fidlcat: Guide

Once you have launched fidlcat and attached to a running process, the tool begins logging system calls sent and received using FIDL.

See the following basic example output from fidlcat:

The example output contains the following information:

  • the name of the process that has generated this display.

  • 193974: the process koid.

  • 193976: the thread koid.

  • zx_channel_create: the name of the intercepted/displayed system call.

  • system call input parameters (such as handle and options) listed by name, type, and value.

  • system call return value (ZX_OK) and output parameters.

For system calls representing a FIDL transaction, fidlcat displays additional input and output parameters. See the following example of a synchronous fuchsia.examples/Echo.EchoString request:

Notice the FIDL request and response messages in the display output, including the method name and parameters.

Modifying the display

By default, fidlcat only displays process information on the first line of each message. Use the flag --with-process-info to include these details on each line:

Stack frames

Note: If a program crashes while fidlcat is attached, the stack frames print automatically to the display.

Using the flag --stack you can display the stack frames for every system call. By default (--stack=0), the stack frames are not displayed.

With --stack=1 only the call site (1 to 4 frames) is displayed:

This option doesn't add any overhead (except for the display).

With --stack=2 all the frames are displayed:

This option adds some overhead because we need to ask zxdb for the full stack for each system call (and fidlcat becomes even more verbose). You should use it only when you need to understand what part of your code called the system calls.

Filtering output


By default, fidlcat only displays zx_channel syscalls. The --syscalls option allows you to define a regular expression that selects the syscalls to decode and display.

To display all the syscalls, use: --syscalls=".\*"

The --exclude-syscalls flag defines a regular expreission that excludes syscalls from the set selected by --syscalls.

To be displayed, a syscall must satisfy the --syscalls pattern and not satisfy the --exclude-syscalls pattern.

The following example displays all syscalls, except for zx_handle:

--syscalls ".\*" --exclude-syscalls "zx_handle_.\*"


By default, fidlcat displays all the messages. You can specify the messages you want to display using:

  • --messages allows you to specify one or more regular expressions the messages must satisfy to be displayed.

  • --exclude-messages allows you to specify one or more regular expressions the messages must not satisfy to be displayed.

If both options are used at the same time, to be displayed, a message must satisfy one of the regular expressions specified with --messages and not satisfy any regular expression specified with --exclude-messages.

Message filtering works on the method's fully qualified name. For example, the following flag:


Matches methods like:


When using the option --thread=<thread koid> only the events from the specified thread are displayed. The option can be used several times to display several threads.

Grouping output


Use the options --with=top and --with=top=<path> to generate a view that groups the output by process, protocol, and method. The groups are sorted by number of events, so groups with more associated events are listed earlier.


Use the options --with=group-by-thread and --with=group-by-thread=<path> to generate a view that displays a short version of all the events for each thread.

Postponing the message display

By default, fidlcat begins displaying messages immediately after it attaches to the process.

You can use the --trigger option to defer the display until the provided regular expression matches an incoming message.

This is really useful when you need to understand what's going on after you received or emit a particular message.

Summary view

To configure fidlcat to display a high level summary of the session instead of listing individual messages, use the options --with=summary and --with=summary=<path>.

This displays a list of all the monitored processes, handles, and channels in the session with additional summary details:

  • Handles: Whether the handle is a startup handle (inherited during process creation) or created during the process life. For non-startup handles, fidlcat also displays information about the syscalls used to create and close each handle.

  • Channels: Displays the handle responsible for the other end of the channel and the list of FIDL messages sent and received.

Continuous monitoring

By default, the fidlcat session terminates when all the attached processes exit.

Use the option --stay-alive to keep the session running until you manually exit fidlcat (for example, using Ctrl-C).

This allows you to restart a program multiple times within the same monitoring session. With each restart, the fidlcat session attaches to the new process automatically.