strace for macOS - trace system calls using Instruments
npm install mactracestrace for macOS - trace system calls of any process using Instruments.
```
$ mactrace ls
0.262 5.75 µs ls/52313 access(0x16b473548, 0) = 0
0.262 2.25 µs ls/52313 open(0x16b473548, O_RDONLY, 0) =
0.262 1.25 µs ls/52313 fstat64(
0.262 542 ns ls/52313 read(
0.262 250 ns ls/52313 close(
...
`bash`
bunx mactrace ls -la
Or install globally:
`bash`
bun install -g mactrace
`bashBasic usage - trace a command
mactrace ls -la
Output Format
`
TIMESTAMP DURATION PROCESS/PID SYSCALL(args...) = RESULT
`- Timestamps: seconds since trace start
- Duration: time spent in syscall
- File descriptors: shown as
- Flags: decoded (e.g., O_RDONLY|O_CLOEXEC, PROT_READ|PROT_WRITE)
- Errors: shown in red with errno (e.g., = -1 ENOENT no such file or directory)Examples
$3
`bash
mactrace -- node server.js
`$3
`bash
mactrace -o trace.log -- python script.py
`$3
`bash
mactrace ./myapp 2>&1 | grep open
`$3
`bash
mactrace -- ./hanging-program
See which syscall it's stuck on
`How It Works
mactrace uses macOS Instruments under the hood:
1. Runs
xcrun xctrace record --template "System Trace" to capture syscalls
2. Parses the .trace bundle's XML export
3. Formats output similar to Linux's strace/perf traceThis gives you syscall tracing without needing to disable SIP or use
dtrace directly.Requirements
- macOS (uses Instruments/xctrace)
- Bun runtime
- Xcode Command Line Tools (
xcode-select --install)Limitations
- No file paths in arguments: System Trace captures register values (pointers), not dereferenced strings. You'll see memory addresses instead of actual paths. For file paths, use
fs_usage or dtrace`.| Tool | Pros | Cons |
|------|------|------|
| mactrace | Easy to use, no SIP disable, colored output, flag decoding | No file path strings |
| dtruss | Shows file paths | Requires SIP disabled, dated |
| fs_usage | Real-time, shows paths | Limited to file operations |
| dtrace | Most powerful | Complex, requires SIP disabled |
| Instruments.app | GUI, comprehensive | Heavy, not scriptable |
MIT