View source for DTrace

{{Short description|Dynamic tracing framework for kernel and applications}}
{{Infobox software
| name                   = DTrace
| screenshot             = DTrace on Windows v10.0.19041.1 1115x966.png
| screenshot size        = 
| caption                = The <code>DTrace</code> command
| author                 = [[Bryan Cantrill]], [[Adam Leventhal (programmer)|Adam Leventhal]], [[Mike Shapiro (programmer)|Mike Shapiro]] ([[Sun Microsystems]])
| developer              = [[Sun Microsystems]], [[Oracle Corporation|Oracle]], [[Microsoft]]
| released               = {{Start date and age|2005|01}}
| repo                   = {{URL|https://github.com/opendtrace}}
| programming language   = [[C (programming language)|C]]
| operating system       = [[Solaris (operating system)|Solaris]], [[illumos]], [[macOS]], [[FreeBSD]], [[NetBSD]], [[Linux]],<ref name=coekaerts>{{cite web 
  |url=http://blogs.oracle.com/wim/entry/trying_out_dtrace
  |author = Wim Coekaerts
  |title = Trying out dtrace
  |date = 2011-10-09
  |access-date = 2018-02-15
  |website = blogs.oracle.com}}</ref> [[Microsoft Windows|Windows]]<ref name="win2018a">{{cite web | title = OS internals: Technical deep-dive into operating system innovations - BRK3365 | url = https://www.youtube.com/watch?v=tG8R5SQGPck&t=12m10s | work = Microsoft Ignite Channel | date = 2018-10-08 }}</ref>
| genre                  = [[Tracing (software)|Tracing]]
| license                = [[Common Development and Distribution License|CDDL]], [[GPLv2]], [[Universal Permissive License|UPL]]
| website                = {{URL|dtrace.org}}
}}
'''DTrace''' is a comprehensive dynamic [[Tracing (software)|tracing]] framework originally created by [[Sun Microsystems]] for [[troubleshooting]] [[kernel (operating system)|kernel]] and application problems on production systems in real time. 
Originally developed for [[Solaris (operating system)|Solaris]], it has since been released under the free [[Common Development and Distribution License]] (CDDL) in [[OpenSolaris]] and its descendant [[illumos]], and has been ported to several other [[Unix-like]] systems.  Windows Server systems from [https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dtrace Windows Server 2025] will have DTrace as part of the system.

DTrace can be used to get a global overview of a running system, such as the amount of memory, CPU time, filesystem and network resources used by the active processes. It can also provide much more fine-grained information, such as a log of the arguments with which a specific function is being called, or a list of the processes accessing a specific file.

In 2010, [[Oracle acquisition of Sun|Oracle Corporation acquired Sun Microsystems]] and announced the discontinuation of OpenSolaris. 
As a community effort of some core Solaris engineers to create a truly open source Solaris, [[illumos]] [[operating system]] was announced via [[webinar]] on Thursday, 3 August 2010,<ref name=webinarslides>{{cite web |first=Garrett |last=D'Amore |title=Illumos - Hope and Light Springs Anew - Presented by Garrett D'Amore |date=3 August 2010 |url=http://www.illumos.org/attachments/download/3/illumos.pdf |publisher=illumos.org |access-date = 3 August 2010}}</ref> as a fork on OpenSolaris OS/Net consolidation, including DTrace technology.

In October 2011, Oracle announced the [[porting]] of DTrace to [[Linux]],<ref name="Slashdot 2011">{{cite web | title=Oracle To Bring Dtrace To Linux | website=Slashdot | date=2011-10-04 | url=https://linux.slashdot.org/story/11/10/08/0120215/oracle-to-bring-dtrace-to-linux | access-date=2020-11-11}}</ref> and in 2019 official DTrace for Fedora is available on [[GitHub]]. For several years an unofficial DTrace port to Linux was available, with no changes in licensing terms.<ref>[https://github.com/dtrace4linux/linux] "The original DTrace is licensed under Sun's (now Oracle) CDDL license. Original copyrights are left intact. No GPL code is incorporated into the release, to avoid legal conflicts."</ref>

