The ltrace command can be used to intercept and record the dynamic calls made to shared libraries. The amount of output generated by the ltrace command can be overwhelming for some commands (especially if the -S option is used to also show system calls). You can focus the output to just the interaction between the program and some list of libraries. For example, to execute the id -Z command and show the calls made to the libselinux.so module, execute:
$ ltrace -l /lib/libselinux.so.1 id -Z
is_selinux_enabled(0xc1c7a0, 0x9f291e8, 0xc1affc, 0, -1)a
=1
getcon(0x804c2c8, 0xfee80ff4, 0x804b179, 0x804c020, 0)a
=0
user_u:system_r:unconfined_t
Remember that you can see what libraries a program is linked against using the ldd command.
If you encounter the below error while running the command ltrace:
ltrace: command not found
you may try installing the below package as per your choice of distribution:
| Distribution | Command |
|---|---|
| Debian | apt-get install ltrace |
| Ubuntu | apt-get install ltrace |
| Alpine | apk add ltrace |
| Arch Linux | pacman -S ltrace |
| Kali Linux | apt-get install ltrace |
| CentOS | yum install ltrace |
| Fedora | dnf install ltrace |
| Raspbian | apt-get install ltrace |
ltrace Command Examples
1. Print (trace) library calls of a program binary:
# ltrace ./program
2. Count library calls. Print a handy summary at the bottom:
# ltrace -c path/to/program
3. Trace calls to malloc and free, omit those done by libc:
# ltrace -e malloc+free-@libc.so* path/to/program
4. Write to file instead of terminal:
# ltrace -o file path/to/program