DTrace on Linux

by Amit

Linux port of DTrace has been moving for some time now.

I just tried the latest bits from ftp://crisp.dynalias.com/pub/release/website/dtrace and the initial impression is we got really cool stuff (in the making here).

Besides, GCC, Kernel headers, you will need the following stuffs to compile and load the DTrace kernel module:

  • libelf-dev: Working with ‘elf’ files
  • zlib libraries: working with the zlib files
  • bison, flex

Once you have got them, extract the sources and do:

  1. make all
  2. sudo make install
  3. sudo make load

If you do not see any error message, then the DTrace kernel module ‘dtracedrv’ has been correctly insrted.dtrace -l should display a long list of the currently available probes.

Let’s try a simple DTrace one-liner.

This DTrace one-liner dtrace -n 'syscall:::entry { @num[probefunc] = count(); } will display the number of times a system call is invoked during the time its running. Press a C-c after sometime and you should see something like this:

amit@kubuntu904:~$ dtrace -n 'syscall:::entry { @num[probefunc] = count(); }'
dtrace: description 'syscall:::entry ' matched 329 probes
dtrace: buffer size lowered to 512k
dtrace: aggregation size lowered to 256k

kill 1
rt_sigpending 1
readlink 2
sigprocmask 2
brk 3
uname 3
lstat64 5
fcntl64 7
sigreturn 7
close 11
open 11
socketcall 11
_llseek 14
munmap 15
rt_sigaction 16
mmap2 19
access 27
rt_sigprocmask 30
stat64 54
fstat64 69
setitimer 230
writev 397
time 482
_newselect 545
write 709
futex 727
ioctl 754
poll 1583
gettimeofday 2212
read 4878
clock_gettime 5462

That’s all for now. I just wanted to post my initial excitement :-)

Some points:

  1. If your OS seems to hang after the DTrace command, and even a C-c/ C-d/ C-z won’t help, then its possibly an issue with the terminal you are using. I had issues with gnome-terminal, xterm and ETerm. However, it works perfectly on KDE’s konsole
  2. If you are using Debian 5, you will possibly need to recompile your kernel for the zlib symbols in the kernel
  3. If you are familiar with DTrace on Solaris, you must have noticed that I could use DTrace as non-root user, this is different from the way it works on Solaris. I shall try to explore more on this.