35

I need to profile the performance of an application for which I am using strace. However, I do not really know how to interpret the various system calls the strace emits. Examples of a few of them are below:

(A) lseek(3, 1600, SEEK_SET)                = 1600
(B) write(3, "G_DATA    300        0          "..., 800) = 800
(C) close(3)                                = 0
(D) mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2b600b179000
(E) munmap(0x2b600b179000, 4096)            = 0
(F) fstat(3, {st_mode=S_IFREG|0644, st_size=1600, ...}) = 0

I would be grateful if someone could briefly explain in plain English what these lines from (A) to (F) really means in terms of I/O, data transferred, significance on performance etc.

I went through the man pages of strace but still am not very very confident. If you any other pointers for me to read, that would be great.

I have some background on Operating Systems and understand what system calls, memory, virtual memory, Scheduling, etc. are.

425nesp
  • 6,936
  • 9
  • 50
  • 61
Ketan Maheshwari
  • 2,002
  • 3
  • 25
  • 31
  • 3
    strace is more of debugging tool than a profiler. Are you really looking for something like gprof? – Duck Jun 13 '11 at 19:24
  • 1
    I agree. Since 'strace' will only show you system calls, the best you can do is see a large time gap between system calls and try to figure out what the program was doing in-between those calls that took so long. This is not a good way to profile. Instead, use 'callgrind' (part of 'valgrind') and analzye the results with 'kcachegrind'. Or use gprof, sysprof, oprofile, or the like. – David Schwartz Aug 14 '11 at 17:44
  • 1
    You should read the manpage of the system calls that's preformed here. run `man lseek` , `man open` , `man mmap` and so on. – nos Feb 23 '14 at 18:26

2 Answers2

30

In order to understand these, you have to get familiar with the POSIX system calls. They are the interface a user-space program uses to interact with the kernel.

lseek, write, close, mmap, munmap and fstat are all system calls and are documented in section 2 of the linux manual.

Briefly, lseek moves the internal pointer of the supplied file descriptor to the byte with position pointed to by the second argument, starting from SEEK_SET (the beginning), SEEK_CUR (current position) or SEEK_END (the end). Any consecutive read and write calls on the same descriptor will start their action from this position. Note that lseek is not implemented for all kinds of descriptors - it makes sense for a file on disk, but not for a socket or a pipe.

write copies the supplied buffer to kernelspace and returns the number of bytes actually written. Depending on the kind of the descriptor, the kernel may write the data to disk or send it through the network. This is generally a costly operation because it involves transferring this buffer to the kernel.

close closes the supplied descriptor and any associated resources with it in the kernel are freed. Note that each process has a limit on the number of simultaneously open descriptors, so it's sometimes necessary to close descriptors to not reach this limit.

mmap is a complex system call and is used for many purposes including shared memory. The general usage however is to allocate more memory for the process. The malloc and calloc library functions usually use it internally.

munmap frees the mmap'ped memory.

fstat returns various information that the filesystem keeps about a file - size, last modified, permissions, etc.

webwurst
  • 4,830
  • 3
  • 23
  • 32
Blagovest Buyukliev
  • 42,498
  • 14
  • 94
  • 130
3

For each command there is a manual page, you can read it by typing man and the name of C function, e.g. man lseek (also check apropos). They also have description of passed parameters.

Here are short summaries:

  • lseek - reposition read/write file offset of the file descriptor
  • write - write to a file descriptor from the buffer
  • close - delete a descriptor from the per-process object reference table
  • mmap - allocate memory, or map files or devices into memory
  • munmap - remove a mapping for the specified address range
  • fstat - get file status pointed to by path

Please note that interpreting single/random syscals won't be meaningful in terms performance. To test significance on performance of these syscalls, you should use -c parameter which can count time, calls, and errors for each syscall and report the summary. Then you can read more about these which are taking the longest time.

To learn more about output and strace parameters, check man strace.

See also: How to parse strace in shell into plain text?

Community
  • 1
  • 1
kenorb
  • 155,785
  • 88
  • 678
  • 743