Why we still teach strace before overhead panels

Operators often reach for aggregated charts first. Charts can hide the order of operations that actually mattered during an outage. In our labs we still ask learners to capture a short strace slice and narrate what they see. The exercise is not nostalgia. It forces precise verbs: open, read, wait, exit. Those verbs become the backbone of a postmortem that external reviewers can follow. We also ask people to pair their trace with a service map sketch, even if the sketch is ugly. The combination keeps discussions grounded in Linux primitives rather than vendor names. Finally, we stress kindness toward future readers. A trace without context is noise. A trace with timestamps, hostnames, and a one-line hypothesis is a gift.