DTrace Sample

dtrace-sample.d

#!/usr/sbin/dtrace -s
	
#pragma D option flowindent

/* monitor file open */
syscall::open:entry
{
	printf("%s %s", execname, copyinstr(arg0));
}

/* monitor process fork*/
syscall::fork*:
{
	trace(pid);
}

syscall::exec*:
{
	trace(execname);
}

syscall::posix_spawn*:
{
	trace(execname);
}

/* monitor syscall of process */
syscall:::entry
/execname == "Google Chrome" || execname == "Google Chrome Helper"/
{
	@[probefunc] = count();
}
		
/* show read bytes */
syscall::read:return
{
	@[execname] = quantize(arg0);
}

/* profilling process names*/
profile-997
{
	@[execname] = count();
}
	
tick-1s
{
	printa(@);
	trunc(@);
}

/* timing system call */
syscall::write:entry
{
	self->s = timestamp;
}
syscall::write:return
/self->s/
{
	@["ns"] = quantize(timestamp - self->s);
	self->s = 0;
}