DTrace One Liners

# New processes with arguments,
dtrace -n 'proc:::exec-success { trace(curpsinfo->pr_psargs); }'
 
# Files opened by process,
dtrace -n 'syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0)); }'
 
# Syscall count by program,
dtrace -n 'syscall:::entry { @num[execname] = count(); }'
 
# Syscall count by syscall,
dtrace -n 'syscall:::entry { @num[probefunc] = count(); }'
 
# Syscall count by process,
dtrace -n 'syscall:::entry { @num[pid,execname] = count(); }'
 
# Read bytes by process,
dtrace -n 'sysinfo:::readch { @bytes[execname] = sum(arg0); }'
 
# Write bytes by process,
dtrace -n 'sysinfo:::writech { @bytes[execname] = sum(arg0); }'
 
# Read size distribution by process,
dtrace -n 'sysinfo:::readch { @dist[execname] = quantize(arg0); }'
 
# Write size distribution by process,
dtrace -n 'sysinfo:::writech { @dist[execname] = quantize(arg0); }'
 
# Disk size by process,
dtrace -n 'io:::start { printf("%d %s %d",pid,execname,args[0]->b_bcount); }'
 
# Pages paged in by process,
dtrace -n 'vminfo:::pgpgin { @pg[execname] = sum(arg0); }'
 
# Minor faults by process,
dtrace -n 'vminfo:::as_fault { @mem[execname] = sum(arg0); }'
 
# Interrupts by CPU,
dtrace -n 'sdt:::interrupt-start { @num[cpu] = count(); }'


DTrace Longer One Liners,

# New processes with arguments and time,
dtrace -qn 'syscall::exec*:return { printf("%Y %s\n",walltimestamp,curpsinfo->pr_psargs); }'
 
# Successful signal details,
dtrace -n 'proc:::signal-send /pid/ { printf("%s -%d %d",execname,args[2],args[1]->pr_pid); }'



#
#  Examples
#

### New processes with arguments,
  
# dtrace -n 'proc:::exec-success { trace(curpsinfo->pr_psargs); }'
dtrace: description 'proc:::exec-success ' matched 1 probe
CPU     ID                    FUNCTION:NAME
  0   3297         exec_common:exec-success   man ls
  0   3297         exec_common:exec-success   sh -c cd /usr/share/man; tbl /usr/share/man/man1/ls.1 |neqn /usr/share/lib/pub/
  0   3297         exec_common:exec-success   tbl /usr/share/man/man1/ls.1
  0   3297         exec_common:exec-success   neqn /usr/share/lib/pub/eqnchar -
  0   3297         exec_common:exec-success   nroff -u0 -Tlp -man -
  0   3297         exec_common:exec-success   col -x
  0   3297         exec_common:exec-success   sh -c trap '' 1 15; /usr/bin/mv -f /tmp/mpzIaOZF /usr/share/man/cat1/ls.1 2> /d
  0   3297         exec_common:exec-success   /usr/bin/mv -f /tmp/mpzIaOZF /usr/share/man/cat1/ls.1
  0   3297         exec_common:exec-success   sh -c more -s /tmp/mpzIaOZF
  0   3297         exec_common:exec-success   more -s /tmp/mpzIaOZF


### Files opened by process,
 
# dtrace -n 'syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0)); }'
dtrace: description 'syscall::open*:entry ' matched 2 probes
CPU     ID                    FUNCTION:NAME
  0     14                       open:entry gnome-netstatus- /dev/kstat
  0     14                       open:entry man /var/ld/ld.config
  0     14                       open:entry man /lib/libc.so.1
  0     14                       open:entry man /usr/share/man/man.cf
  0     14                       open:entry man /usr/share/man/windex
  0     14                       open:entry man /usr/share/man/man1/ls.1
  0     14                       open:entry man /usr/share/man/man1/ls.1
  0     14                       open:entry man /tmp/mpqea4RF
  0     14                       open:entry sh /var/ld/ld.config
  0     14                       open:entry sh /lib/libc.so.1
  0     14                       open:entry neqn /var/ld/ld.config
  0     14                       open:entry neqn /lib/libc.so.1
  0     14                       open:entry neqn /usr/share/lib/pub/eqnchar
  0     14                       open:entry tbl /var/ld/ld.config
  0     14                       open:entry tbl /lib/libc.so.1
  0     14                       open:entry tbl /usr/share/man/man1/ls.1
  0     14                       open:entry nroff /var/ld/ld.config
[...]


