1*e137d3e0Schristos# 2*e137d3e0Schristos# DTrace OneLiners Examples 3*e137d3e0Schristos# 4*e137d3e0Schristos 5*e137d3e0Schristos### New processes with arguments, 6*e137d3e0Schristos 7*e137d3e0Schristos# dtrace -n 'proc:::exec-success { trace(curpsinfo->pr_psargs); }' 8*e137d3e0Schristosdtrace: description 'proc:::exec-success ' matched 1 probe 9*e137d3e0SchristosCPU ID FUNCTION:NAME 10*e137d3e0Schristos 0 3297 exec_common:exec-success man ls 11*e137d3e0Schristos 0 3297 exec_common:exec-success sh -c cd /usr/share/man; tbl /usr/share/man/man1/ls.1 |neqn /usr/share/lib/pub/ 12*e137d3e0Schristos 0 3297 exec_common:exec-success tbl /usr/share/man/man1/ls.1 13*e137d3e0Schristos 0 3297 exec_common:exec-success neqn /usr/share/lib/pub/eqnchar - 14*e137d3e0Schristos 0 3297 exec_common:exec-success nroff -u0 -Tlp -man - 15*e137d3e0Schristos 0 3297 exec_common:exec-success col -x 16*e137d3e0Schristos 0 3297 exec_common:exec-success sh -c trap '' 1 15; /usr/bin/mv -f /tmp/mpzIaOZF /usr/share/man/cat1/ls.1 2> /d 17*e137d3e0Schristos 0 3297 exec_common:exec-success /usr/bin/mv -f /tmp/mpzIaOZF /usr/share/man/cat1/ls.1 18*e137d3e0Schristos 0 3297 exec_common:exec-success sh -c more -s /tmp/mpzIaOZF 19*e137d3e0Schristos 0 3297 exec_common:exec-success more -s /tmp/mpzIaOZF 20*e137d3e0Schristos 21*e137d3e0Schristos 22*e137d3e0Schristos### Files opened by process, 23*e137d3e0Schristos 24*e137d3e0Schristos# dtrace -n 'syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0)); }' 25*e137d3e0Schristosdtrace: description 'syscall::open*:entry ' matched 2 probes 26*e137d3e0SchristosCPU ID FUNCTION:NAME 27*e137d3e0Schristos 0 14 open:entry gnome-netstatus- /dev/kstat 28*e137d3e0Schristos 0 14 open:entry man /var/ld/ld.config 29*e137d3e0Schristos 0 14 open:entry man /lib/libc.so.1 30*e137d3e0Schristos 0 14 open:entry man /usr/share/man/man.cf 31*e137d3e0Schristos 0 14 open:entry man /usr/share/man/windex 32*e137d3e0Schristos 0 14 open:entry man /usr/share/man/man1/ls.1 33*e137d3e0Schristos 0 14 open:entry man /usr/share/man/man1/ls.1 34*e137d3e0Schristos 0 14 open:entry man /tmp/mpqea4RF 35*e137d3e0Schristos 0 14 open:entry sh /var/ld/ld.config 36*e137d3e0Schristos 0 14 open:entry sh /lib/libc.so.1 37*e137d3e0Schristos 0 14 open:entry neqn /var/ld/ld.config 38*e137d3e0Schristos 0 14 open:entry neqn /lib/libc.so.1 39*e137d3e0Schristos 0 14 open:entry neqn /usr/share/lib/pub/eqnchar 40*e137d3e0Schristos 0 14 open:entry tbl /var/ld/ld.config 41*e137d3e0Schristos 0 14 open:entry tbl /lib/libc.so.1 42*e137d3e0Schristos 0 14 open:entry tbl /usr/share/man/man1/ls.1 43*e137d3e0Schristos 0 14 open:entry nroff /var/ld/ld.config 44*e137d3e0Schristos[...] 45*e137d3e0Schristos 46*e137d3e0Schristos 47*e137d3e0Schristos### Syscall count by program, 48*e137d3e0Schristos 49*e137d3e0Schristos# dtrace -n 'syscall:::entry { @num[execname] = count(); }' 50*e137d3e0Schristosdtrace: description 'syscall:::entry ' matched 228 probes 51*e137d3e0Schristos^C 52*e137d3e0Schristos snmpd 1 53*e137d3e0Schristos utmpd 2 54*e137d3e0Schristos inetd 2 55*e137d3e0Schristos nscd 7 56*e137d3e0Schristos svc.startd 11 57*e137d3e0Schristos sendmail 31 58*e137d3e0Schristos poold 133 59*e137d3e0Schristos dtrace 1720 60*e137d3e0Schristos 61*e137d3e0Schristos 62*e137d3e0Schristos### Syscall count by syscall, 63*e137d3e0Schristos 