[Level 2] ZFS and DTrace in Mac.

My friend who use Mac OS X, and told me that the Mac OS X support ZFS and DTrace. It surprises me! ZFS and DTrace is the new feature of Solaris 10, of course, OpenSolaris also has these two features, too. So I try the ZFS and DTrace on Mac immediately.
After test, I have the two following conclusions.
1. Mac support ZFS but for read only, so Mac cannot modify ZFS. That's so pity. The primary reason that I love ZFS just because I can have snapshot, clone. Readonly, is not the impression that I know about ZFS.
2. In OpenSolaris, it has over 60K probes(use command to check how many probes your system has, "/usr/sbin/dtrace -l | wc -l"), so I can detect the system behavior. But when I use the command, I found out the Mac OS only have just over 20K probes, just the 1/3 of OpenSolaris. And I try the D-script, it does work. That's a good gift that all Mac fans should to cherish. Really, because DTrace can be used for online debug, performance and you do not need to modify the source ( Sometimes, even we don't have!! ).
The following sample code is the D-script that exists in OpenSolaris, and to let Mac can run it, I modify the probe name from "open64" to "open" in the script. That you can try it on your Mac. Please save the source code on /tmp/opensnoop and use the following command to detect what processes are opening the file.

# /tmp/opensnoop

********************************************************************************************************

#!/usr/bin/sh

#

# opensnoop - snoop file opens as they occur.

# Written using DTrace (Solaris 10 3/05).

#

# $Id: opensnoop 3 2007-08-01 10:50:08Z brendan $

#

# USAGE: opensnoop [-a|-A|-ceghsvxZ] [-f pathname] [-n name] [-p PID]

#

# opensnoop # default output

#

# -a # print most data

# -A # dump all data, space delimited

# -c # print cwd of process

# -e # print errno value

# -g # print command arguments

# -s # print start time, us

# -v # print start time, string

# -x # only print failed opens

# -Z # print zonename

# -f pathname # file pathname to snoop

# -n name # command name to snoop

# -p PID # process ID to snoop

# eg,

# opensnoop -v # human readable timestamps

# opensnoop -e # see error codes

# opensnoop -f /etc/passwd # snoop this file only

#

# FIELDS:

# ZONE Zone name

# UID User ID

# PID Process ID

# PPID Parent Process ID

# FD file descriptor (-1 for error)

# ERR errno value (see /usr/include/sys/errno.h)

# CWD print current working directory of process

# PATH pathname for file open

# COMM command name for the process

# ARGS argument listing for the process

# TIME timestamp for the open event, us

# STRTIME timestamp for the open event, string

#

# SEE ALSO: truss, BSM auditing.

#

# COPYRIGHT: Copyright (c) 2006 Brendan Gregg.

#

# CDDL HEADER START

#

# The contents of this file are subject to the terms of the

# Common Development and Distribution License, Version 1.0 only

# (the "License"). You may not use this file except in compliance

# with the License.

#

# You can obtain a copy of the license at Docs/cddl1.txt

# or http://www.opensolaris.org/os/licensing.

# See the License for the specific language governing permissions

# and limitations under the License.

#

# CDDL HEADER END

#

# Author: Brendan Gregg [Sydney, Australia]

#

# 09-May-2004 Brendan Gregg Created this.

# 21-Jan-2005 " " Wrapped in sh to provide options.

# 08-May-2005 " " Rewritten for performance.

# 14-May-2005 " " Added errno.

# 28-Jun-2005 " " Added cwd, zonename.

# 17-Sep-2005 " " Increased switchrate, fixed page fault bug.

# 16-Jan-2006 " " Added -n, -p.

# 16-Jan-2006 " " Last update.

#

##############################

# --- Process Arguments ---

#

### Default variables

opt_dump=0; opt_file=0; opt_time=0; opt_timestr=0; opt_args=0

opt_zone=0; opt_cwd=0; opt_failonly=0; opt_err=0; filter=0; pathname=.

opt_name=0; opt_pid=0; pname=.; pid=0

### Process options

while getopts aAcef:ghn:p:svxZ name

do

case $name in

a) opt_time=1; opt_timestr=1; opt_args=1; opt_err=1 ;;

A) opt_dump=1 ;;

c) opt_cwd=1 ;;

e) opt_err=1 ;;

g) opt_args=1 ;;

f) opt_file=1; pathname=$OPTARG ;;

n) opt_name=1; pname=$OPTARG ;;

p) opt_pid=1; pid=$OPTARG ;;

s) opt_time=1 ;;

v) opt_timestr=1 ;;

x) opt_failonly=1 ;;

Z) opt_zone=1 ;;

h|?) cat <<-END >&2

USAGE: opensnoop [-a|-A|-ceghsvxZ] [-f pathname]

