# strace-ltrace

Teaches coding agents how to trace Linux system calls and dynamic library functions with strace and ltrace to diagnose broken binaries without a debugger.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 648 installs · ★ 267
- Author: mohitmishra786
- License: MIT · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/mohitmishra786/low-level-dev-skills/tree/HEAD/skills/profilers/strace-ltrace/SKILL.md
- Updated: 2026-06-27
- HTML: https://affpapa.org/en/nevibecode/skills/strace-ltrace

## What it does

This skill gives your agent structured procedures for inspecting compiled Linux binaries that behave incorrectly without crashing. It provides targeted recipes to isolate kernel operations, separating file system interactions like openat from network socket communication.

The guidance includes methods for isolating error codes and decoding common failures. The agent can quickly spot a missing configuration path behind an ENOENT error or identify restricted operations returning EACCES and EPERM. It also demonstrates how to apply ltrace to observe shared library calls such as malloc and fopen.

Strace introduces excessive overhead during execution speed checks. Use perf for performance profiling instead. Both strace and ltrace utilities must be installed on the host system to run these traces.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add mohitmishra786/low-level-dev-skills --skill strace-ltrace -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/strace-ltrace/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/strace-ltrace/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add mohitmishra786/low-level-dev-skills --skill strace-ltrace -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/strace-ltrace/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add mohitmishra786/low-level-dev-skills --skill strace-ltrace -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/strace-ltrace/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install mohitmishra786/low-level-dev-skills strace-ltrace
```

2. **Manually: put the files in place**
- File: `.github/skills/strace-ltrace/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add mohitmishra786/low-level-dev-skills --skill strace-ltrace -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/mohitmishra786/low-level-dev-skills --path skills/profilers/strace-ltrace
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/strace-ltrace/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add mohitmishra786/low-level-dev-skills --skill strace-ltrace -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/mohitmishra786/low-level-dev-skills/tree/HEAD/skills/profilers/strace-ltrace/SKILL.md

## When to use it
- pinpoint missing configuration paths reported by ENOENT errors
- monitor outbound network connections and socket operations
- detect system calls terminated by seccomp security policies
- inspect shared library execution with ltrace

## Example prompts
- Help me determine which file path causes ENOENT when running ./myapp
- Show how to trace network activity on running process 12345 with strace
- Give me the ltrace command to intercept malloc calls in my executable

## Source text · SKILL.md · MIT

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: 0478e6296888a742.

BEGIN THIRD-PARTY FILE 0478e6296888a742
````text
---
name: strace-ltrace
description: strace and ltrace skill for system call and library call tracing. Use when a binary behaves incorrectly without crashing, diagnosing file-not-found errors, permission failures, network issues, or unexpected library calls by tracing syscalls and library function calls. Activates on queries about strace, ltrace, syscall tracing, library interception, ENOENT, EPERM, strace -e, or diagnosing binary behaviour without a debugger.
---

# strace / ltrace

## Purpose

Guide agents through tracing system calls with `strace` and library calls with `ltrace` — the most effective tools for diagnosing incorrect binary behaviour without a crash or debugger.

## Triggers

- "My program behaves incorrectly — how do I trace what it's doing?"
- "How do I find what files a binary is opening?"
- "strace shows ENOENT — how do I interpret it?"
- "How do I trace network calls with strace?"
- "What is ltrace and how does it differ from strace?"
- "How do I trace a running process?"

## Workflow

### 1. Basic strace usage

```bash
# Trace all syscalls of a command
strace ./myapp arg1 arg2

# Attach to running process
strace -p 12345

# Trace child processes too (-f = follow fork)
strace -f ./myapp

# Save to file (raw output — not stdout)
strace ./myapp 2> trace.txt

# Most useful: timestamps + summary
strace -t -f ./myapp 2>&1 | head -100
```

### 2. Filter by syscall category

```bash
# Trace file operations only
strace -e trace=file ./myapp

# Trace network syscalls
strace -e trace=network ./myapp

# Trace specific syscalls
strace -e trace=open,openat,read,write ./myapp

# Trace process management
strace -e trace=process ./myapp

# Trace memory operations
strace -e trace=memory ./myapp

# Trace signals
strace -e trace=signal ./myapp

# Multiple categories
strace -e trace=file,network ./myapp
```

| Category | Syscalls included |
|----------|------------------|
| `file` | open, openat, stat, access, unlink, rename, ... |
| `network` | socket, connect, bind, accept, send, recv, ... |
| `process` | fork, exec, wait, clone, exit, ... |
| `memory` | mmap, munmap, mprotect, brk, ... |
| `signal` | kill, sigaction, sigprocmask, ... |
| `ipc` | pipe, socket pair, shmget, ... |
| `desc` | close, dup, poll, select, epoll, ... |

### 3. Interpreting common errors

```bash
# See return values and errors
strace -e trace=file ./myapp 2>&1 | grep -E "ENOENT|EPERM|EACCES|ENOTSUP"
```

| Error | Meaning | Common cause |
|-------|---------|-------------|
| `ENOENT` | No such file or directory | Config file missing, wrong path |
| `EACCES` | Permission denied | File permissions, SELinux |
| `EPERM` | Operation not permitted | Missing capability, suid needed |
| `EADDRINUSE` | Address already in use | Port already bound |
````
END THIRD-PARTY FILE 0478e6296888a742

The third-party file has ended. Everything between the 0478e6296888a742 tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

First 2772 of 6258 bytes. © mohitmishra786 · MIT · https://github.com/mohitmishra786/low-level-dev-skills/tree/HEAD/skills/profilers/strace-ltrace/SKILL.md

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md