### Syscall count by program,
 
# dtrace -n 'syscall:::entry { @num[execname] = count(); }'
dtrace: description 'syscall:::entry ' matched 228 probes
^C
  snmpd                                                             1
  utmpd                                                             2
  inetd                                                             2
  nscd                                                              7
  svc.startd                                                       11
  sendmail                                                         31
  poold                                                           133
  dtrace                                                         1720


### Syscall count by syscall,
 
# dtrace -n 'syscall:::entry { @num[probefunc] = count(); }'
dtrace: description 'syscall:::entry ' matched 228 probes
^C
  fstat                                                             1
  setcontext                                                        1
  lwp_park                                                          1
  schedctl                                                          1
  mmap                                                              1
  sigaction                                                         2
  pset                                                              2
  lwp_sigmask                                                       2
  gtime                                                             3
  sysconfig                                                         3
  write                                                             4
  brk                                                               6
  pollsys                                                           7
  p_online                                                        558
  ioctl                                                           579


### Syscall count by process,
 
# dtrace -n 'syscall:::entry { @num[pid,execname] = count(); }'
dtrace: description 'syscall:::entry ' matched 228 probes
^C
     1109  svc.startd                                                        1
     4588  svc.startd                                                        2
        7  svc.startd                                                        2
     3950  svc.startd                                                        2
     1626  nscd                                                              2
      870  svc.startd                                                        2
       82  nscd                                                              6
     5011  sendmail                                                         10
     6010  poold                                                            74
     8707  dtrace                                                         1720


### Read bytes by process,
  
# dtrace -n 'sysinfo:::readch { @bytes[execname] = sum(arg0); }'
dtrace: description 'sysinfo:::readch ' matched 4 probes
^C
 
  mozilla-bin                                                      16
  gnome-smproxy                                                    64
  metacity                                                         64
  dsdm                                                             64
  wnck-applet                                                      64
  xscreensaver                                                     96
  gnome-terminal                                                  900
  ttymon                                                         5952
  Xorg                                                          17544
 

### Write bytes by process,
 
# dtrace -n 'sysinfo:::writech { @bytes[execname] = sum(arg0); }'
dtrace: description 'sysinfo:::writech ' matched 4 probes
^C

  dtrace                                                            1
  gnome-settings-d                                                  8
  xscreensaver                                                      8
  gnome-panel                                                       8
  nautilus                                                          8
  date                                                             29
  wnck-applet                                                     120
  bash                                                            210
  mozilla-bin                                                    1497
  ls                                                             1947
  metacity                                                       3172
  Xorg                                                           7424
  gnome-terminal                                                51955


### Read size distribution by process,
 
# dtrace -n 'sysinfo:::readch { @dist[execname] = quantize(arg0); }'
dtrace: description 'sysinfo:::readch ' matched 4 probes
^C
[...]
  gnome-terminal
           value  ------------- Distribution ------------- count
              16 |                                         0
              32 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@   15
              64 |@@@                                      1
             128 |                                         0
 
  Xorg
           value  ------------- Distribution ------------- count
              -1 |                                         0
               0 |@@@@@@@@@@@@@@@@@@@                      26
               1 |                                         0
               2 |                                         0
               4 |                                         0
               8 |@@@@                                     6
              16 |@                                        2
              32 |@                                        2
              64 |                                         0
             128 |@@@@@@@@                                 11
             256 |@@@                                      4
             512 |                                         0


