git: 3a7bb1e67c - main - Status/2026Q3/truss.adoc: Add report

The branch main has been updated by dteske:

URL: https://cgit.FreeBSD.org/doc/commit/?id=3a7bb1e67caf4510e7734b08a01826887acb2d92

commit 3a7bb1e67caf4510e7734b08a01826887acb2d92
Author:     Devin Teske <dteske@FreeBSD.org>
AuthorDate: 2026-10-12 19:15:17 +0000
Commit:     Devin Teske <dteske@FreeBSD.org>
CommitDate: 2026-10-12 19:15:17 +0000

    Status/2026Q3/truss.adoc: Add report
    
    Approved by:    salvadore
    Reviewed by:    salvadore
    Differential Revision:  https://reviews.freebsd.org/D59318
---
 .../en/status/report-2026-07-2026-09/truss.adoc    | 48 ++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/website/content/en/status/report-2026-07-2026-09/truss.adoc b/website/content/en/status/report-2026-07-2026-09/truss.adoc
new file mode 100644
index 0000000000..ef4979ada9
--- /dev/null
+++ b/website/content/en/status/report-2026-07-2026-09/truss.adoc
@@ -0,0 +1,48 @@
+=== Syscall filtering for truss(1)
+
+Links: +
+link:https://reviews.freebsd.org/D59275[D59275] URL: link:https://reviews.freebsd.org/D59275[] +
+link:https://cgit.freebsd.org/src/commit/?id=af25f24762307bf606690c0aca6a3205a0515914[rGaf25f2476230] URL: link:https://cgit.freebsd.org/src/commit/?id=af25f24762307bf606690c0aca6a3205a0515914[]
+
+Contact: Devin Teske <dteske@FreeBSD.org>
+
+man:truss[1] traces the system calls a process makes.
+Until this quarter it reported every call, which for anything larger than a toy program buries the calls of interest.
+
+HEAD now accepts `-t` with a comma-separated expression naming the system calls to report.
+The option letter is the one System V Release 4 and SunOS `truss` use for this.
+A term may be a system call name, an man:fnmatch[3] glob (`readlink*`), a system call number in the traced process's ABI, or `@group` for a family of related calls.
+A leading `!` excludes what that one term matches and applies to no other term -- unlike SVR4 `truss` and Linux `strace`, where `!` is sticky for the rest of the list.
+Terms apply in order; the last match wins.
+`truss -t` with no expression lists the groups and exits.
+
+Groups are themselves `-t` expressions, so they compose without a second language.
+`@desc` is built from `@read` and `@write` rather than repeating their members.
+Member lists are patterns (`extattr_*_file`, `sctp_*`) rather than frozen name lists, so a later system call that follows the same naming convention joins the right group without a source change here.
+
+Thirteen groups ship to start: `@all`, `@creds`, `@desc`, `@file`, `@ipc`, `@memory`, `@net`, `@none`, `@proc`, `@read`, `@signal`, `@time`, and `@write`.
+They are not a clone of Linux `strace`'s `%` classes: `@read` and `@write` split descriptor data-in from data-out, and `@time` covers clocks, timers, and sleeping rather than clocks alone.
+
+Show only the file and network activity of a command:
+
+  truss -t @file,@net fetch https://www.freebsd.org/
+
+Show everything a command does except its memory management:
+
+  truss -t '!@memory' make buildworld
+
+Show the descriptor activity of a running process apart from the data transfers themselves:
+
+  truss -t '@desc,!@read,!@write' -p 34
+
+Count the man:readlink[2] and man:readlinkat[2] calls made while starting a program:
+
+  truss -c -t 'readlink*' /bin/ls
+
+A system call excluded by `-t` is not decoded, so the filter also skips the cost of formatting arguments that would never be printed, and it is left out of the `-c` summary.
+Without `-t`, behaviour is unchanged.
+
+The work is in HEAD as of af25f2476230, with an MFC planned after two weeks.
+Thanks to Robert Clausecker for review, and to Alexander Ziaee for the man page pass.
+
+If a call you care about is in the wrong group, or a group you would use is missing, please write.