3.3.4 Using the stddev Function

Meanwhile, you can use the stddev aggregating function to characterize the distribution of data points. The following example shows the average and standard deviation of the time that it takes to exec processes. Save it in a file named stddev.d:

syscall::execve:entry
{
 self->ts = timestamp;
}

syscall::execve:return
/ self->ts /
{
  t = timestamp - self->ts;
  @execavg[probefunc] = avg(t);
  @execsd[probefunc] = stddev(t);
  self->ts = 0;
}

END
{
  printf("AVERAGE:");
  printa(@execavg);
  printf("\nSTDDEV:");
  printa(@execsd);
}

The sample output is as follows:

# dtrace -q -s stddev.d
^C
AVERAGE:
  execve                                                       253839

STDDEV:
  execve                                                       260226
Note

The standard deviation is approximated as √((Σ(x2)/N)-(Σx/N)2), which is an imprecise approximation, but should suffice for most purposes to which DTrace is put.