extract syscall names from strace output

Question

I use the following command to extract syscall names from strace output:

strace ls 3>&1 1>&2 2>&3 3>&- | grep -P -o '^[az]*(?=\\()'

but this command also includes the ls output in the output. how can I prevent that?

Answer 1

There are two options to strace that will help you get what you want:

• -c will output a table of all system calls run by the command, together with the number of times they were called and CPU usage.

$ strace -c ls
Desktop  Documents  Downloads  Music  Pictures  Public  Templates  Videos
% time     seconds  usecs/call     calls    errors syscall
------ ----------- ----------- --------- --------- ----------------
 31.07    0.000653          20        32           mmap
  9.94    0.000209          20        10           mprotect
  9.80    0.000206          12        16           read
  8.28    0.000174          15        11           close
  7.61    0.000160          16        10           fstat
  6.90    0.000145          16         9           openat
  2.47    0.000052          17         3         3 ioctl
...

• The -o option will send strace's output to a file, so it won't get mixed in with your process's output.

The following will run the ls command, diverting its output to /dev/null , and will send strace's output to an awk script to extract the last column:

$ strace -o >(awk '$1 ~ /^-----/ { toprint = !toprint; next } { if (toprint) print $NF }') \
  -c ls >/dev/null 2>/dev/null

mmap
mprotect
read
close
fstat
openat
ioctl
...

Answer 2

Finally I found a solution with the help of this link: http://mywiki.wooledge.org/BashFAQ/047

strace ls 2>&1 >/dev/null | grep -P -o '^[az]*(?=\\()'

and a useful variant to count the syscalls:

strace ls 2>&1 >/dev/null | grep -P -o '^[az]*(?=\\()' | sort | uniq -c | sort -nr

And a better solution using Mark Plotnick 's answer:

strace -o >(grep -P -o '^[az]*(?=\\()' | sort | uniq -c | sort -nr) ls &>/dev/null