strace — some recipes

It's possible to use Bash's slightly fancy process substitution feature to make some of the basic filtering of strace be slightly more intuitive.

# list all .so libraries that are loaded when a Perl script runs
strace -e trace=open,openat -o >( grep '\.so' | grep -v ENOENT ) -- ./script_under_test.pl

In this case, the two different types of output (the script's normal STDOUT, and the filtered output after the grep -v ENOENT) get combined together. However, each of these could be sent to /dev/null or redirected elsewhere, in a somewhat intuitive manner:

strace -e trace=open,openat -o >( grep '\.so' | grep -v ENOENT ) -- ./script_under_test.pl >/dev/null
# or
strace -e trace=open,openat -o >( grep '\.so' | grep -v ENOENT >/tmp/so_files.txt ) -- ./script_under_test.pl
# why not both?!
strace -e trace=open,openat -o >( grep '\.so' | grep -v ENOENT >/tmp/so_files.txt ) -- ./script_under_test.pl >/dev/null

specific recipes

List all files that got opened (that were opened successfully; ignore the failed attempts).

strace -e trace=open,openat -o >( grep -v ENOENT ) -- ./tool_under_test

List the exec's of all children that got fork+exec'ed. (and the children's children, etc)

strace -f -s99999 -e trace=execve -- ./tool_under_test