Question

I am trying to debug a C++ application which invokes many command line applications such as grep, etc through a the system() system call. I need to see all the commands the application is executing through the system() call.

I tried to view these commands by enabling history and view the .history file. But these commands are not executed through a terminal. The history file has only the commands executed interactively.

Any idea how this can be done?

Answer 1

To trace every command executed by “yourProgram”:

truss -s!all -daDf -t exec yourProgram

eg:

$ truss -s!all -daDf -t exec sh -c "/bin/echo hello world;/bin/date" 
Base time stamp:  1282164973.7245  [ Wed Aug 18 22:56:13 CEST 2010 ]
5664:    0.0000  0.0000 execve("/usr/bin/i86/ksh93", 0x080471DC, 0x080471EC)  argc = 3
5664:    argv: sh -c /bin/echo hello world;/bin/date
5665:    0.0106  0.0106 execve("/bin/echo", 0x08067484, 0x080674F8)  argc = 3
5665:    argv: /bin/echo hello world
hello world
5664:    0.0126  0.0126 execve("/bin/date", 0x080674E0, 0x080674F8)  argc = 1
5664:    argv: /bin/date
Wed Aug 18 22:56:13 CEST 2010

If you want to correlate these execs to system() calls, you can use that command:

truss -t execve -f -u 'libc:system' yourProgram

eg:

$ cat a.c
main()
{
system("echo a b c");
system("pwd");
}

$ truss -t execve -f -u 'libc:system' ./a
20073:  execve("a", 0x08047240, 0x08047248)  argc = 1
20073/1@1:  -> libc:system(0x8050a5c, 0x0)
20074/1:    execve("/bin/sh", 0x080471BC, 0x08047248)  argc = 3
a b c
20073/1@1:  <- libc:system() = 0
20073/1@1:  -> libc:system(0x8050a68, 0x0)
20076/1:    execve("/bin/sh", 0x080471BC, 0x08047248)  argc = 3
/tmp
20073/1@1:  <- libc:system() = 0

Finally, if you are using Solaris 10 or newer, you can use Dtrace for this task like this:

dtrace -Z -q -c yourProgram -n ' pid$target:libc:system:entry { printf("system(\"%s\")\n", copyinstr(arg0)); } '

which will give that output with the same “a” code:

a b c
/tmp
system("echo a b c")
system("pwd")

PS: By the way system() isn’t a system call but a standard library function.