Filter expression is a chain of glob- or regexp-based rules that are used to pick symbols for tracing from libraries that the process uses. Most of it is intuitive, so as an example, the following would trace calls to malloc and free, except those done by libc:
This reads: trace malloc and free, but don't trace anything that comes from libc. Semi-formally, the syntax of the above example looks approximately like this:
Symbol_pattern is used to match symbol names, library_pattern to match library SONAMEs. Both are implicitly globs, but can be regular expressions as well (see below). The glob syntax supports meta-characters * and ? and character classes, similarly to what basic bash globs support. ^ and $ are recognized to mean, respectively, start and end of given name.
Both symbol_pattern and library_pattern have to match the whole name. If you want to match only part of the name, surround it with one or two *'s as appropriate. The exception is if the pattern is not mentioned at all, in which case it's as if the corresponding pattern were *. (So malloc is really malloc@* and @libc.* is really *@libc.*.)
In libraries that don't have an explicit SONAME, basename is taken for SONAME. That holds for main binary as well: /bin/echo has an implicit SONAME of echo. In addition to that, special library pattern MAIN always matches symbols in the main binary and never a library with actual SONAME MAIN (use e.g. ^MAIN or [M]AIN for that).
If the symbol or library pattern is surrounded in slashes (/like this/), then it is considered a regular expression instead. As a shorthand, instead of writing /x/@/y/, you can write /x@y/.
If the library pattern starts with a slash, it is not a SONAME expression, but a path expression, and is matched against the library path name.
The first rule may lack a sign, in which case + is assumed. If, on the other hand, the first rule has a - sign, it is as if there was another rule @ in front of it, which has the effect of tracing complement of given rule.
The above rules are used to construct the set of traced symbols. Each candidate symbol is passed through the chain of above rules. Initially, the symbol is unmarked. If it matches a + rule, it becomes marked, if it matches a - rule, it becomes unmarked again. If, after applying all rules, the symbol is marked, it will be traced.
It has most of the bugs stated in strace(1).
It only works on Linux and in a small subset of architectures.
If you would like to report a bug, send a message to the mailing list (email@example.com), or use the reportbug(1) program if you are under the Debian GNU/Linux distribution.