I used strace
to attach to a process briefly. The process created 90 threads. When I found the offending thread, I had to tediously search for the parent thread
I can't see an easy way:
You could use the -ff
option with -o filename
to produce multiple files (one per pid).
eg:
strace -o process_dump -ff ./executable
grep clone process_dump*
that would help you see which parent created what. Maybe that would help you - at least then you could search backwards.