64*e137d3e0Schristos# dtrace -n 'syscall:::entry { @num[probefunc] = count(); }' 65*e137d3e0Schristosdtrace: description 'syscall:::entry ' matched 228 probes 66*e137d3e0Schristos^C 67*e137d3e0Schristos fstat 1 68*e137d3e0Schristos setcontext 1 69*e137d3e0Schristos lwp_park 1 70*e137d3e0Schristos schedctl 1 71*e137d3e0Schristos mmap 1 72*e137d3e0Schristos sigaction 2 73*e137d3e0Schristos pset 2 74*e137d3e0Schristos lwp_sigmask 2 75*e137d3e0Schristos gtime 3 76*e137d3e0Schristos sysconfig 3 77*e137d3e0Schristos write 4 78*e137d3e0Schristos brk 6 79*e137d3e0Schristos pollsys 7 80*e137d3e0Schristos p_online 558 81*e137d3e0Schristos ioctl 579 82*e137d3e0Schristos 83*e137d3e0Schristos 84*e137d3e0Schristos### Syscall count by process, 85*e137d3e0Schristos 86*e137d3e0Schristos# dtrace -n 'syscall:::entry { @num[pid,execname] = count(); }' 87*e137d3e0Schristosdtrace: description 'syscall:::entry ' matched 228 probes 88*e137d3e0Schristos^C 89*e137d3e0Schristos 1109 svc.startd 1 90*e137d3e0Schristos 4588 svc.startd 2 91*e137d3e0Schristos 7 svc.startd 2 92*e137d3e0Schristos 3950 svc.startd 2 93*e137d3e0Schristos 1626 nscd 2 94*e137d3e0Schristos 870 svc.startd 2 95*e137d3e0Schristos 82 nscd 6 96*e137d3e0Schristos 5011 sendmail 10 97*e137d3e0Schristos 6010 poold 74 98*e137d3e0Schristos 8707 dtrace 1720 99*e137d3e0Schristos 100*e137d3e0Schristos 101*e137d3e0Schristos### Read bytes by process, 102*e137d3e0Schristos 103*e137d3e0Schristos# dtrace -n 'sysinfo:::readch { @bytes[execname] = sum(arg0); }' 104*e137d3e0Schristosdtrace: description 'sysinfo:::readch ' matched 4 probes 105*e137d3e0Schristos^C 106*e137d3e0Schristos 107*e137d3e0Schristos mozilla-bin 16 108*e137d3e0Schristos gnome-smproxy 64 109*e137d3e0Schristos metacity 64 110*e137d3e0Schristos dsdm 64 111*e137d3e0Schristos wnck-applet 64 112*e137d3e0Schristos xscreensaver 96 113*e137d3e0Schristos gnome-terminal 900 114*e137d3e0Schristos ttymon 5952 115*e137d3e0Schristos Xorg 17544 116*e137d3e0Schristos 117*e137d3e0Schristos 118*e137d3e0Schristos### Write bytes by process, 119*e137d3e0Schristos 120*e137d3e0Schristos# dtrace -n 'sysinfo:::writech { @bytes[execname] = sum(arg0); }' 121*e137d3e0Schristosdtrace: description 'sysinfo:::writech ' matched 4 probes 122*e137d3e0Schristos^C 123*e137d3e0Schristos 124*e137d3e0Schristos dtrace 1 125*e137d3e0Schristos gnome-settings-d 8 126*e137d3e0Schristos xscreensaver 8 127*e137d3e0Schristos gnome-panel 8 128*e137d3e0Schristos nautilus 8 129*e137d3e0Schristos date 29 130*e137d3e0Schristos wnck-applet 120 131*e137d3e0Schristos bash 210 132*e137d3e0Schristos mozilla-bin 1497 133*e137d3e0Schristos ls 1947 134*e137d3e0Schristos metacity 3172 135*e137d3e0Schristos Xorg 7424 136*e137d3e0Schristos gnome-terminal 51955 137*e137d3e0Schristos 138*e137d3e0Schristos 139*e137d3e0Schristos### Read size distribution by process, 140*e137d3e0Schristos 141*e137d3e0Schristos# dtrace -n 'sysinfo:::readch { @dist[execname] = quantize(arg0); }' 142*e137d3e0Schristosdtrace: description 'sysinfo:::readch ' matched 4 probes 143*e137d3e0Schristos^C 144*e137d3e0Schristos[...] 