Tips and tricks on DTrace, ZFS, Zones and Solaris administration
One of the most useful (for me) options in DTrace is flowindent. All it does is indent the entry to each function with “->”, and mark the return from this function with “<-“. Doesn’t seem like much, does it? But just look at the results!
The following example catches all the probes of the fbt provided. By default (that’s our case since we’re not changing any other options but flowindent), DTrace registers and prints to the standard output all the probes matched in the tracing process.
One more variation of using DTrace allows to track which system calls are made from a certain process. Or do the same for lots of processes, if you use execname and not PIDs…
Such a command line will show you all system calls made by Xorg in the last 5 seconds:
solaris# dtrace -n 'syscall:::entry /execname == "Xorg"/ {@[probefunc] = count(); } tick-5sec {printa(@); clear(@);}'
dtrace: description 'syscall:::entry ' matched 227 probes
CPU ID FUNCTION:NAME
0 36588 :tick-5sec
writev 20
lwp_sigmask 38
setcontext 38
setitimer 75
read 422
pollsys 426
pS: some time later I’ll hopefully write more about what DTrace and D language are
I’m slowly getting used to seeing and using DTrace in my everyday work…
For example, here’s a start of the most basic analysis.
My setup: The system is constantly busy with something, and our task is to find what’s responsible for this. How? One of the possible solutions is to simply watch the system for a certain period of time (5 seconds in our case) to see what process makes most system calles… And it’s clearly seen now that the most active consumer of system calls is Java VM which happens to run a very complex graphics applet at this very moment.
Here are just some of the revolutionary changes introduced in Solaris 10:
DTrace allows you to dynamically trace anything and everything in real time. You can observe processes both in userland and kernel space, watch them as closely as you want and this all with virtually no performance impact. This allows DTrace to be used on a production system being absolutely sure it’s not going to considerably slow the system down or crash it.
I think it’s one of the best Solaris 10 innovations – all the administrators and developers will like it.
I’ve finally got some spare time to download a PEAR module for DTrace. What a great module! I’ve found a little problem with it, wrote a letter to Wez Furlong, and he immediately changed the source code to make it work even better. Thanks a lot, Wez! 🙂
So, here it is – my first PHP Dtrace script: php-scripts-snoop.d