In August 2017, Oracle released DTrace kernel code under the [[GPLv2|GPLv2+]] license, and [[user space]] code under GPLv2 and [[Universal Permissive License|UPL]] licensing.<ref>{{cite web
  |url = https://gnu.wildebeest.org/blog/mjw/2018/02/14/dtrace-for-linux-oracle-does-the-right-thing/
  |title = dtrace for linux; Oracle does the right thing
  |access-date = 2018-02-14
  |first = Mark J.
  |last = Wielaard
  |date = 2018-02-14
  |work = Mark J. Wielaard blog
}}</ref> In September 2018 [[Microsoft]] announced that they had ported DTrace from [[FreeBSD]] to Windows.<ref name="win2018a" />

In September 2016 the OpenDTrace effort began on [https://github.com/opendtrace GitHub] with both code and comprehensive [https://github.com/opendtrace/documentation documentation] of the system's internals.  The OpenDTrace effort maintains the original CDDL licensing for the code from OpenSolaris with additional code contributions coming under a [[BSD 2-Clause|BSD 2 Clause]] license.  The goal of OpenDTrace is to provide an OS agnostic, portable implementation of DTrace that is acceptable to all consumers, including macOS, FreeBSD, OpenBSD, NetBSD, and Linux as well as embedded systems.

== Description ==
Sun Microsystems designed DTrace to give operational insights that allow users to tune and troubleshoot applications and the OS itself.

Testers write tracing programs (also referred to as scripts) using the D programming language (not to be confused with other [[D programming language (disambiguation)|programming languages named "D"]]).  The language, inspired by [[C (programming language)|C]], includes added functions and variables specific to tracing. D programs resemble [[AWK]] programs in structure; they consist of a list of one or more ''probes'' (instrumentation points), and each probe is associated with an action. These probes are comparable to a [[pointcut]] in [[aspect-oriented programming]]. Whenever the condition for the probe is met, the associated action is executed (the probe "fires"). A typical probe might fire when a certain file is opened, or a process is started, or a certain line of code is executed. A probe that fires may analyze the run-time situation by accessing the [[call stack]] and context variables and evaluating expressions; it can then print out or log some information, record it in a database, or modify context variables. The reading and writing of context variables allows probes to pass information to each other, allowing them to cooperatively analyze the correlation of different events.

Special consideration has been taken to make DTrace safe to use in a production environment. For example, there is minimal [[probe effect]] when tracing is underway, and no performance impact associated with any disabled probe; this is important since there are tens of thousands of DTrace probes that can be enabled. New probes can also be created dynamically.

==Command line examples==
DTrace scripts can be invoked directly from the command line, providing one or more probes and actions as arguments. Some examples:

<syntaxhighlight lang="bash">
# New processes with arguments
dtrace -n 'proc:::exec-success { trace(curpsinfo->pr_psargs); }'

