Dtrace 快速参考

chley

                                                                                传统的系统观测工具，truss, iostat, mpstat, cpustat, vmstat,
lockstat,proc(1)等可以实现对单个子系统的监测。DTrace
不仅可以实现这些工具的功能，还具备了更强大的能力，从应用程序进程，到操作系统内核；从宏观的模块性能，到具体每个函数的使用、运行情况，甚至到每个指
令的执行过程，DTrace都可以对其进行跟踪。DTrace为系统性能监测，程序开发调试等提供了一个统一的接口。
DTrace probe的基本结构：
provider:module:function:name
/predicate/
{
    /*action*/
}
dtrace -l  -- list all probes
dtrace -l -f function -- list probe function
dtrace -l -m module -- list probe module
dtrace -l -n  name    -- list probe name
dtrace -l -P provider  -- list probe provider
1. 常用D变量（内置）：
int64_t arg0, ..., arg9
  
The first ten input arguments to a probe represented as raw
64-bit integers.  If fewer than ten arguments are passed to the current probe,
the remaining variables return zero.
  
args[]
  
The typed arguments to the current probe, if any. The args[] array is accessed using an integer index, but each element is defined
to be the type corresponding to the given probe argument. For example, if
the args[] array is referenced by a read(2) system call probe, args[0] is of
type int, args[1] is of type void
*, and args[2] is of type size_t.
  
uintptr_t caller
  
The program counter location of the current thread just before
entering the current probe.
  
chipid_t chip
  
The CPU chip identifier for the current physical chip.
  
processorid_t cpu
  
The CPU identifier for the current CPU.
  
cpuinfo_t *curcpu
  
The CPU information for the current CPU.
  
lwpsinfo_t *curlwpsinfo
  
The lightweight process (LWP) state of the LWP associated
with the current thread. This structure is described in further detail in
the proc(4) man page.
  
psinfo_t *curpsinfo
  
The process state of the process associated with the current
thread. This structure is described in further detail in the  This structure
is described in further detail in the proc(4) man page.
  
kthread_t *curthread
  
The address of the operating system kernel's internal data
structure for the current thread, the kthread_t. The kthread_t is defined in . Refer
to Solaris Internals for more information on this variable
and other operating system data structures.
  
string cwd
  
The name of the current working directory of the process associated
with the current thread.
  
uint_t epid
  
The enabled probe ID (EPID) for the current probe. This integer
uniquely identifiers a particular probe that is enabled with a specific predicate
and set of actions.
  
int errno
  
The error value returned by the last system call executed
by this thread.
  
string execname
  
The name that was passed to exec(2) to execute the current process.
  
gid_t gid
  
The real group ID of the current process.
  
uint_t id
  
The probe ID for the current probe. This ID is the system-wide
unique identifier for the probe as published by DTrace and listed in the output
of dtrace -l.
  
uint_t ipl
  
The interrupt priority level (IPL) on the current CPU at the
time that the probe fires. Refer to Solaris Internals for
more information on interrupt levels and interrupt handling in the Solaris
operating system kernel.
  
lgrp_id_t lgrp
  
The locality group ID for the latency group of which the current
CPU is a member.
  
pid_t pid
  
The process ID of the current process.
  
pid_t ppid
  
The parent process ID of the current process.
  
string probefunc
  
The function name portion of the current probe's description.
  
string probemod
  
The module name portion of the current probe's description.
  
string probename
  
The name portion of the current probe's description.
  
string probeprov
  
The provider name portion of the current probe's description.
  
psetid_t pset
  
The processor set ID for the processor set that contains the
current CPU.
string root
  
The name of the root directory of the process associated with
the current thread.
  
uint_t stackdepth
  
The current thread's stack frame depth at probe firing time.
  
id_t tid
  
The thread ID of the current thread. For threads that are
associated with user processes, this value is equal to the result of a call
to pthread_self(3C).
  
uint64_t timestamp
  
The current value of a nanosecond timestamp counter. This
counter increments from an arbitrary point in the past and should only be
used for relative computations.
  
uid_t uid
  
The real user ID of the current process.
  
uint64_t uregs[]
  
The current thread's saved user-mode register values at probe
firing time. Use of the uregs[] array is discussed in
[/url]
Chapter 33, User Process Tracing, in Solaris Dynamic Tracing Guide
[url=http://docs.sfbay.sun.com/app/docs/doc/817-6223/6mlkidlmd?a=view]
.
  
uint64_t vtimestamp
  
The current value of a nanosecond timestamp counter. The counter
is virtualized to the amount of time that the current thread has been running
on a CPU. The counter does not include the time that is spent in DTrace predicates
and actions. This counter increments from an arbitrary point in the past and
should only be used for relative time computations.
  
uint64_t walltimestamp
  
The current number of nanoseconds since 00:00 Universal Coordinated
Time, January 1, 1970.
  
例：
# dtrace -n 'zfod {trace(pid);trace(execname)}'
2. Aggregation
@name[ keys ] = aggfunc( args );
aggfunc: count(),sum,avg,min,max,lquantize,quantize
3.常用 D Macros:
$[0-9]+
Macro arguments
$egid
Effective group-ID
$euid
Effective user-ID
$gid
Real group-ID
$pid
Process ID
$pgid
Process group ID
$ppid
Parent process ID
$projid
Project ID
$sid
Session ID
$target
Target process ID
$taskid
Task ID
$uid
Real user-ID
变量pid与 macro $pid的区别：
syscall::write:entry
/pid != $pid/
{
        printf("%s", stringof(copyin(arg1, arg2)));
}
The $pid macro variable expands to the process identifier
of the process that enabled the probes. The pid variable
contains the process identifier of the process whose thread was running on
the CPU where the probe was fired. The predicate /pid != $pid/ ensures
that the script does not trace any events related to the running of this script.
http://docs.sun.com/app/docs/doc/819-5488
http://developers.sun.com/solaris/articles/dtrace_quickref/dtrace_quickref.html
               
               
               
               
               
               
               
               
               
               
               
               
               

本文来自ChinaUnix博客，如果查看原文请点：http://blog.chinaunix.net/u/24393/showart_229037.html