For some problems, you might wish to use a single in-kernel buffer. While this approach can be implemented with the switch policy and appropriate D constructs by incrementing a variable in D and predicating an exit action appropriately, such an implementation does not eliminate the possibility of drops. To request a single, large in-kernel buffer, and continue tracing until one or more of the per-CPU buffers has filled, use the fill buffer policy. Under this policy, tracing continues until an enabled probe attempts to trace more data than can fit in the remaining principal buffer space. When insufficient space remains, the buffer is marked as filled and the consumer is notified that at least one of its per-CPU buffers has filled. Once dtrace(1M) detects a single filled buffer, tracing is stopped, all buffers are processed and dtrace exits. No further data will be traced to a filled buffer even if the data would fit in the buffer.
To use the fill policy, set the bufpolicy option to fill. For example, the following command traces every system call entry into a per-CPU 2K buffer with the buffer policy set to fill:
# dtrace -n syscall:::entry -b 2k -x bufpolicy=fill