Ниже буде приведены однострочники для dtrace, которые можно использовать под Solaris/FreeBSD. Примеры взяты из книги по dtrace
CPU
Which processes are on-CPU?
dtrace -n 'profile-997hz { @[pid, execname] = count(); }'
Which processes are on-CPU, running user code?
dtrace -n 'profile-997hz /arg1/ { @[pid, execname] = count(); }'
What are the top user functions running on-CPU (%usr time)?
dtrace -n 'profile-997hz /arg1/ { @[execname, ufunc(arg1)] = count(); }'
What are the top kernel functions running on-CPU (%sys time)?
dtrace -n 'profile-997hz /arg0/ { @[func(arg0)] = count(); }'
What are the top five kernel stack traces on the CPU (shows why)?
dtrace -n 'profile-997hz { @[stack()] = count(); } END { trunc(@, 5); }'
What are the top five user stack traces on the CPU (shows why)?
dtrace -n 'profile-997hz { @[ustack()] = count(); } END { trunc(@, 5); }'
What threads are on-CPU, counted by their thread name (FreeBSD)?
dtrace -n 'profile-997 { @[stringof(curthread->td_name)] = count(); }'
What system calls are being executed by the CPUs?
dtrace -n 'syscall:::entry { @[probefunc] = count(); }'
Which processes are executing the most system calls?
dtrace -n 'syscall:::entry { @[pid, execname] = count(); }'
What system calls are a given process name executing (for example, firefox-bin)?
dtrace -n 'syscall:::entry /execname == "firefox-bin"/ { @[probefunc] = count(); }'
Memory
Tracking memory page faults by process name:
dtrace -n 'vminfo:::as_fault { @mem[execname] = sum(arg0); }'
Tracking pages paged in by process name:
dtrace -n 'vminfo:::pgpgin { @pg[execname] = sum(arg0); }'
Tracking pages paged out by process name:
dtrace -n 'vminfo:::pgpgout { @pg[execname] = sum(arg0); }'
Tracking process user stack sizes:
dtrace -n 'sched:::on-cpu { @[execname] = max(curthread->t_procp->p_stksize);}'
Tracking which processes are growing their address space heap segment:
dtrace -n 'fbt::brk:entry { @mem[execname] = count(); }'
Process allocation (via malloc()) counting requested size:
dtrace -n 'pid$target::malloc:entry { @[arg0] = count(); }' -p PID
Process allocation (via malloc()) requested size distribution plot:
dtrace -n 'pid$target::malloc:entry { @ = quantize(arg0); }' -p PID
Process allocation (via malloc()) by user stack trace and total requested size:
dtrace -n 'pid$target::malloc:entry { @[ustack()] = sum(arg0); }' -p PID
Process allocation (via malloc()) by Java stack trace and total requested size:
dtrace -n 'pid$target::malloc:entry { @[jstack()] = sum(arg0); }' -p PID
I/O
Which processes are executing common I/O system calls?
dtrace -n 'syscall::*read:entry,syscall::*write:entry { @rw[execname,probefunc] = count(); }'
Which file system types are targeted for reads and writes?
dtrace -n 'syscall::*read:entry,syscall::*write:entry { @fs[execname, probefunc,
fds[arg0].fi_fs] = count(); }'
Which files are being read, and by which processes?
dtrace -n 'syscall::*read:entry { @f[execname, fds[arg0].fi_pathname] = count(); }'
Which files are being written, and by which processes?
dtrace -n 'syscall::*write:entry { @f[execname, fds[arg0].fi_pathname] = count(); }'
Which processes are generating network I/O (Solaris)?
dtrace -n 'fbt:sockfs::entry { @[execname, probefunc] = count(); }'
Which processes are generating file system I/O (Solaris)?
dtrace -n 'fsinfo::: { @fs[execname, probefunc] = count(); }'
What is the rate of disk I/O being issued?
dtrace -n 'io:::start { @io = count(); } tick-1sec { printa("Disk I/Os per second: %@d
\n", @io); trunc(@io); }'
А так же можно использовать iotop, process_io_top, iosnoop из набора DTraceToolkit
