Section B.1. DTrace One-Liners

B.1. DTrace One-Liners

# New processes with arguments, dtrace -n 'proc:::exec-success { trace(curpsinfo->pr_psargs); }' # Files opened by process name, dtrace -n 'syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0)); }' # Files created using creat() by process name, dtrace -n 'syscall::creat*:entry { printf("%s %s",execname,copyinstr(arg0)); }' # Syscall count by process name, dtrace -n 'syscall:::entry { @num[execname] = count(); }' # Syscall count by syscall, dtrace -n 'syscall:::entry { @num[probefunc] = count(); }' # Syscall count by process ID, dtrace -n 'syscall:::entry { @num[pid,execname] = count(); }' # Read bytes by process name, dtrace -n 'sysinfo:::readch { @bytes[execname] = sum(arg0); }' # Write bytes by process name, dtrace -n 'sysinfo:::writech { @bytes[execname] = sum(arg0); }' # Read size distribution by process name, dtrace -n 'sysinfo:::readch { @dist[execname] = quantize(arg0); }' # Write size distribution by process name, dtrace -n 'sysinfo:::writech { @dist[execname] = quantize(arg0); }' # Disk size by process ID, dtrace -n 'io:::start { printf("%d %s %d",pid,execname,args[0]->b_bcount); }' # Disk size aggregation dtrace -n 'io:::start { @size[execname] = quantize(args[0]->b_bcount); }' # Pages paged in by process name, dtrace -n 'vminfo:::pgpgin { @pg[execname] = sum(arg0); }' # Minor faults by process name, dtrace -n 'vminfo:::as_fault { @mem[execname] = sum(arg0); }' # Interrupts by CPU, dtrace -n 'sdt:::interrupt-start { @num[cpu] = count(); }' # CPU cross calls by process name, dtrace -n 'sysinfo:::xcalls { @num[execname] = count(); }' # Lock time by process name, dtrace -n 'lockstat:::adaptive-block { @time[execname] = sum(arg1); }' # Lock distribution by process name, dtrace -n 'lockstat:::adaptive-block { @time[execname] = quantize(arg1); }' # Kernel funtion calls by module dtrace -n 'fbt:::entry { @calls[probemod] = count(); }' # Stack size for processes dtrace -n 'sched:::on-cpu { @[execname] = max(curthread->t_procp->p_stksize);}'