Strace, how to see the fork syscall?

Question

On old SystemV Unix using the "truss" program(is similar to strace)

truss script.sh
.....

fork()                                          = 382
      6 
    Received signal #18, SIGCLD, in waitsys() [default]
      siginfo: SIGCLD CLD_EXITED pid=382 uid=0 status=0x0000

.....

In the long output I can see the fork() syscall. I want to see the same thing(or similar) on Linux using strace.

I have tried

strace -e fork sh script.sh

and

strace -f sh script.sh

and

strace -f -e fork sh script.sh

But I cannot see the fork(). Linux and Old SystemV are of course different OS, and probably Unix use fork() in a different way from Linux, but the question is: how to see the fork() output using strace? Of course script.sh contain the same command "ls|wc -l" in both systems, I use it only for test.

What's in `script.sh`? Perhaps it's something that the shell can execute without needing to fork. Or are you talking about the fork needed to create the `sh` process in the first place? — Nate Eldredge, May 10 '20 at 22:31
Oh, now I see what you're asking. Look for the `clone` system call in the output. On modern Linux kernels, the `fork()` libc function is implemented using the more general `clone(2)` system call. — Nate Eldredge, May 11 '20 at 01:01

score 3 · Accepted Answer · answered May 11 '20 at 01:09

Current versions of Linux provide a system call named clone(2) (see https://linux.die.net/man/2/clone and scroll down to the description of sys_clone), which is a general system call for creating new tasks. There are options to determine exactly what resources the new task should share with its parent (memory, file descriptors, etc), so that the system call can be used to create new processes or new threads or anything in between. Although the kernel still provides a fork system call for backward compatibility, current versions of glibc implement fork() in terms of clone(2) instead.

Thus, even though you may see a call to fork() in the source code of sh, the output of strace will show a clone system call. So you should look for that instead of fork.

Strace, how to see the fork syscall?

1 Answers1