Clearing Aggregations

When using DTrace to build simple monitoring scripts, you can periodically clear the values in an aggregation using the clear() function. This function takes an aggregation as its only parameter. The clear() function clears only the aggregation's values; the aggregation's keys are retained. Therefore, the presence of a key in an aggregation that has an associated value of zero indicates that the key had a non-zero value that was subsequently set to zero as part of a clear(). To discard both an aggregation's values and its keys, use the trunc(). See Truncating aggregations for details.

The following example adds clear() to Example 9-1:

#pragma D option quiet

BEGIN
{
    last = timestamp;
}

syscall:::entry
{
    @func[execname] = count();
}

tick-10sec
{
    normalize(@func, (timestamp - last) / 1000000000);
    printa(@func);
    clear(@func);
    last = timestamp;
}

While Example 9-1 shows the system call rate over the lifetime of the dtrace invocation, the preceding example shows the system call rate only for the most recent ten-second period.