Diagnosis and the Modern Kernel

Use tracing to answer real questions: what is this process stuck on, why will this program not start, and why do some calls never show up. Ends with a forensics capstone on a mystery binary.

Labs in this module

Attach and Diagnose - Attach strace to a program that is already running, read what a hung process is blocked on, and use the summary to find where the time goes.
The Invisible System Calls - Find out why some calls never appear in strace, the difference between the call you write and the call the kernel sees, and the tool that sh
Syscall Forensics - A mystery program will not run. Using only tracing, find what it looks for, where it fails, and fix the box until it succeeds.