From 77a5a61f9615b558c9b7c25b8d5f0e31a5127935 Mon Sep 17 00:00:00 2001
From: Tyler Hawkins <thawkins@ruvos.com>
Date: Mon, 3 May 2021 11:24:24 -0400
Subject: [PATCH] add strace examples

---
 eg/examples/strace.md | 54 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)
 create mode 100644 eg/examples/strace.md

diff --git a/eg/examples/strace.md b/eg/examples/strace.md
new file mode 100644
index 0000000..5158f68
--- /dev/null
+++ b/eg/examples/strace.md
@@ -0,0 +1,54 @@
+# strace
+
+trace syscalls of a command and follow child pids
+
+    strace -f ls
+
+# Basic Usage
+
+Trace syscalls of a command:
+
+    strace <command>
+
+See the syscalls of an already-running process:
+
+    strace -p <pid>
+
+See only `network` type syscalls (and/or `file`,`stat`, `process`, or any specific syscall, comma separated)
+
+    strace -e trace=%network <command>
+
+See only system calls accessing <path>
+
+    strace -P <path> <command>
+
+Increase default preview string size to 256
+
+    strace -s 256 <command>
+
+Show timestamps
+
+    strace -t <command>
+
+Show time spent in syscalls
+
+    strace -T <command>
+
+Only show a summary of syscalls
+
+    strace --summary-only/-c
+
+# Attach to a running process to see time spent in calls
+
+    strace -f -s 256 -p <pid> -T
+
+    ~$ strace -f -s 256 -T echo "hi"
+    execve("/usr/bin/echo", ["echo", "hi"], 0x7fff519c2db8 /* 57 vars */) = 0 <0.003416>
+    brk(NULL)                               = 0x561667bc7000 <0.000013>
+    arch_prctl(0x3001 /* ARCH_??? */, 0x7ffd1ca4cec0) = -1 EINVAL (Invalid argument) <0.000012>
+    access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory) <0.000023>
+    openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3 <0.000046>
+    fstat(3, {st_mode=S_IFREG|0644, st_size=237628, ...}) = 0 <0.000015>
+    mmap(NULL, 237628, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f42a29f9000 <0.000017>
+    close(3)                                = 0 <0.000012>
+    [...]
\ No newline at end of file