DTraceToolkit in MacOS X

Apple included DTrace in MacOS X 10.5 (Leopard), released in October 2007. It's great to have DTrace available in MacOS X for its powerful application and kernel performance analysis. To think that there is now another kernel we can examine using DTrace is exciting - it's like discovering a new planet in the solar system.

Apart from kernel analysis, DTrace also improves general usability by answering every day questions like: why are my disks rattling? or why does my browser keep hanging? Although, your average user may not write DTrace scripts to answer these questions themselves (it's better if they do), but instead use prewritten scripts.

MacOS X includes a collection of DTrace scripts in /usr/bin, mostly from the DTraceToolkit:

leopard# grep -l DTrace /usr/bin/*
/usr/bin/bitesize.d
/usr/bin/cpuwalk.d
/usr/bin/creatbyproc.d
/usr/bin/dappprof
/usr/bin/dapptrace
/usr/bin/diskhits
/usr/bin/dispqlen.d
/usr/bin/dtruss
/usr/bin/errinfo
/usr/bin/execsnoop
/usr/bin/fddist
/usr/bin/filebyproc.d
/usr/bin/hotspot.d
/usr/bin/httpdstat.d
/usr/bin/iofile.d
/usr/bin/iofileb.d
/usr/bin/iopattern
/usr/bin/iopending
/usr/bin/iosnoop
/usr/bin/iotop
/usr/bin/kill.d
/usr/bin/lastwords
/usr/bin/loads.d
/usr/bin/newproc.d
/usr/bin/opensnoop
/usr/bin/pathopens.d
/usr/bin/pidpersec.d
/usr/bin/plockstat
/usr/bin/priclass.d
/usr/bin/pridist.d
/usr/bin/procsystime
/usr/bin/runocc.d
/usr/bin/rwbypid.d
/usr/bin/rwbytype.d
/usr/bin/rwsnoop
/usr/bin/sampleproc
/usr/bin/seeksize.d
/usr/bin/setuids.d
/usr/bin/sigdist.d
/usr/bin/syscallbypid.d
/usr/bin/syscallbyproc.d
/usr/bin/syscallbysysc.d
/usr/bin/topsyscall
/usr/bin/topsysproc
/usr/bin/weblatency.d

That's 44 DTraceToolkit scripts, plus plockstat from Solaris 10. While the DTraceToolkit now has over 200 scripts, it makes sense to pick out the most useful scripts for inclusion in /usr/bin.

Popular scripts such as iosnoop can now be run by MacOS X users:

leopard# iosnoop
  UID   PID D    BLOCK   SIZE       COMM PATHNAME
  501   130 R 31987472  40960   Terminal ??/dyld/dyld_shared_cache_i386
  501   130 R  7879952   8192   Terminal ??/SearchManager.nib/keyedobjects.nib
  501   130 R 32132304  12288   Terminal ??/dyld/dyld_shared_cache_i386
  501   130 R 32132528   4096   Terminal ??/dyld/dyld_shared_cache_i386
  501   130 R 32047696  12288   Terminal ??/dyld/dyld_shared_cache_i386
  501   130 R 32132592   4096   Terminal ??/dyld/dyld_shared_cache_i386
  501   130 R 32131512  12288   Terminal ??/dyld/dyld_shared_cache_i386
  501   130 R 32033296  12288   Terminal ??/dyld/dyld_shared_cache_i386
  501   130 R 32044488   4096   Terminal ??/dyld/dyld_shared_cache_i386
  501   130 R 32045064   4096   Terminal ??/dyld/dyld_shared_cache_i386
  501   130 R 32131344   4096   Terminal ??/dyld/dyld_shared_cache_i386
  501   130 R 32048680  16384   Terminal ??/dyld/dyld_shared_cache_i386
  501   130 R 32132544   8192   Terminal ??/dyld/dyld_shared_cache_i386
  501   130 R 32049296  12288   Terminal ??/dyld/dyld_shared_cache_i386
   -1     0 W 32482848  86016 kernel_task ??/vm/swapfile2
   -1     0 W 32483040 135168 kernel_task ??/vm/swapfile2
  501   130 R 32044672   4096   Terminal ??/dyld/dyld_shared_cache_i386
  501   130 R 32132656  12288   Terminal ??/dyld/dyld_shared_cache_i386
[...]

The man pages are conveniently included in /usr/share/man.

I had been making preperations in the latest DTraceToolkit (0.99) for MacOS X DTrace, such as putting an "OS" field into the man pages and figuring out how to support different versions of the same script (tcpsnoop_snv, etc). Hopefully many scripts will run on both Solaris and MacOS X (especially if they use stable providers), however I expect there will be some that are specific to each. Now that QNX DTrace also exists, there is additional need for identifying OS specifics in the DTraceToolkit.

It's been great news for DTrace, Sun and Apple - who have not only gained the best performance and debugging tool available, but also the existing DTrace community.