Skip to content

docs: document the strace textual format - #7226

Open
Socialpranker wants to merge 1 commit into
google:mainfrom
Socialpranker:strace-docs
Open

docs: document the strace textual format#7226
Socialpranker wants to merge 1 commit into
google:mainfrom
Socialpranker:strace-docs

Conversation

@Socialpranker

Copy link
Copy Markdown
Contributor

Depends on #7224 — please land that first. This describes the strace
importer's behaviour after that fix; on current main a -T capture still
imports with zero-duration slices and the measured numbers below differ. Happy
to hold this until #7224 is in.


Perfetto has had an strace importer since the plugin landed, but the format is
not mentioned anywhere under docs/. A reader has no way to find out that an
strace log can be opened at all, and — more painfully — no way to find out
which strace flags produce a log that imports cleanly. Get either of -ttt or
-f wrong and the trace loads to an empty timeline, with the explanation
buried in the stats table.

This adds a section to the external-formats guide covering:

  • what the importer maps into — thread-track slices, the strace category,
    args/ret, -T durations, and blocked calls spanning their
    <unfinished ...>/<... resumed> pair;
  • the two flags that are not optional (-ttt, -f) and why each is required,
    each pointing at the stat that fires when it is missing;
  • the limitations worth stating up front — opaque argument strings, and the
    fact that a ptrace-based tool perturbs the timings it reports;
  • how to capture a log in the first place.

Two things in it are measured rather than asserted:

  • The example block is verbatim lines from an strace 6.13 capture, not
    hand-written — same method as the diff-test fixture in tp: fix the strace importer on real -f and -T output #7224.
  • The "use -o FILE, don't redirect stderr" advice comes from tracing
    sh -c 'ls /usr/bin >/dev/null; sleep 0.1' both ways: with -o, all 214
    syscalls import and none are dropped; over stderr, 140 import and 76 are
    dropped as strace_missing_pid, because strace leaves the process it
    started unprefixed until a second one is attached. For a program that never
    forks, the stderr capture imports nothing at all.

--syscall-times is documented with the version it appeared in (strace 5.6,
per the project's NEWS) rather than left for the reader to discover by
trying it.

Verified: tools/run_presubmit passes on this branch.

Comment thread docs/getting-started/other-formats.md Outdated
an explanation of what to change:

```sql
select name, value from stats where name like 'strace%' and value > 0

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

use glob and nit add a semicolon

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done: where name glob 'strace*' and value > 0;

Comment thread docs/getting-started/other-formats.md Outdated
Comment on lines +726 to +729
- You want to see *where* a process's wall-clock time goes inside the kernel:
which `read` blocked and for how long, how long a `futex` wait lasted, how
many `openat` calls a startup path makes — as a timeline rather than as
thousands of lines of text.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

would be nice to have a e.g. query for this.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added one right under that bullet — top system calls by time spent inside them:

select name, count(*) as calls, sum(dur) as total_dur
from slice
where category = 'strace'
group by name
order by total_dur desc
limit 10;

Checked it runs against a real strace capture.

Comment thread docs/getting-started/other-formats.md Outdated
a pid there is no thread to attribute a system call to, so such lines are
dropped; see the `strace_missing_pid` stat.
- **Limitations:**
- Syscall arguments are kept as the single opaque string strace printed.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: pls use either system call or syscall

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done — "system call" everywhere in prose now; --syscall-times stays as-is since that's the flag's actual name.

Comment thread docs/getting-started/other-formats.md Outdated
Comment on lines +808 to +810
`sh -c 'ls /usr/bin >/dev/null; sleep 0.1'` both ways, `-o` imports all 214
system calls and drops none, while the stderr capture imports 140 and drops
76. Tracing a program that never forks at all, the stderr capture imports

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pls remove these numbers 214 and 76 as those vary system to system.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed. Replaced with the part that doesn't depend on the machine: on a program that never forks, no second process is ever attached, so a stderr capture has no pid prefix on any line and imports nothing.

Perfetto has had an strace importer since the plugin landed, but the
format is not mentioned anywhere in docs/ — a reader has no way to learn
that an strace log can be opened at all, let alone which strace flags
produce a log that imports cleanly.

Add a section to the external-formats guide covering what the importer
maps into (thread-track slices, category, args/ret, durations, blocked
calls spanning their unfinished/resumed pair), the two flags that are
mandatory (-ttt and -f) and why, the limitations, and how to capture a
log in the first place.

The example lines are verbatim from an strace 6.13 capture rather than
hand-written, and the -o-versus-stderr advice is measured: tracing
`sh -c 'ls /usr/bin >/dev/null; sleep 0.1'` both ways, -o imports all
214 syscalls and drops none while the stderr capture imports 140 and
drops 76, because strace leaves the process it started unprefixed until
a second one is attached.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants