The DTrace Cheatsheet

dtrace -n 'probe /predicate/ { action; }'

http://wikis.sun.com/display/DTrace/Documentation

finding Probes Actions

dtrace -l | grep foo keyword search @agg[key1, key2] = count() frequency count
dtrace -n 'fbt:::entry { @[probefunc] = count(); }' -c 'ping host' @agg[key1, key2] = sum(var) sum variable
frequency count @agg[key1, key2] = quantize(var) power of 2 quantize variable
grep foo /opt/DTT/Bin/* DTraceToolkit printf("format", var0...varN) print vars; use printa() for aggrs
stack(num), ustack(num) print num lines of kernel, user stack
func(pc), ufunc(pc) return kernel, user func name from PC
Probe Arguments
clear(@) clear an aggregation
syscall::: man syscallname trunc(@, 5) truncate agg to top 5 entries
fbt::: Kernel source stringof(ptr) string from kernel address
copyinstr(ptr) string from user address
Probes exit(0); exit dtrace
BEGIN program start
END program end Switches
tick-1sec run once per sec, one CPU only -n trace this probe description
syscall::read*:entry process reads -l list probes instead of tracing them
syscall::write*:entry process writes -q quiet; don't print default output
syscall::open*:entry file open -s <file> invoke script file, or at top of script: #!/usr/sbin/dtrace -s
proc:::exec-success process create -w allow destructive actions
io:::start,io:::done disk or NFS I/O request -p PID allow pid::: provider to trace this pid; it's also $target
lockstat:::adaptive-block blocked thread acquired kernel mutex -c 'command' have dtrace invoke this command
sysinfo:::xcalls cross calls -o file output to file
sched:::off-cpu thread leaves CPU -x options set various DTrace options (switchrate, bufsize…)
fbt:::entry entire kernel
profile-123 sample at 123Hz
perl*::: Perl provider probes Pragmas
javascript*::: JavaScript provider probes #pragma D option quiet same as -q, quiet output
#pragma D option destructive same as -w, allow destructive actions
#pragma D option switchrate=10hz print at 10Hz (instead of 1Hz)
Vars
#pragma D option bufsize=16m set per-CPU buffer size (default 4m)
execname on-CPU process name #pragma D option defaultargs $1 is 0, $$1 is "", etc…
pid, tid on-CPU PID, Thread ID
cpu CPU ID
timestamp time, nanoseconds One-Liners
vtimestamp time thread was on-CPU, ns dtrace -n 'proc:::exec-success { trace(curpsinfo->pr_psargs); }'
arg0...N probe args (uint64) dtrace -n 'syscall:::entry { @num[execname] = count(); }'
args[0]...[N] probe args (typed) dtrace -n 'syscall::open*:entry { printf("%s %s", execname, copyinstr(arg0)); }'
curthread pointer to current thread dtrace -n 'io:::start { @size = quantize(args[0]->b_bcount); }'
probemod module name dtrace -n 'fbt:::entry { @calls[probemod] = count(); }'
probefunc function name dtrace -n 'sysinfo:::xcalls { @num[execname] = count(); }'
probename probe name dtrace -n 'profile-1001 { @[stack()] = count() }'
self->foo thread-local dtrace -n 'profile-101 /pid == $target/ { @[ustack()] = count() }' -p PID
this->foo clause-local dtrace -n 'syscall:::entry { @num[probefunc] = count(); }'
$1...$N CLI args, int dtrace -n 'syscall::read*:entry { @[fds[arg0].fi_pathname] = count(); }'
$$1...$$N CLI args, str dtrace -n 'vminfo:::as_fault { @mem[execname] = sum(arg0); }'
$target -p PID, -c command dtrace -n 'sched:::off-cpu /pid == $target/ { @[stack()] = count(); }' -p PID
curpsinfo procfs style process statistics dtrace -n 'pid$target:libfoo::entry { @[probefunc] = count(); }' -p PID