strace String Length: Set -s to Capture Full Strings (2026)

strace truncates strings by default, hiding crucial details in system call arguments.

This is the problem: strace is your best friend for debugging system calls, but by default, it’s like talking to someone who keeps cutting you off mid-sentence. When a system call involves strings – like reading a file path, writing to a socket, or even just printing a message – strace often shows you a truncated version. This can be incredibly frustrating when the missing part of the string is the exact piece of information you need to understand what went wrong.

Consider this scenario: your application is failing because it can’t find a configuration file. You run strace to see what file it’s trying to open.

strace -f -e trace=openat your_application

The output might look like this:

...
openat(AT_FDCWD, "/etc/myapp/conf/app.conf"..., O_RDONLY) = 3
...

See that ...? strace has deliberately cut off the string. You know it’s trying to open something in /etc/myapp/conf/, but you don’t know the full filename. Was it app.conf, app.conf.bak, or something else entirely? This ambiguity can lead you down the wrong debugging path.

The solution is simple, but easily overlooked: use the -s flag, followed by a number, to tell strace how many bytes you want it to display for strings. There’s no single magic number that works for every situation, but a good starting point is 4096 (4KB), which covers most common string lengths encountered in system calls.

To see the full string in the openat example above, you’d run:

strace -f -s 4096 -e trace=openat your_application

Now, the output would likely show the complete path:

...
openat(AT_FDCWD, "/etc/myapp/conf/app.conf", O_RDONLY) = 3
...

This gives you the exact filename strace is attempting to access.

Why does this happen? By default, strace limits string output to 32 bytes. This is a performance and readability optimization to prevent massive, unmanageable output when dealing with large data buffers, like those passed to read or write system calls. However, for arguments that are expected to be shorter, like filenames or command-line arguments, this default truncation can be a hindrance. The -s flag essentially increases this buffer size.

Common Causes and Fixes:

1. Truncated Filenames in open, openat, stat:

   • Diagnosis: You see openat(AT_FDCWD, "/path/to/some/dir/file_part_...".
   • Command: strace -f -s 4096 -e trace=open,openat,stat your_application
   • Fix: strace -f -s 4096 -e trace=open,openat,stat your_application
   • Why it works: Increases the buffer size for string arguments, revealing the full filename.

2. Incomplete Command-Line Arguments (execve):

   • Diagnosis: When an application launches another, strace might show only the beginning of the executable path or its arguments. You see execve("/usr/bin/python3", ["python3", "script.py", "--long-option=value_part_...".
   • Command: strace -f -s 4096 -e trace=execve your_application
   • Fix: strace -f -s 4096 -e trace=execve your_application
   • Why it works: Ensures the entire command line, including arguments, is displayed.

3. Partial Network Data (sendto, recvfrom):

   • Diagnosis: Debugging network issues, you see sendto(..., "GET /very/long/url/path?query=va...".
   • Command: strace -f -s 4096 -e trace=sendto,recvfrom your_application
   • Fix: strace -f -s 4096 -e trace=sendto,recvfrom your_application
   • Why it works: Allows you to see the full payload being sent or received, crucial for diagnosing malformed requests or responses.

4. Truncated Environment Variables (execve):

   • Diagnosis: An application is behaving unexpectedly due to its environment, but strace only shows part of an environment variable’s value: execve("/bin/bash", ["/bin/bash"], ["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "MY_VAR=some_value_part_...".
   • Command: strace -f -s 4096 -e trace=execve your_application
   • Fix: strace -f -s 4096 -e trace=execve your_application
   • Why it works: Reveals the complete value of environment variables passed to a new process.

5. Short Read/Write Buffers (Less Common but Possible):

   • Diagnosis: If you’re specifically debugging a scenario where read or write calls are expected to handle relatively short, fixed-size buffers (e.g., a custom protocol on a file descriptor), and strace truncates them.
   • Command: strace -f -s 1024 -e trace=read,write your_application (adjust -s to the expected buffer size).
   • Fix: strace -f -s 1024 -e trace=read,write your_application
   • Why it works: Tailors the string length to match the specific buffer size you’re interested in, preventing unnecessary truncation.

6. Symbolic Link Resolution (openat with O_NOFOLLOW):

   • Diagnosis: You’re trying to open a file, but it’s a symlink, and the target path is long. strace might truncate the target path shown by openat if it’s resolving it implicitly.
   • Command: strace -f -s 4096 -e trace=openat your_application
   • Fix: strace -f -s 4096 -e trace=openat your_application
   • Why it works: Ensures that even long symlink targets are fully displayed.

The next error you’ll likely encounter after fixing this is a permission denied error, which strace will now show you the full path for.