3.6 Truncating Aggregations

When looking at aggregation results, you often care only about the top several results. The keys and values associated with anything other than the highest values are not interesting. You might also wish to discard an entire aggregation result, removing both keys and values. The DTrace trunc function is used for both of these situations.

The parameters to trunc are an aggregation and an optional truncation value. Without the truncation value, trunc discards both aggregation values and aggregation keys for the entire aggregation. When a truncation value n is present, trunc discards aggregation values and keys except for those values and keys associated with the highest n values. That is, trunc(@foo, 10) truncates the aggregation named foo after the top ten values, where trunc(@foo) discards the entire aggregation. The entire aggregation is also discarded if 0 is specified as the truncation value.

To see the bottom n values instead of the top n, specify a negative truncation value to trunc. For example, trunc(@foo, -10) truncates the aggregation named foo after the bottom ten values.

The following example displays only the per-second system call rates of the top ten system-calling applications in a ten-second period:

#pragma D option quiet

  last = timestamp;

  @func[execname] = count();

  trunc(@func, 10);
  normalize(@func, (timestamp - last) / 1000000000);
  last = timestamp;

The following example shows the output from running the previous script on a lightly loaded laptop:

# dtrace -s truncagg.d 
  memballoon                                                        4
  rtkit-daemon                                                      6
  vmstats                                                           8
  automount                                                        12
  udisks-daemon                                                    12
  gnome-panel                                                      20
  gnome-settings-                                                  28
  gvfs-afc-volume                                                  30
  metacity                                                         30
  qpidd                                                            34
  hald                                                             38
  gnome-terminal                                                   54
  hald-addon-inpu                                                 183
  VBoxClient                                                      240
  Xorg                                                            354
  X11-NOTIFY                                                      476
  java                                                            666
  dtrace                                                         1655
  sh                                                           167108
  date                                                         312258