I am writing a script that analyzes file access with strace.
The trace contains some calls that were interrupted by another process. straceshows them with <unfinished ...>and <... close resumed>(in case of interruption close).
[pid 26817] 12:48:22.972737 close(449 <unfinished ...>
[pid 28708] 12:48:22.972797 fcntl(451, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 26817] 12:48:22.972808 <... close resumed> ) = 0
The process and all its threads were tracked using
strace -f -tt -p <pid>
The manual page is not aware of the end of the call.
If a system call is being made, and yet another one is being called from another thread / process, strace will try to keep the order of these events and mark the current call as incomplete. When the call returns, it will be marked as resumed.
, , resumed , . , .
[pid 28708] 12:48:22.972797 fcntl(451, F_SETFD, FD_CLOEXEC <unfinished ...>
[pid 26817] 12:48:22.972808 close(449) = 0
[pid 26817] 12:48:22.972737 close(449) = 0
[pid 28708] 12:48:22.972797 fcntl(451, F_SETFD, FD_CLOEXEC <unfinished ...>
, unfinished resumed , - , .