145*e137d3e0Schristos gnome-terminal 146*e137d3e0Schristos value ------------- Distribution ------------- count 147*e137d3e0Schristos 16 | 0 148*e137d3e0Schristos 32 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 15 149*e137d3e0Schristos 64 |@@@ 1 150*e137d3e0Schristos 128 | 0 151*e137d3e0Schristos 152*e137d3e0Schristos Xorg 153*e137d3e0Schristos value ------------- Distribution ------------- count 154*e137d3e0Schristos -1 | 0 155*e137d3e0Schristos 0 |@@@@@@@@@@@@@@@@@@@ 26 156*e137d3e0Schristos 1 | 0 157*e137d3e0Schristos 2 | 0 158*e137d3e0Schristos 4 | 0 159*e137d3e0Schristos 8 |@@@@ 6 160*e137d3e0Schristos 16 |@ 2 161*e137d3e0Schristos 32 |@ 2 162*e137d3e0Schristos 64 | 0 163*e137d3e0Schristos 128 |@@@@@@@@ 11 164*e137d3e0Schristos 256 |@@@ 4 165*e137d3e0Schristos 512 | 0 166*e137d3e0Schristos 167*e137d3e0Schristos 168*e137d3e0Schristos### Write size distribution by process, 169*e137d3e0Schristos 170*e137d3e0Schristos# dtrace -n 'sysinfo:::writech { @dist[execname] = quantize(arg0); }' 171*e137d3e0Schristosdtrace: description 'sysinfo:::writech ' matched 4 probes 172*e137d3e0Schristos^C 173*e137d3e0Schristos[...] 174*e137d3e0Schristos Xorg 175*e137d3e0Schristos value ------------- Distribution ------------- count 176*e137d3e0Schristos 16 | 0 177*e137d3e0Schristos 32 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 169 178*e137d3e0Schristos 64 |@@@ 16 179*e137d3e0Schristos 128 |@@ 10 180*e137d3e0Schristos 256 | 0 181*e137d3e0Schristos 182*e137d3e0Schristos gnome-terminal 183*e137d3e0Schristos value ------------- Distribution ------------- count 184*e137d3e0Schristos 0 | 0 185*e137d3e0Schristos 1 |@@ 6 186*e137d3e0Schristos 2 | 0 187*e137d3e0Schristos 4 | 0 188*e137d3e0Schristos 8 | 1 189*e137d3e0Schristos 16 |@ 2 190*e137d3e0Schristos 32 |@@@ 7 191*e137d3e0Schristos 64 | 0 192*e137d3e0Schristos 128 |@@@@@@@@@@@@@@@@@@@@@@@ 63 193*e137d3e0Schristos 256 |@@@@ 10 194*e137d3e0Schristos 512 | 1 195*e137d3e0Schristos 1024 |@@@@@ 13 196*e137d3e0Schristos 2048 |@ 2 197*e137d3e0Schristos 4096 |@@@ 7 198*e137d3e0Schristos 199*e137d3e0Schristos 200*e137d3e0Schristos### Disk size by process, 201*e137d3e0Schristos 202*e137d3e0Schristos# dtrace -n 'io:::start { printf("%d %s %d",pid,execname,args[0]->b_bcount); }' 203*e137d3e0Schristos 0 3271 bdev_strategy:start 16459 tar 1024 204*e137d3e0Schristos 0 3271 bdev_strategy:start 16459 tar 1024 205*e137d3e0Schristos 0 3271 bdev_strategy:start 16459 tar 2048 206*e137d3e0Schristos 0 3271 bdev_strategy:start 16459 tar 1024 207*e137d3e0Schristos 0 3271 bdev_strategy:start 16459 tar 1024 208*e137d3e0Schristos 0 3271 bdev_strategy:start 16459 tar 1024 209*e137d3e0Schristos 0 3271 bdev_strategy:start 16459 tar 8192 210*e137d3e0Schristos 0 3271 bdev_strategy:start 16459 tar 8192 211*e137d3e0Schristos 0 3271 bdev_strategy:start 16459 tar 16384 212*e137d3e0Schristos 0 3271 bdev_strategy:start 16459 tar 2048 213*e137d3e0Schristos 0 3271 bdev_strategy:start 16459 tar 1024 214*e137d3e0Schristos 0 3271 bdev_strategy:start 16459 tar 1024 215*e137d3e0Schristos 216*e137d3e0Schristos 217*e137d3e0Schristos### Pages paged in by process, 218*e137d3e0Schristos 219*e137d3e0Schristos# dtrace -n 'vminfo:::pgpgin { @pg[execname] = sum(arg0); }' 220*e137d3e0Schristosdtrace: description 'vminfo:::pgpgin ' matched 1 probe 221*e137d3e0Schristos^C 222*e137d3e0Schristos 223*e137d3e0Schristos ttymon 1 224*e137d3e0Schristos bash 1 225*e137d3e0Schristos mozilla-bin 36 226*e137d3e0Schristos tar 6661 227*e137d3e0Schristos 228*e137d3e0Schristos 229*e137d3e0Schristos### Minor faults by process, 