Abstract: The existing Linux syscall tracing tools can’t effectively trace multi process applications that communicate with other processes through network. The tracing result’s context information is incomplete and lacks of graphical display. So a new tracing tool named heuristic-strace is designed based on the existing syscall tracing tool strace. It can automatically find and trace the processes that communicate through network. Moreover, it can display the tracing result in the form of process creation graph and network communication graph. Combined with the stack trace info, it can locate the process error exit reason. The experimental results show that this tool can trace typical GUI and network applications with lower performance overhead and ensure normal interact with the traced software.

Key words: Linux syscall, heuristic trace, network communication, process error exit analysis

摘要： 现有的Linux系统调用跟踪工具存在跟踪上下文信息不全、无法高效地对通过网络通信的多进程应用程序进行跟踪以及跟踪结果缺少图形化展现的问题。通过扩展Linux系统调用跟踪工具strace，实现了启发式跟踪工具heuristic-strace，其能够实时发现和自动跟踪应用程序中通过网络通信的进程，形成进程创建关系图、进程网络通信关系图，并结合系统调用的栈回溯信息，定位进程的错误退出原因。实验结果表明，此工具对能对典型的GUI和网络应用软件进行跟踪，引入的性能开销比较低，并能保证被跟踪软件的正常交互。

关键词: Linux系统调用, 启发式跟踪, 网络通信, 进程错误退出分析