# Files opened by process
dtrace -n 'syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0)); }'

# Syscall count by program
dtrace -n 'syscall:::entry { @num[execname] = count(); }'

# Syscall count by syscall
dtrace -n 'syscall:::entry { @num[probefunc] = count(); }'

# Syscall count by process
dtrace -n 'syscall:::entry { @num[pid,execname] = count(); }'

# Disk size by process
dtrace -n 'io:::start { printf("%d %s %d",pid,execname,args[0]->b_bcount); }'

# Pages paged in by process
dtrace -n 'vminfo:::pgpgin { @pg[execname] = sum(arg0); }'
</syntaxhighlight>

Scripts can also be written which can reach hundreds of lines in length, although typically only tens of lines are needed for advanced troubleshooting and analysis.  Over 200 examples of open source DTrace scripts can be found in the DTraceToolkit,<ref>{{cite web
  | url = http://www.brendangregg.com/dtracetoolkit.html
  | title = DTraceToolkit
  | publisher = [[Brendan Gregg]]
  | access-date=2014-06-08
}}</ref> created by [[Brendan Gregg]] (author of the DTrace book<ref>{{cite book
  | url = http://my.safaribooksonline.com/book/operating-systems-and-server-administration/solaris/9780137061839
  | title = DTrace: Dynamic Tracing in Oracle Solaris, Mac OS X and FreeBSD
  | publisher = [[Safari Books]]
  | isbn = 978-0132091510
  | date = 2011
  | access-date = 2011-01-03
  | archive-date = 2011-04-06
  | archive-url = https://web.archive.org/web/20110406173133/http://my.safaribooksonline.com/book/operating-systems-and-server-administration/solaris/9780137061839
  | url-status = dead
  }}</ref>), which also provides documentation and demonstrations of each.

== Supported platforms ==
DTrace first became available for use in November 2003, and was formally released as part of Sun's [[Solaris (operating system)|Solaris 10]] in January 2005. DTrace was the first component of the [[OpenSolaris]] project to have its source code released under the [[Common Development and Distribution License]] (CDDL).

DTrace is an integral part of [[illumos]] and related distributions.

DTrace is a standard part of FreeBSD<ref>{{cite web | url=http://www.freebsd.org/releases/7.1R/announce.html | title=FreeBSD 7.1-RELEASE Announcement |date=2009-01-06 | access-date=2009-01-06}}</ref> and [[NetBSD]].<ref>{{cite web | url=http://mail-index.netbsd.org/source-changes/2010/02/21/msg006855.html | title=NetBSD source changes, 21 February 2010}}</ref>

Apple added DTrace support in [[Mac OS X 10.5]] "Leopard", including a GUI called [[Instruments (application)|Instruments]].<ref>{{cite web
 |url=https://www.apple.com/macosx/developertools/instruments.html 
 |title=Mac OS X Leopard - Developer Tools - Instruments 
 |publisher=[[Apple Inc.]] 
 |access-date=2007-10-19 
 |archive-url=https://web.archive.org/web/20071024144916/http://www.apple.com/macosx/developertools/instruments.html 
 |archive-date=2007-10-24 
 |url-status=dead 
}}</ref> Over 40 DTrace scripts from the DTraceToolkit are included in /usr/bin,<ref>{{cite web
  | url = https://opensource.apple.com/source/dtrace/
  | title = Mac OS X DTrace
  | publisher = [[Apple Inc.]]
  | access-date = 2010-05-31
  | archive-date = 2022-06-05
  | archive-url = https://web.archive.org/web/20220605233550/https://opensource.apple.com/source/dtrace/
  | url-status = dead
  }}</ref> including tools to examine disk I/O (iosnoop) and process execution (execsnoop). Unlike other platforms that DTrace is supported on, Mac OS X has a flag (P_LNOATTACH) that a program may set that disallows tracing of that process by debugging utilities such as DTrace and [[gdb]].  In the original Mac OS X DTrace implementation, this could affect tracing of other system information, as unrelated probes that should fire while a program with this flag set was running would fail to do so.<ref>{{cite web
  | url = http://dtrace.org/blogs/ahl/2008/01/18/mac-os-x-and-the-missing-probes/
  | title = Mac OS X and the missing probes
  | publisher = Leventhal, Adam H.
  | date = January 18, 2008
  | access-date = 2008-01-20
}}</ref> The OS&nbsp;X 10.5.3 update addressed this issue a few months later.<ref>{{cite web
  | url = http://dtrace.org/blogs/ahl/2008/06/07/apple-updates-dtrace/
  | title = Apple Updates DTrace
  | publisher = Leventhal, Adam H.
  | date = June 7, 2008
  | access-date = 2008-06-16
}}</ref> However, since El Capitan, [[System Integrity Protection]] prevents user from DTracing protected binary by default.

