关键词: Linux系统调用, 启发式跟踪, 网络通信, 进程错误退出分析

Abstract: The existing Linux syscall tracing tools can’t effectively trace multi process applications that communicate with other processes through network. The tracing result’s context information is incomplete and lacks of graphical display. So a new tracing tool named heuristic-strace is designed based on the existing syscall tracing tool strace. It can automatically find and trace the processes that communicate through network. Moreover, it can display the tracing result in the form of process creation graph and network communication graph. Combined with the stack trace info, it can locate the process error exit reason. The experimental results show that this tool can trace typical GUI and network applications with lower performance overhead and ensure normal interact with the traced software.

Key words: Linux syscall, heuristic trace, network communication, process error exit analysis