DTrace Destructive Actions
Some DTrace actions are destructive in that they change the state of the system in some well-defined way. Destructive actions may not be used unless they have been explicitly enabled. When using dtrace
, you can enable destructive actions using the -w
option. If an attempt is made to enable destructive actions in dtrace
without explicitly enabling them, dtrace
will fail with a message similar to the following example:
dtrace: failed to enable 'syscall': destructive actions not allowed
An administrator may choose to disable destructive actions system-wide by setting the kernel tunable dtrace_destructive_disallow
to 1
. This may be done in a number of ways including rebooting after adding the following line to /etc/system
:
set dtrace:dtrace_destructive_disallow = 1
You can set the kernel tunable dtrace_destructive_disallow
parameter by using the mdb
utility. For more information about the mdb
utility, see mdb
(1).
# echo "dtrace_destructive_disallow/W 1" | mdb -kw
dtrace_destructive_disallow: 0x0 = 0x1