The [[Linux]] port of DTrace has been available since 2008;<ref>{{cite web
 | url = http://www.crisp.demon.co.uk/tools.html
 | title = CRiSP tools download page.
 | access-date = 2011-03-02
 | archive-date = 2020-11-16
 | archive-url = https://web.archive.org/web/20201116162408/http://www.crisp.demon.co.uk/tools.html
 | url-status = dead
 }}</ref> work continues actively to enhance and fix issues. There is also an active [https://github.com/dtrace4linux/linux implementation on github]. Standard core providers are available (fbt, syscall, profile), plus a special "instr" provider (some of the Solaris providers are not yet available {{as of | 2013| lc = on}}). The Linux DTrace implementation is a loadable [[kernel module]], which means that the kernel itself requires no modification, and thus allows DTrace to avoid CDDL vs. GPL licensing conflicts (in its source form, at least). However, once DTrace is loaded the kernel instance will be marked as [[Loadable kernel module#License issues|tainted]].

In 2007, a developer at QNX Software Systems announced on his blog that he and a colleague were working on incorporating DTrace into the [[QNX]] operating system.<ref>{{cite web|url=https://blogs.oracle.com/bmc/entry/dtrace_on_qnx|title=DTrace on QNX!|website=Oracle The Observation Deck Blog|date=November 8, 2007}}</ref>

Oracle Corporation added beta DTrace support for [[Oracle Linux]] in 2011,<ref name=coekaerts/> as a technology preview in the [[Oracle Linux#RHEL compatibility|Unbreakable Enterprise Kernel]] release 2, which is under GPLv2 (the DTrace Linux kernel module was originally released under CDDL).<ref>{{cite conference|url=https://events.linuxfoundation.org/images/stories/pdf/lfcs2012_zannoni_hees.pdf|title=DTrace on Linux|first1=Elena|last1=Zannoni|first2=Kris|last2=Van Hees|conference=Linux Foundation Collaboration Summit|year=2012|access-date=2012-04-05|archive-url=https://web.archive.org/web/20140707205640/https://events.linuxfoundation.org/images/stories/pdf/lfcs2012_zannoni_hees.pdf|archive-date=2014-07-07|url-status=dead}}</ref> General availability was announced in December 2012.<ref>{{cite web|url=https://blogs.oracle.com/linux/entry/announcement_dtrace_for_oracle_linux|title=Announcement: DTrace for Oracle Linux General Availability|website=Oracle Linux Blog|date=December 12, 2012|first=Zeynep|last=Koch}}</ref><ref>[https://web.archive.org/web/20190913144624/https://oss.oracle.com/git/?p=dtrace-modules.git DTrace module source code for Linux]</ref>

On March 11, 2019, Microsoft released a version of DTrace for Windows 10 insider builds.<ref>{{cite web|url=https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/DTrace-on-Windows/ba-p/362902|title=DTrace on Windows|website=Microsoft Tech Community|date=March 11, 2019|first=Hari|last=Pulapaka}}</ref> Microsoft included DTrace as a built-in tool in [[Windows Server 2025]].<ref>{{Cite web |last= |date=2024-04-19 |title=DTrace |url=https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dtrace |access-date=2024-11-07 |website=Microsoft Learn |language=en-us}}</ref><ref>{{Cite web |last=Gatlan |first=Sergiu |date=2024-11-04 |title=Windows Server 2025 released—here are the new features |url=https://www.bleepingcomputer.com/news/microsoft/windows-server-2025-released-here-are-the-new-features/ |url-status=live |archive-url=https://web.archive.org/web/20241105062437/https://www.bleepingcomputer.com/news/microsoft/windows-server-2025-released-here-are-the-new-features/ |archive-date=2024-11-05 |access-date=2024-11-07 |website=[[BleepingComputer]] |language=en-us}}</ref>

== Language and application providers ==
With a supported ''language provider'', DTrace can retrieve context of the code, including function, source file, and line number location. Further, dynamic memory allocation and garbage collection can be made available if supported by the language.<ref name="DTraceBook">{{cite book |title=DTrace: Dynamic Tracing in Oracle Solaris, Mac OS X and FreeBSD |year=2011 |publisher=[[Prentice Hall]] |isbn=9780132091510 |pages=1152}}</ref> Supported language providers include [[assembly language]]{{clarify|reason=Which ones?|date=February 2018}}, [[C (programming language)|C]], [[C++]], [[Java (programming language)|Java]], [[Erlang (programming language)|Erlang]], [[JavaScript]], [[Perl]], [[PHP]], [[Python (programming language)|Python]], [[Ruby (programming language)|Ruby]], [[shell script]], and [[Tcl]].

