A tracer for execve{,at} and pre-exec behavior, with a TUI and debugger launcher capabilities.
tracexec is a tracer for execve and execveat system calls that captures pre-exec behavior and program execution details. It solves the problem of understanding how commands spawn processes, which is essential for debugging build systems, analyzing shell scripts, and reverse-engineering software execution flows.
System developers, DevOps engineers, and security researchers who need to debug process execution, analyze build pipelines, or understand the behavior of complex software.
Developers choose tracexec over alternatives like strace because it offers a cleaner, more focused output, interactive TUI, Perfetto integration for visualization, and specialized features like debugger launching and setuid tracing.
Tracer for execve{,at} and pre-exec behavior, launcher for debuggers.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Exports execution traces to Perfetto format for visualization in Perfetto UI, enabling process tree analysis and bottleneck identification, as shown in the build system example.
Provides a terminal user interface with pseudo-terminal support for real-time event viewing and interaction, demonstrated in the TUI demo with follow-forks and breakpoints.
Supports tracing setuid binaries with root access, including nested executions, useful for debugging privilege escalation issues like in the sudo ls and extra-x86_64-build examples.
Launches debuggers like GDB for programs executed by scripts, simplifying attachment to processes in complex execution flows, as illustrated in the gdb-launcher video.
eBPF mode is labeled experimental, requires kernel 5.17+, and may not capture all details due to technical limitations like filename and argv value retrieval issues, as noted in the known issues.
The README explicitly states that output is not stable and may change in future versions, posing a risk for scripts or automated tools relying on consistent format.
Non-UTF-8 strings are converted to UTF-8 in a lossy manner, which can lead to inaccurate representations of command-line arguments or environment variables, affecting debugging accuracy.
tracexec is an open-source alternative to the following products: