Equivalent of strace -feopen < command > on mac os X

Question

This is useful for debugging (hence programming related). On linux, we can use the command

strace -feopen python myfile.py

to figure out which python modules and shared objects are loaded. Is there an equivalent one-liner on macOS X?

Exceed

Answer 1

I suppose you meant strace -fetrace=open?

dtruss -f -t open python myfile.py

Stuckey

Hi ephemient, I just tested your version of strace (with -fetrace=open) and it gave exactly the same outuput as my example. I look forward to testing your dtruss command shortly. Thanks for the quick response! – Exceed

Somehow, today, sudo dtruss doesn't work for me. It's as if Python is not executed at all! – Odel

@qarma sudo-ing back again might solve your problem: serverfault.com/questions/215510/… – Tricolor

btw., some open calls are reported as open_nocancel on osx. same wrt. read and read_nocancel. – Odel

btw., some open calls are reported as open_nocancel on osx. same wrt. read recv close and perhaps a bunch/all others, they seems to have *_nocancel counterparts. – Odel

dtruss requires root privileges, but you might not want to run the command you want traced as root. Consider sudo dtruss -f -t open sudo -u $USER python myfile.py – Ayrshire

The link to dtruss in your answer is broken. – Dicky

@Dicky Apparently Apple moved their manpages to /legacy/ now. – Stuckey

Getting an error with $ sudo dtruss -f -t open sudo -u $USER python: ` dtrace: system integrity protection is on, some features will not be available` and then dtrace: failed to execute sudo: dtrace cannot control executables signed with restricted entitlements – Jinajingle

The only way to run dtruss as an strace/ltrace replacement on macOS (since roughly 2018) is to disable SIP through csrutil disable in recovery mode. It's unfortunate, especially if one only needs it for a quick session to see which files are opened by process or similar query tasks. – Malleolus