From DTraceBook

The DTrace book was written for Solaris 11.

While Solaris 10, Mac OS X, and FreeBSD operating systems were included and discussed, the main operating system used during the development of the DTrace book was Solaris Nevada: the internal development version of Solaris 11. This allowed the latest version of DTrace to be demonstrated (including the most providers).

However, the syscall provider did change between writing the book and the Oracle Solaris 11 FCS release, as discussed below.

New Providers

Solaris 11 includes the ip, tcp and udp providers, allowing many scripts from the Network Lower Level Protocols chapter to be used. These providers were previously available in OpenSolaris.

syscall Provider Changes

Various system call probes were removed from the syscall provider in the final months of Solaris 11 development, including those for open(), stat(), mkdir() and creat(). These now need to be traced via the system call trap table names and arguments, such as via openat() instead of open(). The full list is here.

For example, the example one-liner on page 44:

dtrace -n 'syscall::open:entry { printf("%s %s", execname, copyinstr(arg0)); }'

Becomes the following on Solaris 11:

dtrace -n 'syscall::openat:entry { printf("%s %s", execname, copyinstr(arg1)); }'

(Which traces both open() and openat().) Likewise for all other scripts that use the syscall provider and the syscalls that were changed.

The syscall provider was never a stable interface, which was noted in the book. However, we expected it to have a reasonable level of stability, with only minor changes over time. The changes in Solaris 11 were unexpected and unfortunate for DTrace users with existing syscall-based scripts.

The reason behind the changes was to simply the system call trap table code, as part of the Solaris architecture proposal PSARC 2010/441 "delete obsolete system call traps".