When looking at aggregation results, you often care only about the
top several results. The keys and values that are associated with
anything other than the highest values are not of interest. You
might also choose to discard an entire aggregation result,
removing both the keys and values. The DTrace
trunc
function is used in both of these
situations.
The parameters to trunc
are an aggregation and
an optional truncation value. Without the truncation value,
trunc
discards both the aggregation values and
the aggregation keys for the entire aggregation. When a truncation
value n
is present,
trunc
discards the aggregation values and keys,
except for those values and keys that are associated with the
highest n
values. That is to say,
trunc(@foo, 10)
truncates the aggregation named
foo
after the top ten values, where
trunc(@foo)
discards the entire aggregation.
The entire aggregation is also discarded if 0
is specified as the truncation value.
To see the bottom n
values instead of
the top n
values, specify a negative
truncation value to trunc
. For example,
trunc(@foo, -10)
truncates the aggregation
named foo
after the bottom ten values.
The following example displays only the per-second system call rates of the top ten system-calling applications in a ten-second period:
#pragma D option quiet BEGIN { last = timestamp; } syscall:::entry { @func[execname] = count(); } tick-10sec { trunc(@func, 10); normalize(@func, (timestamp - last) / 1000000000); printa(@func); clear(@func); last = timestamp; }
The following example shows the output from running the previous script on a lightly loaded system:
#dtrace -s truncagg.d
dbus-daemon 0 NetworkManager 1 gmain 1 systemd-logind 1 sendmail 1 systemd 1 httpd 2 tuned 5 dtrace 44 rpcbind 0 dbus-daemon 0 gmain 0 sshd 1 systemd-logind 1 sendmail 1 systemd 1 httpd 2 tuned 5 dtrace 41 dbus-daemon 0 gmain 1 sshd 1 systemd-logind 1 sendmail 1 systemd 1 httpd 2 tuned 5 automount 7 dtrace 41^C
#