Dtrace snippets for observing the syscall interaction.

measure-opens-and-closes.d

dtrace -qn '
/* Result is a CSV with three columns: 
1) path,
2) count of open(s) without matching close(s) 
3) number of times opened*/
int self fd[int];
string self path;
BEGIN {
start = timestamp;
}
syscall::open64:entry,syscall::open:entry /arg0 != NULL/ {
  self->path = copyinstr(arg0);
}
syscall::open64:return,syscall::open:return /self->path != ""/ {
  self->fd[arg1] = 1;
  @hndl[self->path] = sum(1);
  @opens[self->path] = count();
}
syscall::close:entry /self->fd[arg0] > 0 && self->path != ""/ {
  @hndl[self->path] = sum(-1);
  self->path = 0;
  self->fd[arg0] = 0;
}
END {
  this->runt = (timestamp - start) / 1000000000;
  printa("%s,%@d,%@d\n", @hndl, @opens);
  printf("Ran for %d seconds\n", this->runt);
}'

pread+pwrite-iops.d

dtrace -qn '
/* 
  Run command with single argument, which is name of executable
  doing IO, for example, "fio".
*/
    BEGIN {
        ops["pwrite64"] = 0;
        ops["pwrite"] = 0;
        ops["pread64"] = 0;
        ops["pread"] = 0;
        ops["write"] = 0;
    }
    syscall::pread64:entry, syscall::pread:entry,
    syscall::pwrite64:entry, syscall::pwrite:entry,
    syscall::read:entry, syscall::write:entry
    /execname == $$1/ {
        ops[probefunc] += 1;  
    }
    tick-1sec {
        sum_rd = ops["pread64"] + ops["pread"] + ops["read"];
        sum_wr = ops["pwrite64"] + ops["pwrite"] + ops["write"];
        printf("WRITE IOPs: %d READ IOPs: %d\n", sum_wr, sum_rd);
        /* zero out and start this exercise over */
        ops["pwrite64"] = 0;
        ops["pwrite"] = 0;
        ops["pread64"] = 0;
        ops["pread"] = 0;
        ops["write"] = 0;
        ops["read"] = 0;
    }' fio

syscall-counts.d

// Count number of system calls over period of 5 seconds, then reset and repeat.
dtrace -qn 'BEGIN {cnt = 0} syscall:::entry {cnt++} tick-5sec {printf("%Y,%d\n", walltimestamp, cnt); cnt =0; }'

write-syscalls.d

#!/usr/sbin/dtrace -qs
#pragma D option quiet

/* Traces all write system calls executed by $1 input argument. */
/* INPUTS: $1 is the name of the process to trace
*/

BEGIN /* The BEGIN probe fires once when tracing starts */
{
printf("%Y: %s BEGIN\n", walltimestamp, $0);
}

syscall::write:entry
/pid != $pid && (execname == $$1 || ($$1 == "" && execname !=
"dtrace"))/
{
self->desc = arg0; /* file descriptor passed to write() */
self->bufp = arg1; /* buffer pointer passed to write() */
self->size = arg2; /* size, in bytes passed to write() */
}

syscall::write:return
/pid != $pid && (execname == $$1 || ($$1 == "" && execname !=
"dtrace"))/
{
printf("%Y: ", walltimestamp);

printf("%s(PID:%d) called %s(rc=%d, errno=%d) with fd=%d, size=
%d, and \nbuf=\"%s\"\n\n",
execname, pid, probefunc, arg0, errno, self->desc,
self->size, stringof(copyin(self->bufp, self->size)));

self->desc = 0;
self->bufp = 0;
self->size = 0;
}

END /* The END probe fires once when tracing is completed */
{
printf("%Y: %s END\n", walltimestamp, $0);
}