How to strip a Linux system?

There are programs like Bootchart that can be used to show what programs you ran during startup - you can probably keep it going after boot to see what's been invoked during a session.

A better solution may be to use remastering tools.

There are remastering tools for Fedora, Ubuntu, and others; you can use these to customize a distribution.

You might want to look at Tiny Core Linux. There is a guy working on a remaster script for that as well.

Amongst other things, you want to remove everything you don't need. Make sure the filesystem has atime fully enabled; you can set this in /etc/fstab. The current default is relatime but you want to use just atime. Every time a file is accessed, the timestamp will get updated. Then do some usage for a few days to see which files have never had their atime updated. I would do all of this in a VM, and very carefully, because I imagine there are a few files that are read when the system is in read-only mode. Note: set it to noatime once you're ready for production, otherwise you'll do a write every time you read; this is inefficient.

Though to be honest, I'd look at Damn Small Linux; do you really need to be smaller than that? Build yours based on their distro and simply remove the window manager and a few extra programs. Leave all the command-line tools, that way if you ever need to repair or reload you have the shell.

assuming you are using Debian or it's derivatives

After some days of (heavy) usage, run popularity-contest. It will display the oldest unused packages at the bottom. Uninstall those, but with a watchful eye on whether or not there's stuff depending on them installed.

Here's a snippet of the output:

1294222606 1292570417 vlc /usr/lib/vlc/plugins/gui/libqt4_plugin.so
1294222606 1292570109 xulrunner-1.9.2 /usr/share/xulrunner-1.9.2/chrome/classic.jar
1294222606 1292507839 ttf-dejavu-extra /usr/share/fonts/truetype/ttf-dejavu/DejaVuSans-Oblique.ttf
1294222606 1292507459 x11-utils /usr/bin/xprop

The colums mean atime, ctime, package-name, and file accessed.