do not display information about signals received by the process. (Normally, truss displays signal as well as system call events.) so you're muting the signal gossip 🙈
• -o file — Print the output to the specified file instead of standard error. take it to a private chat instead of the group chat
• -s strsize — Display strings using at most strsize characters. If the buffer is larger, "..." will be displayed at the end of the string. The default strsize is 32. we truncate, we don't overshare 🔥
• -p pid — Follow the process specified by pid instead of a new command. lurking on someone already living their life
• command [args] — Execute command and trace the system calls of it. (The -p and command options are mutually exclusive.) you literally cannot do both, choose one, periodt

---

🦋 EXAMPLES 🦋

Follow the system calls used in echoing "hello":

$ truss /bin/echo hello

Do the same, but put the output into a file:

$ truss -o /tmp/truss.out /bin/echo hello

Follow an already-running process:

$ truss -p 34

that's it. that's the whole tutorial. go be nosy 💜

---

👑 SEE ALSO 👑

dtrace(1), kdump(1), ktrace(1), ptrace(2), utrace(2), sysdecode(3)

the whole friend group, honestly 🌈

---

⭐ HISTORY ⭐

The truss command was written by Sean Eric Fagan for FreeBSD. It was modeled after similar commands available for System V Release 4 and SunOS. a legend, an absolute icon, we stan 🫶

---

and that's the whole page bestie!! this one's from the Debian manual, dated June 18, 2025, TRUSS(1) — mwah 💋✨