JavaScript is required to for searching.
Skip Navigation Links
Exit Print View
DTrace User Guide
search filter icon
search icon

Document Information


1.  Introduction

2.  DTrace Basics

Listing Probes

Specifying Probes in DTrace

Enabling Probes

DTrace Action Basics

Data Recording Actions

The trace() function

The tracemem() function

The printf() function

The printa() function

The stack() function

The ustack() function

The jstack() function

Destructive Actions

Process Destructive Actions

The stop() function

The raise() function

The copyout() function

The copyoutstr() function

The system() function

Kernel Destructive Actions

The breakpoint() function

The panic() function

The chill() function

DTrace Aggregations

DTrace Aggregation Syntax

3.  Scripting With the D Language

4.  Using DTrace


DTrace Aggregations

For performance-related questions, aggregated data is often more useful than individual data points. DTrace provides several built-in aggregating functions. When an aggregating function is applied to subsets of a collection of data, then applied again to the results of the analysis of those subsets, the results are identical to the results returned by the aggregating function when it is applied to the collection as a whole.

The DTrace facility stores a running count of data items for aggregations. The aggregating functions store only the current intermediate result and the new element that the function is being applied to. The intermediate results are allocated on a per-CPU basis. Because this allocation scheme does not require locks, the implementation is inherently scalable.

DTrace Aggregation Syntax

A DTrace aggregation takes the following general form:

@name[ keys ] = aggfunc( args );

In this general form, the variables are defined as follows:


The name of the aggregation, preceded by the @ character.


A comma-separated list of D expressions.


One of the DTrace aggregating functions.


A comma-separated list of arguments appropriate to the aggregating function.

Table 2-1 DTrace Aggregating Functions

Function Name
The number of times that the count function is called.
scalar expression
The total value of the specified expressions.
scalar expression
The arithmetic average of the specified expressions.
scalar expression
The smallest value among the specified expressions.
scalar expression
The largest value among the specified expressions.
scalar expression, lower bound, upper bound, step value
A linear frequency distribution of the values of the specified expressions that is sized by the specified range. This aggregating function increments the value in the highest bucket that is less than the specified expression.
scalar expression
A power-of-two frequency distribution of the values of the specified expressions. This aggregating function increments the value in the highest power-of-two bucket that is less than the specified expression.

Example 2-14 Using an Aggregating Function

This example uses the count aggregating function to count the number of write(2) system calls per process. The aggregation does not output any data until the dtrace command is terminated. The output data represents a summary of the data collected during the time that the dtrace command was active.

# cat writes.d
#!/usr/sbin/dtrace -s
{   @numWrites[execname] = count();

# ./writes.d
dtrace: script 'writes.d' matched 1 probe
  dtrace                           1
  date                             1
  bash                             3
  grep                            20
  file                           197
  ls                             201