230*e137d3e0Schristos 231*e137d3e0Schristos# dtrace -n 'vminfo:::as_fault { @mem[execname] = sum(arg0); }' 232*e137d3e0Schristosdtrace: description 'vminfo:::as_fault ' matched 1 probe 233*e137d3e0Schristos^C 234*e137d3e0Schristos 235*e137d3e0Schristos mozilla-bin 18 236*e137d3e0Schristos dtrace 57 237*e137d3e0Schristos find 64 238*e137d3e0Schristos bash 150 239*e137d3e0Schristos tar 501 240*e137d3e0Schristos 241*e137d3e0Schristos 242*e137d3e0Schristos### Interrupts by CPU, 243*e137d3e0Schristos 244*e137d3e0Schristos# dtrace -n 'sdt:::interrupt-start { @num[cpu] = count(); }' 245*e137d3e0Schristosdtrace: description 'sdt:::interrupt-start ' matched 1 probe 246*e137d3e0Schristos^C 247*e137d3e0Schristos 248*e137d3e0Schristos 513 2 249*e137d3e0Schristos 515 4 250*e137d3e0Schristos 3 39 251*e137d3e0Schristos 2 39 252*e137d3e0Schristos 253*e137d3e0Schristos 254*e137d3e0Schristos### New processes with arguments and time, 255*e137d3e0Schristos 256*e137d3e0Schristos# dtrace -qn 'syscall::exec*:return { printf("%Y %s\n",walltimestamp,curpsinfo->pr_psargs); }' 257*e137d3e0Schristos2005 Apr 25 19:15:09 man ls 258*e137d3e0Schristos2005 Apr 25 19:15:09 sh -c cd /usr/share/man; tbl /usr/share/man/man1/ls.1 |... 259*e137d3e0Schristos2005 Apr 25 19:15:09 neqn /usr/share/lib/pub/eqnchar - 260*e137d3e0Schristos2005 Apr 25 19:15:09 tbl /usr/share/man/man1/ls.1 261*e137d3e0Schristos2005 Apr 25 19:15:09 nroff -u0 -Tlp -man - 262*e137d3e0Schristos2005 Apr 25 19:15:09 col -x 263*e137d3e0Schristos2005 Apr 25 19:15:10 sh -c trap '' 1 15; /usr/bin/mv -f /tmp/mpRZaqTF /usr/s... 264*e137d3e0Schristos2005 Apr 25 19:15:10 /usr/bin/mv -f /tmp/mpRZaqTF /usr/share/man/cat1/ls.1 265*e137d3e0Schristos2005 Apr 25 19:15:10 sh -c more -s /tmp/mpRZaqTF 266*e137d3e0Schristos2005 Apr 25 19:15:10 more -s /tmp/mpRZaqTF 267*e137d3e0Schristos[...] 268*e137d3e0Schristos 269*e137d3e0Schristos 270*e137d3e0Schristos### Successful signal details, 271*e137d3e0Schristos 272*e137d3e0Schristos# dtrace -n 'proc:::signal-send /pid/ { printf("%s -%d %d",execname,args[2],args[1]->pr_pid); }' 273*e137d3e0Schristosdtrace: description 'proc:::signal-send ' matched 1 probe 274*e137d3e0SchristosCPU ID FUNCTION:NAME 275*e137d3e0Schristos 0 3303 sigtoproc:signal-send bash -15 16442 276*e137d3e0Schristos 0 3303 sigtoproc:signal-send bash -9 16443 277*e137d3e0Schristos^C 278*e137d3e0Schristos 279*e137d3e0Schristos 280*e137d3e0Schristos### Kernel function calls by module, 281*e137d3e0Schristos 282*e137d3e0Schristos# dtrace -n 'fbt:::entry { @calls[probemod] = count(); }' 283*e137d3e0Schristosdtrace: description 'fbt:::entry ' matched 18437 probes 284*e137d3e0Schristos^C 285*e137d3e0Schristos 286*e137d3e0Schristos devfs 2 287*e137d3e0Schristos ptm 2 288*e137d3e0Schristos ipf 5 289*e137d3e0Schristos pts 5 290*e137d3e0Schristos ttcompat 9 291*e137d3e0Schristos ptem 9 292*e137d3e0Schristos ldterm 23 293*e137d3e0Schristos ipgpc 24 294*e137d3e0Schristos ufs 24 295*e137d3e0Schristos ata 25 296*e137d3e0Schristos sockfs 27 297*e137d3e0Schristos gld 32 298*e137d3e0Schristos rtls 34 299*e137d3e0Schristos flowacct 38 300*e137d3e0Schristos specfs 50 301*e137d3e0Schristos ip 84 302*e137d3e0Schristos TS 92 303*e137d3e0Schristos uhci 101 304*e137d3e0Schristos uppc 1758 305*e137d3e0Schristos unix 6347 306*e137d3e0Schristos genunix 10023 307*e137d3e0Schristos 308