''Application providers'' allow DTrace to follow the operation of applications through system calls and into the kernel. Applications that offer DTrace application providers include [[MySQL]], [[PostgreSQL]], [[Oracle Database]], [[Oracle Grid Engine]], and [[Firefox]].<ref name="DTraceBook"/><ref>{{cite web |url=https://gridscheduler.sourceforge.net/documentation.html |title=Open Grid Scheduler / Grid Engine Documentation |publisher=Open Grid Scheduler |access-date=December 30, 2012}}</ref><ref>{{cite web |url=https://developer.mozilla.org/en/docs/DTrace |title=DTrace – MDN |publisher=Mozilla |access-date=December 30, 2012 |archive-date=September 5, 2014 |archive-url=https://web.archive.org/web/20140905175313/https://developer.mozilla.org/en/docs/DTrace |url-status=dead }}</ref>

== Authors and awards ==
DTrace was designed and implemented by [[Bryan Cantrill]], [[Mike Shapiro (programmer)|Mike Shapiro]], and [[Adam Leventhal (programmer)|Adam Leventhal]].

The authors received recognition in 2005 for the innovations in DTrace from ''[[InfoWorld]]'' and ''[[Technology Review]]''.<ref>{{cite web
| url = http://www.technologyreview.com/tr35/Profile.aspx?Cand=T&TRID=91
| title = Tracing software in real time
| access-date = 2007-03-31
| year = 2005
| work = Technology Review
| publisher = MIT
}}</ref><ref>{{ cite web
 |url         = http://www.infoworld.com/reports/31SRinnovators2005.html
 |title       = Innovation is alive and well in 2005
 |access-date  = 2007-03-31
 |last        = McAllister
 |first       = Neil
 |date        = August 2005
 |work        = InfoWorld
 |publisher   = IDG
 |url-status     = dead
 |archive-url  = https://web.archive.org/web/20051123190528/http://www.infoworld.com/reports/31SRinnovators2005.html
 |archive-date = 2005-11-23
}}</ref>  DTrace won the top prize in ''[[The Wall Street Journal]]''{{'}}s 2006 Technology Innovation Awards competition.<ref>{{cite web
| url = https://www.wsj.com/public/article/SB115755300770755096-R2Ct41cQ4ZIPMwk4_xh0xU_HnQI_20061011.html?mod=tff_main_tff_top
| title = The Winners Are...
| access-date = 2007-03-31
| last = Totty
| first = Michael
|date=September 2006
| work = The Wall Street Journal
| publisher = Dow Jones & Company, Inc.
}}</ref> The authors were recognized by [[USENIX]] with the Software Tools User Group (STUG) award in 2008.<ref>{{cite web
| url = http://www.usenix.org/events/usenix08/index.html
| title = 2008 USENIX Annual Technical Conference (USENIX '08)
| access-date = 2008-11-26
| year = 2008
}}</ref>

== See also ==
{{Portal|Computer programming|Free and open-source software}}

* [[eBPF]]{{snd}} Linux kernel tracing backend providing a set of features similar to DTrace<ref>{{cite web
 | url = http://www.brendangregg.com/dtrace.html
 | title = DTrace Tools
 | access-date=2017-11-27
}}</ref> since kernel version 4.9
* [[ftrace]]{{snd}} a tracing framework for the Linux kernel, capable of tracing scheduling events, interrupts, memory-mapped I/O, CPU power state transitions, etc.
* [[ktrace]]{{snd}} a BSD Unix and macOS utility that traces kernel&ndash;program interactions
* [[ltrace]]{{snd}} a Linux debugging utility, displays the calls a userland application makes to shared libraries
* [[strace]]{{snd}} a debugging utility for Linux, monitors system calls used by a program and all received signals 
* [[SystemTap]]{{snd}} a scripting language and utility used for instrumenting Linux installations
<!-- target article was moved to draftspace in August 2017 * [[Sysdig]] -->
* [[LTTng]]
* IBM [[ProbeVue]]