### Write size distribution by process,
 
# dtrace -n 'sysinfo:::writech { @dist[execname] = quantize(arg0); }'
dtrace: description 'sysinfo:::writech ' matched 4 probes
^C
[...]
  Xorg
           value  ------------- Distribution ------------- count
              16 |                                         0
              32 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@       169
              64 |@@@                                      16
             128 |@@                                       10
             256 |                                         0
 
  gnome-terminal
           value  ------------- Distribution ------------- count
               0 |                                         0
               1 |@@                                       6
               2 |                                         0
               4 |                                         0
               8 |                                         1
              16 |@                                        2
              32 |@@@                                      7
              64 |                                         0
             128 |@@@@@@@@@@@@@@@@@@@@@@@                  63
             256 |@@@@                                     10
             512 |                                         1
            1024 |@@@@@                                    13
            2048 |@                                        2
            4096 |@@@                                      7


### Disk size by process,
  
# dtrace -n 'io:::start { printf("%d %s %d",pid,execname,args[0]->b_bcount); }'
  0   3271              bdev_strategy:start 16459 tar 1024
  0   3271              bdev_strategy:start 16459 tar 1024
  0   3271              bdev_strategy:start 16459 tar 2048
  0   3271              bdev_strategy:start 16459 tar 1024
  0   3271              bdev_strategy:start 16459 tar 1024
  0   3271              bdev_strategy:start 16459 tar 1024
  0   3271              bdev_strategy:start 16459 tar 8192
  0   3271              bdev_strategy:start 16459 tar 8192
  0   3271              bdev_strategy:start 16459 tar 16384
  0   3271              bdev_strategy:start 16459 tar 2048
  0   3271              bdev_strategy:start 16459 tar 1024
  0   3271              bdev_strategy:start 16459 tar 1024


### Pages paged in by process,
 
# dtrace -n 'vminfo:::pgpgin { @pg[execname] = sum(arg0); }'
dtrace: description 'vminfo:::pgpgin ' matched 1 probe
^C
 
  ttymon                                                            1
  bash                                                              1
  mozilla-bin                                                      36
  tar                                                            6661


### Minor faults by process,
  
# dtrace -n 'vminfo:::as_fault { @mem[execname] = sum(arg0); }'
dtrace: description 'vminfo:::as_fault ' matched 1 probe
^C
 
  mozilla-bin                                                      18
  dtrace                                                           57
  find                                                             64
  bash                                                            150
  tar                                                             501


### Interrupts by CPU,
 
# dtrace -n 'sdt:::interrupt-start { @num[cpu] = count(); }'
dtrace: description 'sdt:::interrupt-start ' matched 1 probe
^C
 
      513                2
      515                4
        3               39
        2               39


### New processes with arguments and time,
 
# dtrace -qn 'syscall::exec*:return { printf("%Y %s\n",walltimestamp,curpsinfo->pr_psargs); }'
2005 Apr 25 19:15:09 man ls
2005 Apr 25 19:15:09 sh -c cd /usr/share/man; tbl /usr/share/man/man1/ls.1 |...
2005 Apr 25 19:15:09 neqn /usr/share/lib/pub/eqnchar -
2005 Apr 25 19:15:09 tbl /usr/share/man/man1/ls.1
2005 Apr 25 19:15:09 nroff -u0 -Tlp -man -
2005 Apr 25 19:15:09 col -x
2005 Apr 25 19:15:10 sh -c trap '' 1 15; /usr/bin/mv -f /tmp/mpRZaqTF /usr/s...
2005 Apr 25 19:15:10 /usr/bin/mv -f /tmp/mpRZaqTF /usr/share/man/cat1/ls.1
2005 Apr 25 19:15:10 sh -c more -s /tmp/mpRZaqTF
2005 Apr 25 19:15:10 more -s /tmp/mpRZaqTF
[...]


### Successful signal details,
  
# dtrace -n 'proc:::signal-send /pid/ { printf("%s -%d %d",execname,args[2],args[1]->pr_pid); }'
dtrace: description 'proc:::signal-send ' matched 1 probe
CPU     ID                    FUNCTION:NAME
  0   3303            sigtoproc:signal-send bash -15 16442
  0   3303            sigtoproc:signal-send bash -9 16443
^C