process syscall details

Process syscall details. Uses DTrace. dtruss [-acdeflhoLs] [-t syscall] { -p PID | -n name | command } Outputs details on process system calls like truss and less intrusive.

Especially interesting are elapsed and cpu times which identify calls that are slow or consume excessive CPU cycles.

Root privileges are requiured.

-a all details
-b bufsize Increase if you dynamic variable drop errors. Default "4m" (4 megabytes) per CPU.
-c Output system call counts
-d Output relative timestamps, µs
-e Output elapsed times, µs
-f follow children as forked
-l output of pid/lwpid per line
-L Don't output pid/lwpid per line
-n name examine name
-W name wait for name
-o Output cpu times, µs
-s Output stack backtraces
-p PID examine PID
-t syscall examine syscall only


Mac OS:
dtrace: system integrity protection is on, some features will not be available
dtrace: failed to execute df: Operation not permitted


Run and examine "df -h": dtruss df -h

Examine PID 1871: dtruss -p 1871

Examine all processes called "tar": dtruss -n tar

Run test.sh and follow children: dtruss -f test.sh

run "date" and output elapsed and cpu times: dtruss -eo date

USAGE: dtruss [-acdefholLs] [-t syscall] { -p PID | -n name | command | -W name }

          -p PID          # examine this PID
          -n name         # examine this process name
          -t syscall      # examine this syscall only
          -W name         # wait for a process matching this name
          -a              # print all details
          -c              # print syscall counts
          -d              # print relative times (us)
          -e              # print elapsed times (us)
          -f              # follow children
          -l              # force printing pid/lwpid
          -o              # print on cpu times
          -s              # print stack backtraces
          -L              # don't print pid/lwpid
          -b bufsize      # dynamic variable buf size
       dtruss df -h       # run and examine "df -h"
       dtruss -p 1871     # examine PID 1871
       dtruss -n tar      # examine all processes called "tar"
       dtruss -f test.sh  # run test.sh and follow children


PID/LWPID Process ID / Lightweight Process ID
RELATIVE relative timestamps to the start of the thread, us (microseconds)
ELAPSD elapsed time for this system call, us
CPU on-cpu time for this system call, us
SYSCALL(args) system call name, with arguments (some may be evaluated)


DTraceToolkit includes full worked examples with verbose descriptions explaining the output.


Runs until sigQuit, or the command executed dtruss finishes.


procsystime(1M), dtrace(1M), truss(1)