On: The Magic of strace

[hobo_mark]

while we wait, could you elaborate on that? ;)

[dmpk2k → hobo_mark]

strace shows syscalls -- it's effectively truss.

That's useful and all, but what if you want to instrument arbitrary parts of a program, not just the syscall interface? By function or instruction? Either in userspace or in kernel? With statistical functions? And speculative tracing? And extensive control flow (except loops, which prevent certain safely guarantees DTrace makes). And a lot more.

Don't be fooled by the single-letter change: strace is to DTrace what edlin is to emacs. Or something else ridiculously extreme. They're barely comparable.

[Xdes → dmpk2k]

Still doesn't tell me what dtrace does.

[brodney → Xdes]

Read this: http://blog.bignerdranch.com/1907-hooked-on-dtrace-part-1/

[Xdes → brodney]

Or you could just give a concise definition:

    >What is this "DTrace" thing? It stands for "Dynamic Tracing",
    >a way you can attach "probes" to a running system
    >and peek inside as to what it is doing.

[brodney → Xdes]

It was my mistake to link you to a tutorial on the thing you are asking about. I don't know what came over me.

[dunham → Xdes]

It's like awk, except that you match entry/exit of syscalls, function calls, method invocations (in ObjC/Java), and give code to execute with access to arguments, return values, stack trace, etc.

It can be used to write tools like strace (see "dtruss" on OSX), iotop, topsyscall, etc.

[Someone → dunham]

On Mac OS X, the way to get an idea of what dtrace can do is "apropos dtrace". That shows you the dtrace scripts that the OS ships with.