== References ==
*{{cite journal
 |     first = Bryan
 |     last = Cantrill
 |date=February 2006
 |      title = Hidden in Plain Sight
 |    journal = [[ACM Queue]]
 |     volume = 4
 |      issue = 1
 |      pages = 26&ndash;36
 |        doi = 10.1145/1117389.1117401
 |        url = http://queue.acm.org/detail.cfm?id=1117401
 | access-date = 2017-12-19
 |doi-access = free
 }}
*{{cite conference
 |     author = Bryan M. Cantrill, Michael W. Shapiro and Adam H. Leventhal
 |date=June 2004
 |      title = Dynamic Instrumentation of Production Systems
 | conference = Proceedings of the 2004 [[USENIX]] Annual Technical Conference
 | url = http://www.usenix.org/event/usenix04/tech/general/full_papers/cantrill/cantrill_html/
 | access-date = 2006-09-08
 }}

=== Notes ===
{{Reflist|30em}}

== External links ==
* [https://www.brendangregg.com/dtrace.html DTrace Tools]{{snd}} Brendan Gregg's DTrace examples (2004)
* [https://www.brendangregg.com/dtracetoolkit.html DTraceToolkit]{{snd}} a collection of DTrace scripts
* [https://github.com/brendangregg/DTrace-book-scripts DTrace book scripts]{{snd}} DTrace book scripts on GitHub
* [https://wiki.freebsd.org/DTrace FreeBSD DTrace page]{{snd}} FreeBSD DTrace homepage, includes a tutorial and one-liners
* [https://www.dtracebook.com DTrace book]
* [https://illumos.org/books/dtrace DTrace guide]{{snd}} Illumos DTrace book
* [https://myaut.github.io/dtrace-stap-book Dynamic Tracing with DTrace & SystemTap]{{snd}} free book with examples and exercises
* [http://dtracehol.com/ DTrace Hands On Lab]{{snd}} a step-by-step course to learn DTrace
* [https://docs.oracle.com/cd/E24457_01/html/E22001/ossdl.html DLight Tutorial]{{snd}} an interactive GUI utility for C/C++ developers based on DTrace technology; part of [[Oracle Solaris Studio]] prior to version 12.4
* [https://web.archive.org/web/20170903114855/http://www.mactech.com/articles/mactech/Vol.23/23.11/ExploringLeopardwithDTrace/index.html Exploring Leopard with DTrace]{{snd}} DTrace for debugging and exploration
* [https://www.youtube.com/watch?v=TgmA48fILq8|Google Tech Talk on DTrace given by Bryan Cantrill]
* [http://queue.acm.org/detail.cfm?id=1117401 Hidden in Plain Sight], Sun Microsystems, by Bryan Cantrill
* Official Oracle DTrace port to Linux:
** [https://github.com/oracle/dtrace-linux-kernel DTrace patches merged with recent Linux kernel releases]
** [https://github.com/oracle/dtrace-utils Userspace portion of the DTrace port to Linux]
** [https://github.com/oracle/libdtrace-ctf Compact Type Format library used by DTrace on Linux]
* [https://blogs.oracle.com/linux/dtrace-on-fedora DTrace on Fedora]

{{Solaris}}
{{Oracle FOSS}}

[[Category:Command-line software]]
[[Category:Sun Microsystems software]]
[[Category:Free system software]]
[[Category:Debuggers]]
[[Category:Aspect-oriented programming]]
[[Category:Software using Common Development and Distribution License]]
[[Category:Linux kernel features]]