I originally posted this at http://bdgregg.blogspot.com/2008/02/dtracetoolkit-in-macos-x.html.
Apple included DTrace in MacOS X 10.5 (Leopard), released in October 2007. It's great to have DTrace available in MacOS X for its powerful application and kernel performance analysis. To think that there is now another kernel we can examine using DTrace is exciting – it's like discovering a new planet in the solar system.
Apart from kernel analysis, DTrace also improves general usability by answering every day questions like: why are my disks rattling? or why does my browser keep hanging? Although, your average user may not write DTrace scripts to answer these questions themselves (it's better if they do), but instead use prewritten scripts.
MacOS X includes a collection of DTrace scripts in /usr/bin, mostly from the DTraceToolkit:
leopard# grep -l DTrace /usr/bin/* /usr/bin/bitesize.d /usr/bin/cpuwalk.d /usr/bin/creatbyproc.d /usr/bin/dappprof /usr/bin/dapptrace /usr/bin/diskhits /usr/bin/dispqlen.d /usr/bin/dtruss /usr/bin/errinfo /usr/bin/execsnoop /usr/bin/fddist /usr/bin/filebyproc.d /usr/bin/hotspot.d /usr/bin/httpdstat.d /usr/bin/iofile.d /usr/bin/iofileb.d /usr/bin/iopattern /usr/bin/iopending /usr/bin/iosnoop /usr/bin/iotop /usr/bin/kill.d /usr/bin/lastwords /usr/bin/loads.d /usr/bin/newproc.d /usr/bin/opensnoop /usr/bin/pathopens.d /usr/bin/pidpersec.d /usr/bin/plockstat /usr/bin/priclass.d /usr/bin/pridist.d /usr/bin/procsystime /usr/bin/runocc.d /usr/bin/rwbypid.d /usr/bin/rwbytype.d /usr/bin/rwsnoop /usr/bin/sampleproc /usr/bin/seeksize.d /usr/bin/setuids.d /usr/bin/sigdist.d /usr/bin/syscallbypid.d /usr/bin/syscallbyproc.d /usr/bin/syscallbysysc.d /usr/bin/topsyscall /usr/bin/topsysproc /usr/bin/weblatency.d
That's 44 DTraceToolkit scripts, plus plockstat from Solaris 10. While the DTraceToolkit now has over 200 scripts, it makes sense to pick out the most useful scripts for inclusion in /usr/bin.
Popular scripts such as iosnoop can now be run by MacOS X users:
leopard# iosnoop UID PID D BLOCK SIZE COMM PATHNAME 501 130 R 31987472 40960 Terminal ??/dyld/dyld_shared_cache_i386 501 130 R 7879952 8192 Terminal ??/SearchManager.nib/keyedobjects.nib 501 130 R 32132304 12288 Terminal ??/dyld/dyld_shared_cache_i386 501 130 R 32132528 4096 Terminal ??/dyld/dyld_shared_cache_i386 501 130 R 32047696 12288 Terminal ??/dyld/dyld_shared_cache_i386 501 130 R 32132592 4096 Terminal ??/dyld/dyld_shared_cache_i386 501 130 R 32131512 12288 Terminal ??/dyld/dyld_shared_cache_i386 501 130 R 32033296 12288 Terminal ??/dyld/dyld_shared_cache_i386 501 130 R 32044488 4096 Terminal ??/dyld/dyld_shared_cache_i386 501 130 R 32045064 4096 Terminal ??/dyld/dyld_shared_cache_i386 501 130 R 32131344 4096 Terminal ??/dyld/dyld_shared_cache_i386 501 130 R 32048680 16384 Terminal ??/dyld/dyld_shared_cache_i386 501 130 R 32132544 8192 Terminal ??/dyld/dyld_shared_cache_i386 501 130 R 32049296 12288 Terminal ??/dyld/dyld_shared_cache_i386 -1 0 W 32482848 86016 kernel_task ??/vm/swapfile2 -1 0 W 32483040 135168 kernel_task ??/vm/swapfile2 501 130 R 32044672 4096 Terminal ??/dyld/dyld_shared_cache_i386 501 130 R 32132656 12288 Terminal ??/dyld/dyld_shared_cache_i386 [...]
The man pages are conveniently included in /usr/share/man.
I had been making preperations in the latest DTraceToolkit (0.99) for MacOS X DTrace, such as putting an "OS" field into the man pages and figuring out how to support different versions of the same script (tcpsnoop_snv, etc). Hopefully many scripts will run on both Solaris and MacOS X (especially if they use stable providers), however, I expect there will be some that are specific to each. Now that QNX DTrace also exists, there is additional need for identifying OS specifics in the DTraceToolkit.
It's been great news for DTrace, Sun, and Apple. Apple have not only gained the best performance and debugging tool available, but also the existing DTrace community.