Hacker News new | ask | show | jobs
by Thaxll 1225 days ago
So it's like strace looking for brk()?
2 comments

strace is limited to system calls but this particular tool uses ptrace to trap symbolic references to mmap, malloc, calloc, etc. This provides better resolution because your allocator probably asks for large chunks of memory from the system and allocates from those instead of making each request one-for-one.
Sorry if this is a dumb question, but can't strace trace brk() calls?

And as kind of a follow up what is the easiest way to trace all allocations (brk() and mmap) but nothing else?

> can't strace trace brk() calls?

Absolutely.

> what is the easiest way to trace all allocations (brk() and mmap) but nothing else?

  strace -e mmap "$command"
I don't think anything modern still uses the program break but one should know brk and sbrk exist. To see deallocations, add munmap to the filter. Note that these represent operating system allocations: programs usually request huge chunks and then manage that memory in user space in order to avoid system call overhead. In many systems, this memory won't actually count as used unless the process actually touches it and causes page fault.
Fyi there is -e %memory alias in strace for all memory related syscalls