See Which Files a Program Reads at Startup with strace

A program starts slowly or ignores a setting, and you want to know which files it opens or searches for before it does anything.

strace -f -e trace=file -o trace.txt git config --get user.name
sed -E 's/^[0-9]+ +//; s/ = -1 ENOENT.*/ = missing/' trace.txt | grep -E 'gitconfig|git/config' | sort -u
echo "system calls on files: $(wc -l < trace.txt), failed lookups: $(grep -c ENOENT trace.txt)"

faccessat(AT_FDCWD, "/etc/gitconfig", R_OK) = missing
faccessat(AT_FDCWD, "/root/.config/git/config", R_OK) = missing
faccessat(AT_FDCWD, "/root/.gitconfig", R_OK) = missing
system calls on files: 45, failed lookups: 22

-e trace=file limits strace to the system calls that take a file name, -f follows child processes and -o writes the trace to a file so it does not mix with the program's own output. The trace of git config --get user.name is short: 45 calls on files, 22 of them failing, and the lookups for /etc/gitconfig, ~/.config/git/config and ~/.gitconfig all came back missing, which is how git searches for configuration. See strace.

strace slows the program a lot, and ptrace is blocked by default in some containers and hardened systems. The class file includes stat and access as well as opens, so use -e trace=openat when only opens matter. Lines carry a process ID with -f, which the sample trims with sed.