--- title: Tracing user space and OS interactions | daily.dev description: A practical guide to tracing interactions between user-space applications and the Linux operating system using three tools: strace, ltrace, and GDB. strace... canonical: https://daily.dev/posts/tracing-user-space-and-os-interactions-mzr22ojnb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Tracing user space and OS interactions | daily.dev og:description: A practical guide to tracing interactions between user-space applications and the Linux operating system using three tools: strace, ltrace, and GDB. strace... og:url: https://daily.dev/posts/tracing-user-space-and-os-interactions-mzr22ojnb og:image: https://api.daily.dev/og/posts/MzR22oJNB.png og:image:alt: Tracing user space and OS interactions og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Tracing user space and OS interactions **[Collabora Blog](https://daily.dev/sources/collabora)** · 12 min read · 0 upvotes · 0 comments ## Summary A practical guide to tracing interactions between user-space applications and the Linux operating system using three tools: strace, ltrace, and GDB. strace traces system calls and signals between an application and the kernel using the ptrace interface, requiring no recompilation. ltrace operates at a higher stack level, tracing library calls instead of syscalls. GDB's 'catch syscall' and 'catch signal' commands offer an interactive alternative with the ability to inspect registers and data structures at syscall entry and exit. The post includes concrete command-line examples for each tool, covering attaching to live processes, filtering specific syscalls, and handling signals. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I trace system calls made by a running Linux process without recompiling it? strace can attach to a running process using its PID with the -p flag (e.g., strace -p2270), and the -e option filters for specific syscalls or groups. It uses the kernel's ptrace interface, so no recompilation or debug symbols are needed. Each output line shows the syscall name, its arguments, and the return value. _Linux developers debugging live processes find the latest strace tips and kernel tracing techniques on daily.dev._ ### What is the difference between strace and ltrace on Linux? strace traces system calls flowing from an application to the kernel and signals flowing back, while ltrace traces library calls made by the application to shared libraries like libc. Both use ptrace and require no recompilation. strace operates at the kernel-application boundary; ltrace operates one level higher, at the application-library boundary. _Developers choosing between Linux debugging tools track comparisons like this on daily.dev._ ### How do I use GDB to break on a specific syscall in Linux? GDB supports 'catch syscall ' since version 7.0, setting a breakpoint at both syscall entry and exit. You can also catch groups with 'catch syscall group:process' and handle signals with 'catch signal SIGUSR1'. No debug symbols are required, though they make inspection easier. Syscall numbers vary by architecture, so using names is safer. _Systems programmers getting deeper into GDB for kernel-level debugging keep up with new techniques on daily.dev._ ## Similar posts on daily.dev - [Medium](https://daily.dev/posts/medium-qywq6zdry) · Medium · 0 upvotes · 0 comments - [How a System Call Actually Works in Linux](https://daily.dev/posts/how-a-system-call-actually-works-in-linux-kj1mr4pdv) · freeCodeCamp · 1 upvotes · 0 comments - [Linux Fu: Taming Strace](https://daily.dev/posts/linux-fu-taming-strace-hv2fxuwcl) · Hackaday · 1 upvotes · 1 comments --- Tags: [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/tracing-user-space-and-os-interactions-mzr22ojnb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Tracing user space and OS interactions","url":"https://daily.dev/posts/tracing-user-space-and-os-interactions-mzr22ojnb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/tracing-user-space-and-os-interactions-mzr22ojnb"},"datePublished":"2026-08-11T08:57:04.694Z","dateModified":"2026-08-11T09:41:58.330Z","description":"A practical guide to tracing interactions between user-space applications and the Linux operating system using three tools: strace, ltrace, and GDB. strace...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/152af08a21ee7e7c59b641fbfb8b1fa7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/152af08a21ee7e7c59b641fbfb8b1fa7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collabora Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collabora Blog","logo":"https://media.daily.dev/image/upload/s--ZGZ0FjqS--/f_auto,q_auto/v1786438306/logos/collabora?_a=BAMAMicg0","url":"https://daily.dev/sources/collabora"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/tracing-user-space-and-os-interactions-mzr22ojnb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collabora Blog","item":"https://daily.dev/sources/collabora"},{"@type":"ListItem","position":3,"name":"Tracing user space and OS interactions"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/tracing-user-space-and-os-interactions-mzr22ojnb#faq","mainEntity":[{"@type":"Question","name":"How do I trace system calls made by a running Linux process without recompiling it?","acceptedAnswer":{"@type":"Answer","text":"strace can attach to a running process using its PID with the -p flag (e.g., strace -p2270), and the -e option filters for specific syscalls or groups. It uses the kernel's ptrace interface, so no recompilation or debug symbols are needed. Each output line shows the syscall name, its arguments, and the return value. Linux developers debugging live processes find the latest strace tips and kernel tracing techniques on daily.dev."}},{"@type":"Question","name":"What is the difference between strace and ltrace on Linux?","acceptedAnswer":{"@type":"Answer","text":"strace traces system calls flowing from an application to the kernel and signals flowing back, while ltrace traces library calls made by the application to shared libraries like libc. Both use ptrace and require no recompilation. strace operates at the kernel-application boundary; ltrace operates one level higher, at the application-library boundary. Developers choosing between Linux debugging tools track comparisons like this on daily.dev."}},{"@type":"Question","name":"How do I use GDB to break on a specific syscall in Linux?","acceptedAnswer":{"@type":"Answer","text":"GDB supports 'catch syscall ' since version 7.0, setting a breakpoint at both syscall entry and exit. You can also catch groups with 'catch syscall group:process' and handle signals with 'catch signal SIGUSR1'. No debug symbols are required, though they make inspection easier. Syscall numbers vary by architecture, so using names is safer. Systems programmers getting deeper into GDB for kernel-level debugging keep up with new techniques on daily.dev."}}]} ```