I'm gonna assume for 6e. 5e works basically the same way, basically only different in marks vs access.
So, first thing you need to do is spot the commlink's icon on the matrix. Just because you've got someone on the phone, or have received a text message from them, that doesn't mean you've also spotted their icon. However, this DOES give you enough to go off to try to spot their particular commlink among the billions that are connected to the matrix at any given moment!
Now, the test is automatically successful if you're "close enough" and they're not running silent. "Close enough" was defined in 5e as being within 100 meters, but it's a more flexible concept in 6e. Maybe in a busy downtown core where there are thousands of commlinks within 50 meters of you, maybe that's the limit for "close enough", whereas out in barren Kansas maybe the automatic spotting range is as much as a kilometer. GM discretion is the credo for 6e, and it applies here too!
Assuming the commlink you wish to track is either running silent and/or not "close enough" for automatic spotting, you have to succeed on a Matrix Perception test.
You have two options in 6e. The first is an extended Electronics + Intuition test with a 10 minute interval (see pg. 178 SR6). The threshold is not given, but see the threshold guidelines on pg 36. This option represents poring over publicly available databases, and is akin to searching the phone book for a telephone number. if the target is analogous to having an unlisted phone number, this may not be a viable option. Again, GM discretion! The second, and only option if the target is Running Silent, is an opposed Electronics + Intuition vs Willpower + Sleaze. Remember to apply a Noise modifier for physical distance between you and the target. You don't know how far away it is yet, but the GM does! Also note that if you succeed on this second option, you may learn additional details about the icon as described on pg. 183. (in 5e, you can ask 1 question per net hit. in 6e, it's not that regimented)
Once the target is spotted, you're correct in that you're going to want to execute a Trace Icon matrix action. As per the writeup for Trace Icon on pg 184, you need admin access. This necessitates either probe/backdoor, or brute force. I won't go over that in this post.
Once the admin level access is achieved, you can execute the trace icon. As described, that's Electronics + Intuition vs (Willpower or Firewall) + Sleaze. As with the spotting, you must suffer Noise penalty based on physical distance between you and the target. Because it's typed as an illegal action, you gain +1 Overwatch Score for each hit rolled against you, and +1 more if you used a hacking cyberprogram to assist the test. If you're successful, you know the physical location.