96

I wanted to trace the system calls made by the find command to debug some performance issues however I could not figure out how to do this on Mac OS X Yosemite. How can I trace system calls for an arbitrary program similarly to what strace does on FreeBSD? I am especially interested in tracing file-system related calls.

Mateusz Piotrowski
  • 6,866
  • 9
  • 49
  • 75
Michaël Le Barbier
  • 5,645
  • 4
  • 27
  • 56
  • 2
    A quick search for *strace osx* gave me [this four year old blog post](https://opensourcehacker.com/2011/12/02/osx-strace-equivalent-dtruss-seeing-inside-applications-what-they-do-and-why-they-hang/). It should be easy to find other alternatives using the same search. – Some programmer dude Jun 25 '15 at 08:54
  • @JoachimPileborg Nice point. I went another way, starting with *apropos trace* and searching from that. I overlooked *dtruss* and *dtrace* because all outcomes I have found were about a trace utility for the *D* language. – Michaël Le Barbier Jun 25 '15 at 09:16
  • 1
    Just a note, FreeBSD ships with [truss(1)](https://www.freebsd.org/cgi/man.cgi?query=truss&manpath=FreeBSD+12.2-RELEASE+and+Ports), not strace. – Mateusz Piotrowski Dec 11 '20 at 14:18

2 Answers2

87

Under current versions of macOS, executables under paths covered by SIP (like /usr/bin) cannot be traced.

You can bypass this by making a copy of the executable in your home directory and tracing the copy:

cp /usr/bin/find find
codesign --remove-signature ./find
sudo dtruss ./find …

You needed to remove the code signature from the new find executable, otherwise SIP still notices that a system file is being accessed (credit: @Anmol Singh Jaggi).

Brian Peterson
  • 2,835
  • 5
  • 27
  • 33
80

You can use dtruss like in

sudo dtruss find ~/repo -depth 2 -type d -name '.git'

The manual page of that utility will help you to tailor the use of the tool to your needs.

Michaël Le Barbier
  • 5,645
  • 4
  • 27
  • 56
jspcal
  • 49,231
  • 7
  • 69
  • 74
  • 25
    dtruss did work then (June '15) but was broken by the System Integrity Protection regime of El Capitan. – Olsonist Feb 25 '17 at 22:09
  • 3
    @Olsonist Same issue with dtrace: `the current security restriction (rootless enabled) prevent dtrace from attaching to an executable not signed with the [com.apple.security.get-task-allow] entitlement` – Nakilon Oct 17 '17 at 02:52
  • 5
    It is possible to disable SIP https://developer.apple.com/library/content/documentation/Security/Conceptual/System_Integrity_Protection_Guide/ConfiguringSystemIntegrityProtection/ConfiguringSystemIntegrityProtection.html – mttrb Oct 17 '17 at 02:55
  • 2
    Also see https://stackoverflow.com/questions/33476432/is-there-a-workaround-for-dtrace-cannot-control-executables-signed-with-restri – mttrb Oct 17 '17 at 02:56
  • Adding a real example is helpful for testing, thanks. – Brian Peterson Dec 15 '21 at 20:01