ltrace Command Examples in Linux

The ltrace command can be used to intercept and record the dynamic calls made to shared libraries. The amount of output generated by the ltrace command can be overwhelming for some commands (especially if the -S option is used to also show system calls). You can focus the output to just the interaction between the program and some list of libraries. For example, to execute the id -Z command and show the calls made to the libselinux.so module, execute:

$ ltrace -l /lib/libselinux.so.1 id -Z
is_selinux_enabled(0xc1c7a0, 0x9f291e8, 0xc1affc, 0, -1)a
       =1 
getcon(0x804c2c8, 0xfee80ff4, 0x804b179, 0x804c020, 0)a
       =0
user_u:system_r:unconfined_t

Remember that you can see what libraries a program is linked against using the ldd command.

ltrace Command Examples

1. Print (trace) library calls of a program binary:

# ltrace ./program

2. Count library calls. Print a handy summary at the bottom:

# ltrace -c path/to/program

3. Trace calls to malloc and free, omit those done by libc:

# ltrace -e malloc+free-@libc.so* path/to/program

4. Write to file instead of terminal:

# ltrace -o file path/to/program