Visit Summary

• Overview
• What is Dtrace
• The Dscripts
• The D Language
• Sample Programs
• DTrace
• Is a feature to trace the workings of a process, kernel or rest of the system
• Lightweight way of checking the kernel or a process in an Adhoc manner
• D Program Structure
• probe descriptions

/ predicate /

{

  action statements

}

• First D Program

dtrace:::BEGIN

{

        trace("Begin Dtrace");

}

dtrace:::END

{

        trace("End Dtrace");

}

• DTrace: More Details
• Providers
• Categories in which probes are defined. e.g. syscall, io, fbt
• Modules
• Functionality based areas: e.g genunix, arp, ip
• Functions
• Specific functions in a module. e.g. read, write
• Names
• For specific state of a function. e.g. entry, return
• D Language
• Mostly works with C operators, naming conventions etc.
• No iterative operations
• Aggregations
• @name[ keys ] = aggfunc ( args );
• Predefined variables
• execname
• pid
• The notion of this->
• timestamp
• Important Providers
• syscall
• dtrace
• fbt
• sysinfo
• proc
• io
• Next Steps
• Download Dtrace Guide
• Practice some simple scripts
• Read about the functionality of other providers
• Next Level
• Advanced Providers
• Advanced D Scripting
• More information with Aggregators
• Scripting using D Scripts

::::::::::::::
aggregate.d
::::::::::::::

syscall:::entry
{
    @counts[ probefunc] = count();
}


::::::::::::::
aggregate02.d
::::::::::::::

syscall::write:entry
{
    @counts[execname] = count();
}

::::::::::::::
blast.d
::::::::::::::

dtrace:::BEGIN
{
      i = 10;
}


profile:::tick-1sec
/i > 0/
{
      trace(i--);
}


profile:::tick-1sec
/i == 0/
{
      trace("blastoff!");
      exit(0);
}

::::::::::::::
error.d
::::::::::::::

BEGIN
{
    *(char *)NULL;
}

ERROR
{
    printf("error!");
}

::::::::::::::
first.d
::::::::::::::
dtrace:::BEGIN
{
	printf("Begin Dtrace");
}

dtrace:::END
{
	trace("End Dtrace");
}
::::::::::::::
pid.d
::::::::::::::
syscall:::
/ pid == 1502 /
{
	trace(probefunc);
}
::::::::::::::
procprov.d
::::::::::::::

proc:::exec
{
        self->parent = execname;
}
proc:::exec-success
/self->parent != NULL/
{
    @[self->parent, execname] = count();
    self->parent = NULL;
}
proc:::exec-failure
/self->parent != NULL/
{
    self->parent = NULL;
}
END
{
    printf("\n%-20s %-20s %s\n", "WHO", "WHAT", "COUNT");
    printa("%-20s %-20s %@d\n", @);
}

::::::::::::::
rw.d
::::::::::::::
dtrace:::BEGIN
{
	i = 0;
}

syscall::read:entry,
syscall::write:entry
/pid == 1624/
{
	i++;
	trace(execname);
}

dtrace:::END
{
	trace(i);
	trace("Goodbye!");
}


::::::::::::::
schedprov.d
::::::::::::::

sched:::on-cpu
{
    self->ts = timestamp;
}
sched:::off-cpu
/self->ts/
{
    @[cpu] = quantize(timestamp - self->ts);
    self->ts = 0;
}

::::::::::::::
schedprov02.d
::::::::::::::

sched:::enqueue
{
    self->ts = timestamp;
}
sched:::dequeue
/self->ts/
{
    @[args[2]->cpu_id] = quantize(timestamp - self->ts);
    self->ts = 0;
}

::::::::::::::
sdtprov.d
::::::::::::::

interrupt-start
{
    self->ts = vtimestamp;
}
interrupt-complete
/self->ts/
{
    this->devi = (struct dev_info *)arg0;
    @[stringof(`devnamesp[this->devi->devi_major].dn_name),
        this->devi->devi_instance] = quantize(vtimestamp - self->ts);
}

::::::::::::::
syscall.d
::::::::::::::

syscall::open:entry
{
	trace(execname);
}



::::::::::::::
wireless.d
::::::::::::::

fbt::*ieee80211*:entry
{
	trace("Wireless activity");
}