0

So, I decided to start learn about system call with strace and want to observe network-related system call on apache2 processes, here's how I attach it:

pidof -s apache2
pstree -sTp <pid-from-pidof>
strace -f -e trace=%network -p <parent-pid-from-pstree>

and while observing, I notice that strace print some syscall, however I can't find the associated recvfrom or sendto syscall with file descriptor that correspond to the accept syscall in which contain the ip address of client (my browser) when I make a http request

my assumption is that when a request is handled by apache, it spawn new processes as a child process, and since I attach the strace to the parent apache2 process, why the strace not follow its child despite I specify -f option?

Improve this question
4
  • Are you sure Apache is using sendto and recvfrom and not write and read? Commented Feb 12 at 21:21
  • after looking for write and read syscall from the parent process, indeed I saw some of it, but I don't see the HTTP data like GET request and the header when I attempt to make a GET request Commented Feb 13 at 3:43
  • however my ip address is printed on accept syscall, maybe the recv/send or read/write is handled on different program? I've tried to check on php-fpm process but still no luck Commented Feb 13 at 3:55
  • The accept call returns the file descriptor of the socket. If you see read/write to that file descriptor, then those would be the ones of interest. Do you see something like that? Commented Feb 14 at 14:59

0

Reset to default

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.