Without a DTrace

Apple subvert an open source tool.

Get It Try It

Adam Leventhal's not happy with Apple right now. Adam's one of the three original authors of DTrace, the Sun Microsystems tracing facility from Solaris 10 Apple ported to OS X.

Apple introduced DTrace in 10.5 Leopard. The explanation at the Apple microsite says the following.

DTrace is a low level debugging and profiling facility for detailed monitoring of virtually any aspect of an application. Based on the Solaris Open Source project, this technology has been integrated by Apple into the Darwin kernel. In addition Java, Ruby, Python, and Perl have been extended to support DTrace, providing unprecedented access for monitoring the performance characteristics of those languages.

There's only one snag: it's not working properly - and that seems to be by design.

'As has been thoroughly recorded, Apple included DTrace in OS X. I've been using it as often as I have the opportunity, and it's a joy to be able to use the fruits of our labour on another operating system. But I hit a rather surprising case recently which led me to discover a serious problem with Apple's implementation', reports Adam.

What he discovered was that some processes never turned up when he ran simple 'tick probes'.

io:::start
{
    @[args[2]->fi_pathname] = count();
}

tick-10s
{
    trunc(@, 10);
    printa(@);
    trunc(@, 0);
}

Seeing a number of anomalies Adam finally realised his iTunes was nowhere to be seen.

'I let it run for a while, made iTunes do some work, and the result when I stopped the script? Nothing. The expensive DTrace invocation clearly caused iTunes to do a lot more work, but DTrace was giving me no output.'

'Which started me thinking... did they? Surely not. They wouldn't disable DTrace for certain applications.'

No?

#if defined(__APPLE__)

'But that's exactly what Apple's done with their DTrace implementation. The notion of true systemic tracing was a bit too egalitarian for their classist sensibilities so they added this glob of lard into dtrace_probe() - the heart of DTrace.'

#if defined(__APPLE__)
        /*
         * If the thread on which this probe has fired belongs to a process marked P_LNOATTACH
         * then this enabling is not permitted to observe it. Move along, nothing to see here.
         */
        if (ISSET(current_proc()->p_lflag, P_LNOATTACH)) {
            continue;
        }
#endif /* __APPLE__ */

'Wow', reports Adam. 'So Apple are explicitly preventing DTrace from examining or recording data for processes which don't permit tracing. This is antithetical to the notion of systemic tracing, antithetical to the goals of DTrace, and antithetical to the spirit of open source.'

Adam Leventhal is one of the original authors of DTrace. Adam joined the Solaris Kernel after graduating cum laude from Brown University in 2001 with his BSc in Math and Computer Science. In 2006 Adam and his DTrace colleagues were chosen Gold winners by a panel of judges representing industry as well as research and academic institutions in The Wall Street Journal's Technology Innovation Awards contest.

See Also
Adam Leventhal: OS X and the missing probes