Debugging Tool Strace

strace

← Debugging Tools and Commands

strace is the quickest Linux check for a thread whose long interval may be inside a syscall. It timestamps calls and reports each call's elapsed duration, making futex, polling, sleep, device ioctl, and file-I/O waits visible.

Property	Details
Supported OS	Linux.
Install	Distribution package strace; SteamOS 3.8.16 includes /usr/bin/strace.
Verify	strace --version and a short controlled trace.
Primary output	Timestamped text log or aggregate syscall summary.

When to use it

Use strace after thread identification and before adding xemu logging when the suspected interval could be:

• futex/condition/mutex waiting;
• poll, ppoll, or epoll_wait;
• clock_nanosleep;
• a graphics-driver ioctl;
• file/cache/configuration I/O;
• a failed or repeatedly retried syscall.

It cannot see CPU work between syscalls and does not decode the internal meaning of a Vulkan driver request.

Target one xemu thread

pgrep -n -x xemu
ps -L -p 12345 -o pid,tid,psr,pcpu,stat,wchan:32,comm

sudo timeout --signal=INT 10s \
  strace \
  -ttT \
  -p 12346 \
  -e trace=futex,poll,ppoll,epoll_wait,ioctl,clock_nanosleep \
  -o strace-thread.log

Replace 12345 with the xemu PID and 12346 with the selected thread's TID.

Important fields:

• -tt records wall-clock timestamps with microseconds;
• -T appends elapsed time inside each syscall;
• -p TID attaches to the selected thread;
• -e trace=... limits overhead and output;
• -o keeps raw output instead of relying on a terminal screenshot.

If the selected user owns xemu and ptrace policy permits attachment, sudo may not be needed. Record whether elevation was used.

Aggregate view

When call frequency matters more than event order:

sudo timeout --signal=INT 10s \
  strace \
  -c \
  -p 12346 \
  -e trace=futex,poll,ppoll,epoll_wait,ioctl,clock_nanosleep \
  -o strace-summary.txt

The aggregate summary reports calls, errors, and time attributed inside the selected syscalls. It loses individual timing/order, so retain an event trace when correlating with a frame hitch.

Interpret common results

futex(...)          <0.013482>
ioctl(...)          <0.017931>
ppoll(...)          <0.019421>

These mean the traced thread remained inside that syscall for the shown elapsed time. They do not by themselves establish:

• which other thread or GPU operation satisfied the wait;
• whether the wait was expected pacing;
• whether shortening the syscall itself is possible;
• whether the interval overlapped the guest-visible hitch.

Continue with perf sched or BCC/Perfetto for waker and scheduler attribution. For a long graphics ioctl, inspect Vulkan submission/fence state and GPU evidence before calling it a driver stall.

Attach and cleanup safety

• Use a bounded timeout and verify strace detached.
• Do not use -f unless child/thread coverage is required; it can greatly increase perturbation and log volume.
• Avoid dumping buffers, paths, or network payloads unless necessary; logs can contain private data.
• Preserve the exit status and attach errors. An empty log caused by denied ptrace is not a clean result.
• Do not kill xemu merely to stop the tracer.

Steam Deck notes

The checked SteamOS 3.8.16 appliance included strace 6.15. No system modification is needed for the basic workflow. Attachment may still require sudo depending on ownership and ptrace policy.

Because strace stops the target briefly at syscall entry/exit, it can change timing in a syscall-heavy thread. Use a narrow filter, reproduce the dependency more than once, and perform final acceptance without it.

Evidence to retain

• strace --version, kernel version, privilege state, and ptrace errors;
• executable hash and selected PID/TID/name;
• exact syscall filter, capture interval, and workload anchor;
• raw event log and optional aggregate summary;
• comparison with scheduler or guest-progress evidence.

Official references

• strace project
• strace manual

Related xemu guides

• Linux perf
• BCC and eBPF
• Perfetto
• Steam Deck and Linux Thread Diagnosis