System call trace

[Alexandru Juncu]

On Wed, Feb 15, 2012 at 4:38 PM, Swapnil Gaikwad
<swapnilgaik72 at gmail.com> wrote:
> Can we see trace of how the system call works?
> What are the functions are called in kernel space?
> For example we want to trace cp command. Then what are the functions
> is get called by that in kernel space? like how the inode allocation
> take place for new destination file etc.
> Is any tool for that?

I think strace [0][1] is what you are looking for. "strace executable"
will list all the system calls made by the executable during runtime
(you can filter what calls you want traced).

A syscall is by definition a "function" that is ran in kernel space,
called by the userspace.

If you want to see what function is called when there's a certain
syscall, you should take a look at the syscall descriptor table. It's
an array for function pointers. You can talke a look at the kernel'
source code to see the implementation of the syscall.

Now, to track what the kernel is doing, while in a syscall, I can't
remember a tool that would do that... maybe somebody else can help.

[0] http://linux.die.net/man/1/strace
[1] http://en.wikipedia.org/wiki/Strace

--
Alexandru Juncu
ROSEdu