How it works
Process probes
The proc provider exposes lifecycle events; use it to identify exec and exit activity, then narrow by executable or PID.
User-level probes
The pid provider can instrument user functions where symbols and privileges permit. Provider names and probe descriptions should be discovered on the target.
Stack frames need context
An unresolved ustack() is not proof that the application lacks symbols; ASLR, optimized builds and missing debug information all affect readability.
Worked examples
Each example explains the question it answers, a reproducible starting point, what to look for, and operational precautions.
1. Process start observation
Watch successful execs.
proc:::exec-success
{
@execs[execname] = count();
}Interpretation: Use a short window to detect restart loops and scheduled task bursts.
Operational note: Run commands in a test environment first; confirm device names, privileges and release-specific options.
2. Find probes for a running program
Explore available process-specific tracing.
dtrace -l -p 1234 | head -80Interpretation: Look for the `pid1234` provider and functions with useful symbols.
Operational note: Run commands in a test environment first; confirm device names, privileges and release-specific options.
3. Sample user stacks for one program
Find frequently active user code.
profile-97 /pid == $target/ { @[ustack()] = count(); }Interpretation: Run `dtrace -n ... -p 1234` or a saved script with `-p`.
Operational note: Run commands in a test environment first; confirm device names, privileges and release-specific options.
4. System call profile of one process
Find syscall mix without logging every event.
syscall:::entry /pid == $target/ { @[probefunc] = count(); }Interpretation: Group by syscall name; use the resulting hotspots to decide next traces.
Operational note: Run commands in a test environment first; confirm device names, privileges and release-specific options.
Before you finish
- Do not instrument sensitive production processes without authorization.
Primary documentation
Read the relevant Oracle documentation for exact version-specific flags, supported platforms and limitations: Oracle primary reference ↗.
This field manual is independent, not affiliated with or endorsed by Oracle. Command examples should be adapted to your environment.