Hacker News Reader

Hacker News

Comment by _kp6z | Hacker News Reader

Full thread

_kp6z

If you think strace is useful, wait until you try dtrace.

View on HN

or systemtap https://sourceware.org/systemtap/ or ktap http://www.ktap.org/doc/tutorial.html for GNU/Linux

or LTTng with both kernel and userspace tracers http://lttng.org

Disclaimer: LTTng developer :)

I was thinking that too. It is my humble opinion that dtrace will knock strace out of its socks.

I find that strace (or dtruss) is more useful when you know less about what exactly you're trying to find. A log of syscalls is often exactly the right granularity to find out the gist of what a process you didn't write is trying (and failing) to do.

So I think the comparison, despite the superficial similarity and similar mechanism of action, isn't really fair.

dtrace is cool, and it benefits from source instrumentation (probes).

strace / dtruss just spit out kernel syscalls of any user land program wo modifications.

Also dtrace, as seen on smartos

while we wait, could you elaborate on that? ;)

strace shows syscalls -- it's effectively truss.

That's useful and all, but what if you want to instrument arbitrary parts of a program, not just the syscall interface? By function or instruction? Either in userspace or in kernel? With statistical functions? And speculative tracing? And extensive control flow (except loops, which prevent certain safely guarantees DTrace makes). And a lot more.

Don't be fooled by the single-letter change: strace is to DTrace what edlin is to emacs. Or something else ridiculously extreme. They're barely comparable.

Still doesn't tell me what dtrace does.

Read this: http://blog.bignerdranch.com/1907-hooked-on-dtrace-part-1/

Or you could just give a concise definition:

    >What is this "DTrace" thing? It stands for "Dynamic Tracing",
    >a way you can attach "probes" to a running system
    >and peek inside as to what it is doing.

It was my mistake to link you to a tutorial on the thing you are asking about. I don't know what came over me.

It's like awk, except that you match entry/exit of syscalls, function calls, method invocations (in ObjC/Java), and give code to execute with access to arguments, return values, stack trace, etc.

It can be used to write tools like strace (see "dtruss" on OSX), iotop, topsyscall, etc.

On Mac OS X, the way to get an idea of what dtrace can do is "apropos dtrace". That shows you the dtrace scripts that the OS ships with.

Thanks! It looks as though by default strace isn't available on Mac but dtrace is!

Reply on news.ycombinator.com