DTrace

DTrace is a dynamic tracing framework originally developed by Sun Microsystems for the Solaris operating system. It provides safe, non-intrusive instrumentation of kernel and user-space code, enabling detailed visibility into system behavior without requiring source modification or recompilation.

At its core, DTrace consists of probes emitted by providers, a scripting language called D used to describe the data to collect and actions to perform, and a runtime engine that coordinates probe activation and data collection. Probes can be placed in kernel or user-space code and can be enabled or disabled at runtime, with overhead designed to be minimal when inactive.

Probes are grouped into providers such as syscall (system calls), fbt (function boundary tracing), and pid (process-specific instrumentation); some platforms also expose io, profile, and sched providers. The D language lets scripts specify probe patterns, variables, and aggregations; common actions include printing values, aggregating counts, or collecting stack traces.

Data collected by DTrace is streamed to the consumer tools or written to buffers for analysis. The toolkit includes the dtrace command-line utility and a library of ready-made scripts; users can build custom probes to diagnose latency, contention, or failure modes.

Originating with Solaris and later ported to other Unix-like systems, DTrace has been developed in open-source initiatives and commercial offerings. It is available on Solaris-derived systems such as Illumos, and on macOS, FreeBSD, and some Linux distributions. Its design emphasizes safety, with a decoupled kernel and user-space runtime that enforces checks before enabling probes.

Applications include troubleshooting complex performance problems, validating hypotheses about software behavior, and gaining insight into system-wide interactions. DTrace remains a widely cited framework for dynamic instrumentation and performance analysis, continued through ongoing ports and community-developed tooling.