DTrace Destructive Actions

Some DTrace actions are destructive in that they change the state of the system in some well-defined way. Destructive actions may not be used unless they have been explicitly enabled. When using dtrace, you can enable destructive actions using the -w option. If an attempt is made to enable destructive actions in dtrace without explicitly enabling them, dtrace will fail with a message similar to the following example:

dtrace: failed to enable 'syscall': destructive actions not allowed

An administrator may choose to disable destructive actions system-wide by setting the kernel tunable dtrace_destructive_disallow to 1. This may be done in a number of ways including rebooting after adding the following line to /etc/system:

set dtrace:dtrace_destructive_disallow = 1

You can set the kernel tunable dtrace_destructive_disallow parameter by using the mdb utility. For more information about the mdb utility, see mdb(1).

# echo "dtrace_destructive_disallow/W 1" | mdb -kw
dtrace_destructive_disallow: 0x0 = 0x1