Watch syscalls when a command misbehaves.

strace

See what a command is actually doing

strace -f -o trace.log ./binary arg

Follow one call only

strace -e trace=openat ./script.sh

Attach to something already running

strace -p <pid> -f

Only the calls that failed

strace -f -e trace=%file ./build.sh 2>&1 | grep ENOENT

Filtering to failures usually answers the question in one pass, instead of paging through a trace that may run to megabytes.

Scope: strace