On Sun, Nov 23, 2025 at 04:59:55PM +0100, Christian Marillat wrote:
> On 23 nov. 2025 06:18, Thomas Dickey <[email protected]> wrote:
> 
> 
> [...]
> 
> >> > You can test this by starting zsh without rc files: zsh -f
> >> 
> >> I tried this, didn't see the problem, doing this to (try to) eliminate my
> >> environment:
> >> 
> >>    #!/bin/sh
> >>    unset TERMINFO
> >>    unset TERMINFO_DIRS
> >>    export TERM=xterm-256color
> >
> > as an afterthought, I recall this was using urxvt.
> > Commenting out that TERM=, and trying with urxvt gave the same result.
> 
> I see in a strace log file:
> 
> How I can decode the first line "19633 read(3," ?

19633 is the process-id.

The "-f" option of strace tells it to also show child processes,
so (if there were programs run by the shell), that column would
be useful for seeing which program did which call.

In ./trace-xterm-256color-full.log, I see several process-ids
produced by clone() and execve() calls, but the "yes" appears
to be written by the main process zsh.

The quoted string "\354ll etc, would be the data returned.
read's third parameter is the buffer size, and
the 42 after the "=" is the actual number of bytes read.

The first parameter (3) is the file descriptor.
I don't see this particular trace in the discussion, but
you should be able to find an openat() preceding these read's
which returns 3, e.g., something like this one:

8910  openat(AT_FDCWD, "/home/revadam/.zsh_history", O_RDONLY) = 3

Knowing what file has been opened/read might give some clues about
what the program is doing when deciding to write "yes".
 
> ,----
> | 19633 read(3, 
> "\354ll\351\336\242\221\347N;\204\177\274\27c\206(\371\215\202\"\247b\16\335\321[\5\10r\372e"...,
>  262144) = 44
> | 19633 rt_sigprocmask(SIG_BLOCK, [HUP INT QUIT TERM], [], 8) = 0
> | 19633 ppoll([{fd=3, events=POLLIN}, {fd=3, events=0}, {fd=4, 
> events=POLLIN}, {fd=5, events=POLLOUT}], 4, NULL, [], 8) = 1 ([{fd=5, 
> revents=POLLOUT}])
> | 19633 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
> | 19633 write(5, "yes", 3)                = 3
> `----
> 
> Christian
> 

-- 
Thomas E. Dickey <[email protected]>
https://invisible-island.net

Attachment: signature.asc
Description: PGP signature

Reply via email to