#strace #syscall #tracing #linux

nightly bin+lib hstrace

Syscall tracing from command line and as a library

5 releases

0.0.5 Apr 11, 2021
0.0.4 Apr 11, 2021
0.0.3 Feb 16, 2020
0.0.2 Feb 16, 2020
0.0.1 Feb 16, 2020

#232 in Debugging

41 downloads per month


3.5K SLoC

Syscall tracing CLI & library

Build Status Latest Version Rust Documentation License

Syscall tracing from command line and as a library. See the design draft: https://github.com/blaind/hstrace/blob/master/docs/01_hstrace_plan.md

This is a WIP implementation, and not production ready. Might not be finished. Multiple issues exist: 1) codebase is not ready to be expanded yet, major refactoring is needed especially for the AV and Value structs to be more generic, 2) attach to process is not instant, some calls are missed at beginning, 3) not all syscalls are implemented, 4) cross-platform support is missing, 5) as a comparison, strace codebase is over 200k LoC in total (incl comments), so finishing the work is quite an undertaking

Command line tool


Install the binary:

$ cargo install hstrace

Run the command

$ hstrace -h

hstrace for stracing processes

    hstrace [FLAGS] [OPTIONS] <prog>...

    -h, --help         Prints help information
        --no-follow    Do not follow child processes as they are created
    -V, --version      Prints version information

    -e <expr>           Expression
    -m <mode>           Run mode [default: strace]
    -o <file>           Save output to a file instead of stderr. If suffix is `.json`, will be stored in JSON-format
                        (format subject to change)
    -p <pid>            PID to trace
    -s <strsize>        Maximum length of printable strings [default: 32]

    <prog>...    Program to strace

Stracing library


Add this to your Cargo.toml:

hstrace = "0.0.4"

And this to your code:

use hstrace::prelude::*;

fn main() {
    let mut tracer = HStraceBuilder::new().program("ps").arg("uxaw").build();


    for syscall in tracer.iter_as_syscall() {
        match syscall.name {
            hstrace::Ident::Openat | hstrace::Ident::Fstat | hstrace::Ident::Stat => {
                println!("File operation detected: {:?}", syscall);

            hstrace::Ident::Socket | hstrace::Ident::Bind | hstrace::Ident::Connect => {
                println!("Network operation detected: {:?}", syscall);

            _ => (),

See examples/03_match_syscall_name.rs and other examples.


Licensed under either of Apache License, Version 2.0 or MIT license at your option.
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in this crate by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.


~158K SLoC