On 4/15/21 3:57 PM, Roger Heflin wrote: (also responding to Samuel)
Google drive probably. The first few lines should tell you what process it was starting.
I really usually only look at filesystem type calls as those are usually the most valuable for something like this. open, unlink (remove), stat (get info like ls shows), and say rename or renameat.
A lot of stats always fail as it is used to see if various things exist here or there.
Basic it loads an executable, lots of setup of that executable then toward the end is the real work the program does.
On a mv strace I get 117 lines with the executable and options at the top, a bunch of loading of libs and stuff for executable then 10 lines from the bottom is the actual rename, and the exit of the program.
bash.32[~]: grep 2636 caja.out > grep2636.txt bash.33[~]: grep open caja.out > grepopen.txt bash.34[~]: grep stat caja.out > grepstat.txt bash.35[~]: bash.35[~]: grep exec caja.out 2619 execve("/usr/bin/caja", ["/usr/bin/caja"], 0x7fff14191888 /* 69 vars */) = 0 2622 read(27, "2619 execve("/usr/bin/caja", [""..., 4096) = 4096 2636 execve("/usr/bin/totem-video-thumbnailer", ["/usr/bin/totem-video-thumbnailer", "-s", "128", "file:///home/bill/KhongWe"..., "/tmp/.mate_desktop_thumbnail.19V"...], 0x7ffdd556b338 /* 69 vars */ <unfinished ...> 2636 <... execve resumed>) = 0 2652 openat(AT_FDCWD, "/sys/fs/selinux/booleans/allow_execmem", O_RDONLY) = -1 ENOENT (No such file or directory) 2652 openat(AT_FDCWD, "/sys/fs/selinux/booleans/allow_execmem", O_RDONLY) = -1 ENOENT (No such file or directory) 2652 openat(AT_FDCWD, "/sys/fs/selinux/booleans/deny_execmem", O_RDONLY) = 31 bash.36[~]: bash.36[~]: grep unlink caja.out 2643 unlink("") = -1 ENOENT (No such file or directory) 2635 unlink("/tmp/.mate_desktop_thumbnail.19VW10") = 0 2635 unlink("/home/bill/.cache/thumbnails/fail/mate-thumbnail-factory/c39b432d203676f5e93a91a2d0d076d4.png.NVLR10") = -1 ENOENT (No such file or directory) bash.37[~]: bash.37[~]: grep remove caja.out 2636 stat("/usr/lib64/gstreamer-1.0/libgstremovesilence.so", {st_mode=S_IFREG|0755, st_size=28392, ...}) = 0 bash.38[~]: bash.38[~]: grep rename caja.out 2635 rename("/home/bill/KhongWeeHo.mkv", "/home/bill/KhongWeeHo_20160327.mkv" <unfinished ...> 2635 <... rename resumed>) = 0 2635 rename("/home/bill/.cache/thumbnails/fail/mate-thumbnail-factory/c39b432d203676f5e93a91a2d0d076d4.png.NVLR10", "/home/bill/.cache/thumbnails/fail/mate-thumbnail-factory/c39b432d203676f5e93a91a2d0d076d4.png") = 0 bash.39[~]:
The grep for the process ID "2636" found lines. The grep for "open" found 4665 lines. The grep for "stat" found 7449 lines.
The file caja.out is 148910 lines long.