[-n name] [-p PID]

opensnoop # default output

-a # print most data

-A # dump all data, space delimited

-c # print cwd of process

-e # print errno value

-g # print command arguments

-s # print start time, us

-v # print start time, string

-x # only print failed opens

-Z # print zonename

-f pathname # pathname name to snoop

-n name # process name to snoop

-p PID # process ID to snoop

eg,

opensnoop -v # human readable timestamps

opensnoop -e # see error codes

opensnoop -f /etc/motd # snoop this file only

END

exit 1

esac

done

### Option logic

if [ $opt_dump -eq 1 ]; then

opt_zone=0; opt_cwd=0; opt_time=0; opt_timestr=0; opt_args=2

fi

if [ $opt_name -eq 1 -o $opt_pid -eq 1 ]; then

filter=1

fi

#################################

# --- Main Program, DTrace ---

#

/usr/sbin/dtrace -n '

/*

* Command line arguments

*/

inline int OPT_dump = '$opt_dump';

inline int OPT_file = '$opt_file';

inline int OPT_args = '$opt_args';

inline int OPT_cwd = '$opt_cwd';

inline int OPT_err = '$opt_err';

inline int OPT_zone = '$opt_zone';

inline int OPT_time = '$opt_time';

inline int OPT_timestr = '$opt_timestr';

inline int OPT_failonly = '$opt_failonly';

inline int OPT_pid = '$opt_pid';

inline int OPT_name = '$opt_name';

inline int FILTER = '$filter';

inline int PID = '$pid';

inline string PATHNAME = "'$pathname'";

inline string NAME = "'$pname'";

#pragma D option quiet

#pragma D option switchrate=10hz

/*

* Print header

*/

dtrace:::BEGIN

{

/*

* ternary operators are used to improve performance.

* OPT_args is unusual in that it can have one of three values.

*/

/* print optional headers */

OPT_time ? printf("%-14s ", "TIME") : 1;

OPT_timestr ? printf("%-20s ", "STRTIME") : 1;

OPT_zone ? printf("%-10s ", "ZONE") : 1;

/* print dump headers */

OPT_dump ? printf("%s %s %s %s %s %s %s %s %s %s %s", "ZONE",

"TIME", "UID", "PID", "PPID", "COMM", "FD", "ERR", "CWD",

"PATH", "ARGS") : printf("%5s %6s ","UID","PID");

/* print main headers */

OPT_args == 0 ? printf("%-12s ", "COMM") : 1;

OPT_dump == 0 ? printf("%3s ", "FD") : 1;

OPT_err ? printf("%3s ", "ERR") : 1;

OPT_cwd ? printf("%-20s ", "CWD") : 1;

OPT_dump == 0 ? printf("%-20s ", "PATH") : 1;

OPT_args == 1 ? printf("%s", "ARGS") : 1;

printf("\n");

}

/*

* Print open event

*/

syscall::open:entry, syscall::open:entry

{

/* save pathname */

self->pathp = arg0;

/* default is to trace unless filtering */

self->ok = FILTER ? 0 : 1;

/* check each filter */

(OPT_name == 1 && NAME == execname) ? self->ok = 1 : 1;

(OPT_pid == 1 && PID == pid) ? self->ok = 1 : 1;

/* OPT_file is checked on return to ensure pathp is mapped */

}

syscall::open:return, syscall::open:return

/self->ok && (! OPT_failonly || (int)arg0 < 0) && ((OPT_file == 0) || (OPT_file == 1 && PATHNAME == copyinstr(self->pathp)))/

{

/* print optional fields */

OPT_time ? printf("%-14d ", timestamp/1000) : 1;

OPT_timestr ? printf("%-20Y ", walltimestamp) : 1;

OPT_zone ? printf("%-10s ", zonename) : 1;

/* print dump fields */

OPT_dump ? printf("%s %d %d %d %d %s %d %d %s %s %S", zonename,

timestamp/1000, uid, pid, ppid, execname, (int)arg0, errno,

cwd, copyinstr(self->pathp), curpsinfo->pr_psargs) :

printf("%5d %6d ", uid, pid);

/* print main fields */

OPT_args == 0 ? printf("%-12s ", execname) : 1;

OPT_dump == 0 ? printf("%3d ", (int)arg0) : 1;

OPT_err ? printf("%3d ", errno) : 1;

OPT_cwd ? printf("%-20s ", cwd) : 1;

OPT_dump == 0 ? printf("%-20s ", copyinstr(self->pathp)) : 1;

OPT_args == 1 ? printf("%S", curpsinfo->pr_psargs) : 1;

printf("\n");

/* cleanup */

self->pathp = 0;

self->ok = 0;

}

/*

* Cleanup

*/

syscall::open:return, syscall::open:return

/self->ok/

{

self->pathp = 0;

self->ok = 0;

}

'