Linux Fu: Taming Strace | Hackaday

https://hackaday.com/2026/06/02/linux-fu-taming-strace/

Publish Date: 2026-06-02 13:00:00

While many operating systems seem to try to prevent you from peeking under the hood, Unix and Linux positively encourage it. One great tool that we’ve looked at before is strace. Using this tool, you can see details about every system call a program makes. As you might imagine, for any significant program, the output from strace can be huge.

While I’m not always a fan of GUIs, this is one of those cases where making the data easier to browse is a great idea. Enter strace-tui, a text-based GUI for strace from [Rodrigodd]. The program can parse output from strace or manage the strace execution itself, and either way, display the data in a useful way.

I started out looking at [janestreet’s] strace_ui, but the OCaml setup was throwing errors for me, so I just gave up. The strace-tui installs like many Rust programs, using cargo, and it went smoothly.

An Example

The strace-tui interface.

The only issue I had running the tool was that I don’t normally keep ~/.cargo/bin on my path. You can add it to your path, link the executable into your path, or solve that in any number of other ways.

As an example, I traced a symbolic link command (ln -sf nature.txt test.link). It is easy to pick out some essential information on the top line. The command took 112 system calls, 14 of them failed (which isn’t unexpected), there were no unfinished calls, no signals, and only a single PID.

The bottom shows things you can do. Arrows or j and k, along with the usual cursor control keys like Home and Page Down scroll through the list. The right and left arrows will expand or collapse items. That will show details about the call in question, including the arguments and return values. You can consult the help for all the details.

Useful Tools

The real power, though, lies in filtering out the noise and searching for specific things. If you are looking at something you don’t want to see, you can press a lowercase h to hide it, but note that it hides everything similar,…

Source