Getting started with dtrace
Thoughts on developer tools.

Friday May 12, 2006

Getting started with dtrace

Vijay forwarded me an email from Eugene and here's what I wrote:

Eugene wrote:
I have a code and I'd like to figure out where the user code is
when brk is being called.  Can this be done with truss?  If it's
done with dtrace I need some serious handholding.  Canned
scripts (or whatever) would be nice since I need to resolve this
in a hurry.

Vijay wrote:
Eugene, this is a perfect opportunity to refer you to ChrisQ's blog:
http://blogs.sun.com/roller/page/quenelle/200503
This one talks about doing exactly the thing you are asking about

Here is what I recommend:

1. download/untar the DTrace toolkit

2. run this command to see the stacks of all places that call brk

./DTraceToolkit-0.96/Bin/dtruss -s -t brk /bin/ls

Unless you give yourself dtrace permissions in /etc/user_attr, you will need to be root to run dtrace. The toolkit has a bunch of scripts in it that do wonderful things. And all without knowing anything about dtrace.

I went ahead and fiddled with dtrace for a bit, and here's what I came up with:

% dtrace -n 'pid$target::sbrk:entry { @num[ustack()] = count()}' -c "find /usr -name 'xyzzy'"

dtrace: description 'pid$target::sbrk:entry ' matched 1 probe
^C
dtrace: pid 17201 terminated by SIGINT

              libc.so.1`sbrk
              libc.so.1`_morecore+0x24
              libc.so.1`_malloc_unlocked+0x1fc
              libc.so.1`_smalloc+0x4c
              libc.so.1`malloc+0x4c
              libc.so.1`calloc+0x58
              libc.so.1`textdomain+0x38
              find`main+0x1c
              find`_start+0x108
                1

              libc.so.1`_morecore+0xdc
              libc.so.1`_malloc_unlocked+0x1fc
              libc.so.1`_smalloc+0x4c
              libc.so.1`malloc+0x4c
              libc.so.1`calloc+0x58
              libc.so.1`textdomain+0x38
              find`main+0x1c
              find`_start+0x108
                1

The number after each stack shows the number of times that stack trace was encountered.

Oh yeah. Did I tell you how much I hate the wysiwyg editor I'm using in Roller? Of course, once I get the content in the little box, it's too much trouble to change editors. I took me almost as long to get the preformatted text right as to write the email, figure out the script and write the rest of this blog.

Silly me. I forgot about using Xinha! It's in my firefox, but I forgot all about it.  I'm using it to add this last paragraph, and it's working fine.