The DTrace Cheatsheet dtrace -n 'probe /predicate/ { action; }' http://wikis.sun.com/display/DTrace/Documentation finding Probes Actions dtrace -l | grep foo keyword search @agg[key1, key2] = count() frequency count dtrace -n 'fbt:::entry { @[probefunc] = count(); }' -c 'ping host' @agg[key1, key2] = sum(var) sum variable frequency count @agg[key1, key2] = quantize(var) power of 2 quantize variable grep foo /opt/DTT/Bin/* DTraceToolkit printf("format", var0...varN) print vars; use printa() for aggrs stack(num), ustack(num) print num lines of kernel, user stack Probe Arguments func(pc), ufunc(pc) return kernel, user func name from PC clear(@) clear an aggregation syscall::: man syscallname trunc(@, 5) truncate agg to top 5 entries Kernel source fbt::: stringof(ptr) string from kernel address copyinstr(ptr) string from user address Probes exit(0); exit dtrace BEGIN program start END program end Switches run once per sec, one CPU only tick-1sec -n trace this probe description process reads syscall::read*:entry -l list probes instead of tracing them process writes syscall::write*:entry -q quiet; don't print default output file open syscall::open*:entry -s
<<