Trace syscalls for a command:
strace touch /tmp/hi
strace -c touch /tmp/hi
pidof httpd # get PID of running process strace -p 4455 # attach to the process by passing PID