Here, I am tracing an xterm running bash to do pwd and to close window:
$ (
truss -faelo /tmp/bash.tr xterm -e bash -i &
sleep 1
tail +0f /tmp/bash.tr
)
[1] 17913
NOTE: /usr/bin/X11/xterm: losing setuid/setgid privileges when tracing
17925/29482: execve(0x7b0f5bf0, 0x7b0f54c0, 0x7b0f54d4) [entry]
argv[0] @ 0x7b0f0020: "xterm"
argv[1] @ 0x7b0f0026: "-e"
argv[2] @ 0x7b0f0029: "bash"
argv[3] @ 0x7b0f002e: "-i"
.
.
.
18907/640: write(2, "$ ", 2) = 2
18906/637: select(7, 0x4000de90, 0x4000de8c, NULL, NULL) = 1
18907/640: sigprocmask(SIG_SETMASK, 0x4001a640, NULL) = 0
18906/637: read(6, "$ ", 4096) = 2
18907/640: sigsetstatemask(0x17, NULL, 1073852280) = 0
18906/637: read(6, 0x4000fb80, 4096) = 0
18906/637: write(5, "L 01\00502\0\01502\0\010\011\01 ".., 60) = 60
18906/637: select(7, 0x4000de90, 0x4000de8c, NULL, NULL) [sleeping]
18906/637: select(7, 0x4000de90, 0x4000de8c, NULL, NULL) = 1
18906/637: ioctl(5, FIONREAD, 0x7b0f5ce0) = 0
18906/637: read(5, "\b04\0{ j 85! I \0\0\0& 02\0\00e".., 32) = 32
18906/637: select(7, 0x4000de90, 0x4000de8c, NULL, NULL) = 1
18906/637: ioctl(5, FIONREAD, 0x7b0f5ce0) = 0
18906/637: read(5, "\n03\0{ 02\0\00e0186a2| ffffffff".., 32) = 32
18906/637: write(5, "L 01\00502\0\01502\0\010\0# \01 ".., 52) = 52
18906/637: select(7, 0x4000de90, 0x4000de8c, NULL, NULL) = 1
18906/637: ioctl(5, FIONREAD, 0x7b0f5ce0) = 0
18906/637: read(5, "\n03\0{ 02\0\00e030 \ra8j 85! a1".., 32) = 32
18906/637: write(5, "L 01\00502\0\01502\0\010\0# \01 ".., 52) = 52
18906/637: select(7, 0x4000de90, 0x4000de8c, NULL, NULL) = 1
18906/637: ioctl(5, FIONREAD, 0x7b0f5ce0) = 0
18906/637: read(5, "\t03\07f02\0\00e03a e6@ U U U U ".., 32) = 32
18906/637: write(5, "L 01\00502\0\01502\0\013\0# \01 ".., 20) = 20
18906/637: select(7, 0x4000de90, 0x4000de8c, NULL, NULL) = 1
18906/637: ioctl(5, FIONREAD, 0x7b0f5ce0) = 0
18906/637: read(5, "\t03\07f02\0\00e02a e6@ U U U U ".., 32) = 32
18906/637: write(5, "L 01\00502\0\01502\0\013\0# \01 ".., 20) = 20
18906/637: select(7, 0x4000de90, 0x4000de8c, NULL, NULL) = 1
18906/637: ioctl(5, FIONREAD, 0x7b0f5ce0) = 0
18906/637: read(5, "a1 \08002\0\00e\0\0\0x \0\0\0y ".., 32) = 32
18906/637: writev(5, 0x7b0f6008, 3) = 16
18906/637: read(5, "01\0\082\0\0\0\0\0\0019f\0\t' bc".., 32) = 32
18906/637: writev(5, 0x7b0f6008, 3) = 24
18906/637: read(5, "01\0\083\0\0\0\0\0\001a0\0\t' bb".., 32) = 32
18906/637: writev(5, 0x7b0f6008, 3) = 24
18906/637: read(5, "01\0\084\0\0\0\0\0\001a1\0\t' bb".., 32) = 32
18906/637: writev(5, 0x7b0f6008, 2) = 24
18906/637: read(5, "01\0\085\0\0\0\0\0\001a2\0\t' bb".., 32) = 32
18907/640: Received signal 1, SIGHUP, in read(), [caught], no siginfo
18906/637: kill(-18907, SIGHUP) = 0
18907/640: read(0, 0x7b0f673c, 1) = 0
18907/640: stat64("/dhome1/n/myid/.sh_history", 0x7b0f6e38) = 0
18907/640: open("/dhome1/n/myid/.sh_history", O_WRONLY|O_APPEND|O_LARGEFILE, 0600) = 6
18907/640: write(6, "p w d \n", 4) = 4
18907/640: close(6) = 0
18907/640: open("/dhome1/n/myid/.sh_history", O_RDONLY|O_LARGEFILE, 0666) = 6
18907/640: fstat64(6, 0x7b0f6ef0) = 0
18907/640: sigprocmask(SIG_BLOCK, 0x7b0f70ac, 0x7b0f70cc) = 0
18907/640: brk(0x40266000) = 0
18907/640: sigprocmask(SIG_SETMASK, 0x7b0f70cc, NULL) = 0
18907/640: read(6, "0101r e = ' ( < n a m e > ) ( ? ".., 392008) = 392008
18907/640: close(6) = 0
18907/640: brk(0x401e6000) = 0
18907/640: sigprocmask(SIG_BLOCK, 0x7b0f6e68, 0x7b0f6e88) = 0
18907/640: ioctl(255, TIOCSPGRP, 0x7b0f6eb8) = 0
18907/640: sigprocmask(SIG_SETMASK, 0x7b0f6e88, NULL) = 0
18907/640: setpgid(18907, 18907) ERR#1 EPERM
18907/640: sigaction(SIGHUP, 0x7b0f6e20, 0x7b0f6e48) = 0
18907/640: getpid() = 18907 (18906)
18907/640: kill(18907, SIGHUP) = 0
18907/640: Received signal 1, SIGHUP, in kill(), [SIG_DFL], no siginfo
18907/640: kill(0, 0x447) [entry]
18907/640: exit(1) [implicit (kill failure)] WIFSIGNALED(SIGHUP)
18906/637: Received signal 18, SIGCLD, in select(), [caught], no siginfo
18906/637: select(7, 0x4000de90, 0x4000de8c, NULL, NULL) = 0
18906/637: waitpid(-1, NULL, WNOHANG) = 18907
18906/637: kill(-18907, SIGHUP) ERR#3 ESRCH
18906/637: open("/etc/utmp", O_RDWR|O_CREAT, 0644) ERR#13 EACCES
18906/637: open("/etc/utmp", O_RDONLY, 0124730) = 7
18906/637: read(7, "\0\0\0\0\0\0\0\0\0\0\0\0s y s t ".., 60) = 60
18906/637: read(7, "\0\0\0\0\0\0\0\0\0\0\0\0r u n - ".., 60) = 60
.
.
.
18906/637: close(7) = 0
18906/637: close(6) = 0
18906/637: chown("/dev/ttyp3", 0, 0) ERR#1 EPERM
18906/637: chown("/dev/pty/ttyp3", 0, 0) ERR#1 EPERM
18906/637: chmod("/dev/ttyp3", 0666) ERR#1 EPERM
18906/637: chmod("/dev/pty/ttyp3", 0666) ERR#1 EPERM
18906/637: exit(0) WIFEXITED(0)
$