10
provider:module:function:name
16
provider:module:function:name
23
* Supported providers: syscall, pid<num>, sysinfo
25
syscall::open*:entry - called on entry in open family syscalls
26
pid4092:::entry - called on entry in any syscall by process 4092
29
cpu == 0 && pid = 1029 - Process 1029 running on the first CPU
30
execname != "sched" - Process is not scheduller
31
- cpu, pid, execname are builtin variables
34
Formated and unformated output, variable assignment...
38
- Semicolon terminated commands;
39
- Variables var. Declaration is not needed, but good idea to set to zero
40
to deallocate space occupied.
42
... usage in this or next probes ...
44
- Arrays: arr[idx] = 1
49
execname - executable name
50
probemod - library/executable name
51
probefunc - function name
52
timestamp - current timestamp in nanoseconds
53
cpu - processor executing code (index)
57
self - thread specific store, usage (self->var = 1)
63
Syscall & pid providers
64
-----------------------
65
module - object: a.out, libc, libds, and so on...
67
name - place: entry, return
71
:::pswitch - fired when a process is switched to run
72
:::exec-success - fired when a new process is started
76
Process and thread creation and termination, signals...
78
:::signal-send - signal send
79
args[1] - psinfo_t of receiving process
80
->pr_fname - process file name
81
args[2] - signal number
86
:::on-cpu - got on cpu
87
:::off-cpu - got off cpu
91
:::start - I/O operation started
93
->b_flag B_READ bit (1 - read : 0 - write)
95
->dev_statname device name
97
->fi_pathname file name
102
printf() - C style printf
103
ustack() - user level stack
104
trace - value of give variable
105
var=val - variable assignments
106
system("ls %s", var) - call shell command using printf syntax
111
Allows to collect tables of information. The format is following
112
@name[indexes]=aggregate_function()
114
Aggegators: count(), sum(val)
116
- Aggegated values are reported on dtrace termination (Ctrl+C)
117
- Only single table is supported (?)
118
- multiline functions could be used as indexes, i.e. @name[ustack()]=...
121
pid4092:libc::entry { @count_table[probefunc] = count(); }
131
dtrace -s <script_file>
132
dtrace -s <script_file> -c command Trace command from start to end
133
-w Permit destructive actions
b'\\ No newline at end of file'