introduction to dtrace

Introduction to dtrace

1. Introduction to DTrace With a view of using it with Ruby 2.0 Monday, 18 March 13
2. What is DTrace • It is a sampling profiler. • Works on Solaris, Mac OSX, *BSD and Oracle Linux. Monday, 18 March 13
3. Sampling profiler? • A sampling profiler probes the target program's program counter at regular intervals using operating system interrupts. Sampling profiles are typically less numerically accurate and specific, but allow the target program to run at near full speed. Monday, 18 March 13
4. Monday, 18 March 13
5. Advantages • Low overhead. • When turned off zero overhead. • No compilatin flags necessary. Monday, 18 March 13
6. Show me the probes ~> dtrace -l | more Monday, 18 March 13
7. Anatomy of a Probe • ID - Internal ID of the probe listed. • Provider - Name of the Provider. Providers are used to classify the probes. This is also the method of instrumentation. • Module - The name of the Unix module or application library of the probe • Function - The name of the function in which the probe exists. • Name - The name of the probe.(entry, return) Monday, 18 March 13
8. Monday, 18 March 13
9. Exploring existing probes ~> sudo dtrace -l -P syscall ~> sudo dtrace -l -f open ~> sudo dtrace -l -m mach_kernel Monday, 18 March 13
10. Show me the Ruby probes • You must already have a program already running in target runtime. • ~> sudo dtrace -l -P ruby* Monday, 18 March 13
11. Process ID Monday, 18 March 13
12. Running a Probe • from command line • Or as a script Monday, 18 March 13
13. Few example probes ~> sudo dtrace -f open ~> sudo dtrace -P syscall -f write Monday, 18 March 13
14. D Programming Language • A subset of C and closer to awk etc. Can we run as scripts. Monday, 18 March 13
15. Goal Print all system calls a program is making Monday, 18 March 13
16. Using D script language /* * Probe when any function is entered within syscall provider */ syscall:::entry { ! printf("%s(%d) called %s\n", execname, pid, probefunc); } Monday, 18 March 13
17. Run it Monday, 18 March 13
18. probe description /predicate/ { action; } Monday, 18 March 13
19. Probe description • provider:module:function:name • Example: syscall:::entry syscall::write:entry • You can use wild cards such as ? or * Monday, 18 March 13
20. /* * Probe when any function is entered within syscall provider */ syscall:::entry { ! printf("%s(%d) called %s\n", execname, pid, probefunc); } Probe description Monday, 18 March 13
21. /* * Probe when any function is entered within syscall provider */ syscall:::entry { ! printf("%s(%d) called %s\n", execname, pid, probefunc); } Monday, 18 March 13
22. Script variables 1. execname - Name of current process 2. probeprov - Name of the provider 3. probemod - Name of the module 4. probefunc - Name of the function 5. probename - Name of the probe 6. arg0,....arg9 - Memory location of 10 arguments that the function took 7. cpu - CPU identifier 8. tid - Thread identifier Monday, 18 March 13
23. Script Variables 1.cwd - Name of current working Directory 2.uid - User ID 3.gid - group ID 4.pid - Process ID 5.walltimestamp - Current Timestamp 6.errorno 7.stackdepth Monday, 18 March 13
24. Action /* * Probe when any function is entered within syscall provider */ syscall:::entry { ! printf("%s(%d) called %s\n", execname, pid, probefunc); } Monday, 18 March 13
25. Goal • Print system calls being made by currently running Java Program. Monday, 18 March 13
26. only_java.d syscall:::entry /execname=="java"/ { ! printf("%s(%d) called %s\n", execname, pid, probefunc); } Monday, 18 March 13
27. syscall:::entry /execname=="java"/ { ! printf("%s(%d) called %s\n", execname, pid, probefunc); } Predicate Monday, 18 March 13
28. Goal • Print number of total bytes written by all currently running programs Monday, 18 March 13
29. total_bytes.d /* * Probe when any function is entered within syscall provider */ syscall::write:entry { @bytes_written[execname] = sum(arg2); } END { printa(@bytes_written); } Monday, 18 March 13
30. total_bytes.d /* * Probe when any function is entered within syscall provider */ syscall::write:entry { @bytes_written[execname] = sum(arg2); } END { printa(@bytes_written); } Monday, 18 March 13
31. Aggregate Syntax @name[key] = aggregate_function(expression) aggregate_function = count() sum(expression) min(expression) max(expression) avg(expression) quantize(expression) Monday, 18 March 13
32. Makes sense? /* * Probe when any function is entered within syscall provider */ syscall::write:entry { @bytes_written[execname] = sum(arg2); } END { printa(@bytes_written); } Monday, 18 March 13
33. Output formatting • printf() more or less same as C version. • printa() aggregate formatting • trace() • https://wikis.oracle.com/display/DTrace/Output +Formatting Monday, 18 March 13
34. aggregate variables • @name • self->ts[key] = aggregate_function(expression) Thread safe Monday, 18 March 13
35. END Probe /* * Probe when any function is entered within syscall provider */ syscall::write:entry { @bytes_written[execname] = sum(arg2); } END { printa(@bytes_written); } Wont fire Monday, 18 March 13
36. copyinstr • Copy in string • man copyinstr Monday, 18 March 13
37. Goal • Print all class instances(with their count) created by currently running Ruby program. Monday, 18 March 13
38. count.d ruby*:::object-create { @objects[copyinstr(arg0)] = count(); } Monday, 18 March 13
39. Monday, 18 March 13
40. Go forth and explore • http://www.codemancers.com/blog • You should follow me on twitter, @gnufied Monday, 18 March 13