Trace file opens of a command
Find which files a command opens with strace -e trace=openat, and add -e status=failed to see the config files it looked for and did not find.
A tool reads a configuration from somewhere, and the manual does not say where it looks.
strace -e trace=openat -e status=successful cat /etc/hostname 2>&1 | head -n 3
echo ---
strace -e trace=openat -e status=failed curl -s file:///dev/null 2>&1 | head -n 3openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/lib/aarch64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/etc/hostname", O_RDONLY) = 3
---
openat(AT_FDCWD, "/root/.curlrc", O_RDONLY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/root/.config/curlrc", O_RDONLY) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/root/.curlrc", O_RDONLY) = -1 ENOENT (No such file or directory)Every file a program opens goes through openat on current Linux, so tracing only that call lists the files. -e status=failed keeps the calls that returned an error, and ENOENT entries are the places the program looked and found nothing, here the two spots where curl searches for its .curlrc. -e status=successful does the opposite, as the first command shows for the libraries and the file that cat read. The filters are in the strace manual.
status= needs strace 5.2 or later. Older systems have open as well as openat, so use -e trace=file to cover both and every other call that takes a path. Add -f to follow children and -y to print the path behind each file descriptor. Output is long, so redirect it with -o file.