Sample One-Liners

See the DTrace book for more one-liners.

syscall Provider

Syscalls by type:
dtrace -n 'syscall:::entry { @[probefunc] = count(); }'

Kernel stack trace profile at 1001 Hertz:
dtrace -n 'profile-1001 { @[stack()] = count(); }'

Kernel thread name profile at 1001 Hertz (FreeBSD):
dtrace -n 'profile-1001 { @[stringof(curthread->td_name)] = count(); }'

Thread off-cpu stack trace count:
dtrace -n 'sched:::off-cpu { @[stack()] = count(); }'

CPU cross calls by kernel stack trace:
dtrace -n 'sysinfo:::xcalls { @[stack()] = count(); }'

Adaptive lock block time totals (ns) by kernel stack trace:
dtrace -qn 'lockstat:::adaptive-block { @[stack(5), "^^^ total ns:"] = sum(arg1); }'

Kernel function call counts for module "zfs" by module:
dtrace -n 'fbt:zfs::entry { @[probefunc] = count(); }'

Kernel function call counts for functions beginning with "hfs_" by module:
dtrace -n 'fbt::hfs_*:entry { @[probefunc] = count(); }'

Kernel stack back trace counts for calls to function "arc_read()" (for example):
dtrace -n 'fbt::arc_read:entry { @[stack()] = count(); }'

Kernel-mode instructions by thread address:
dtrace -n 'cpc:::PAPI_tot_ins-kernel-200000 { @[(uint64_t)curthread] = count(); }'

Kernel-mode instructions by function name:
dtrace -n 'cpc:::PAPI_tot_ins-kernel-200000 { @[func(arg0)] = count(); }'

Kernel-mode CPU cycles by function name:
dtrace -n 'cpc:::PAPI_tot_cyc-kernel-200000 { @[func(arg0)] = count(); }'

Kernel-mode level 1 cache misses by function name:
dtrace -n 'cpc:::PAPI_l1_tcm-kernel-10000 { @[func(arg0)] = count(); }'

Kernel-mode resource stall cycles by function name:
dtrace -n 'cpc:::PAPI_res_stl-kernel-50000 { @[func(arg0)] = count(); }'