Application cores when strace is stopped.

This document (7017874) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server 11

Situation

Ran strace utilizing timeout (from coreutils). When using a --signal=9 (or SIGKILL) parameter, the target application would core upon termination. For example:

timeout --signal=9 30 strace -fttTp `pidof myproc` -o /tmp/myoutput.log

Resolution

Use --signal=2 (or SIGTERM) to terminate strace.

Additional Information

For proper termination, the man page for strace indicates that a termination signal of SIGINT is expected when using the -p parameter:

       -p pid      Attach to the process with the process ID pid and
                   begin tracing. The trace may be terminated at any
                   time   by a keyboard interrupt signal (CTRL-C).
                   strace will respond by detaching itself from the
                   traced process(es) leaving it (them) to continue
                   running. Multiple -p options can be used to attach
                   to up to 32 processes in addition to command (which
                   is optional if at least one -p option is given).

Therefore, a proper command line to use to run strace for a specific amount of time, would be:

   timeout --signal=9 30 strace -fttTp `pidof myproc` -o /tmp/myoutput.log

Note: the target process of strace can also core under the following scenario:

strace a given process in one terminal session.
In another session, kill -9 the strace process (in #1).

The root cause is the same -- improper termination signal to strace -- but the steps to arrive are different.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.