Watch open/read/write/close WIndows syscalls with strace ?

[Jon Turney]

On 02/11/2023 18:21, Roland Mainz via Cygwin wrote:
> 
> We're trying to debug mysterious sporadic I/O issues in Windows native
> git ('/cygdrive/c/Program Files/Git/cmd/git') started from Cygwin
> 3.5.0 mintty.exe ...
> ... which raises the question:
> 
> How can I watch the Windows syscalls for file open/read/write/close
> with Cygwin strace for a new process and all its process and thread
> children ?
> 
> I tried many combinations of --mask=xyz, -etc, but still do not see
> any I/O happening...

strace is not the tool for the job here.

As 'man strace' says: "The strace program executes a program [...] 
reporting any Cygwin DLL output from the program(s) to stdout"

(So strace just shows some general "debugging output" from inside the 
Cygwin DLL.  It perhaps should try to act a bit more like a real strace 
on UNIX, reporting all the emulated syscalls and their results, but that 
would require explicit annotation of all of those points inside the 
cygwin DLL.)

In any case, it isn't a tool for tracing native Windows programs. I 
suggest you use procmon, or some other similar native tool.