[dtrace-discuss] syscall,unix and fbt provider difference

[Jim Mauro]

unix is not a provider. And then there were two. :^)

The usage boundaries are based on what questions you seek answers to.
Yes, both syscall and fbt are useful for accounting for sys time.

System calls are the entry point into the kernel from applications, so
profiling at the syscall level allows you to see which system calls are 
being
executed, by which threads, and various things about what the calls are 
doing
(e.g. which files are being read by read(2), etc). Using time based 
profiling
at the entry / return points gives you a sys time view, most useful on a per
process or per thread basis.

fbt provides probes for virtually all kernel functions, and is generally 
more
useful when you're chasing a particular behavior or performance issue in
a specific kernel subsystem, or are just generally interested in 
learning more
about how the kernel works.

For a simple kernel profile as a starting point:
#dtrace -n 'profile-997hz / arg0 != 0/ { @ks[stack()] = count(); }'

Or if it's a particular CPU that's spending time in the kernel (as per 
mpstat(1) output);
#dtrace -n 'profile-997hz / arg0 != 0 && cpu == <CPU_ID> / { 
@ks[stack()]=count() }'

Or man lockstat(1).

/jim


wynne wrote:
> What's the difference of the three provider.
> It seems all could trace the high sys time. so any difference of usage boundary?
> --
> This message posted from opensolaris.org
> _______________________________________________
> dtrace-discuss mailing list
> dtrace-discuss at opensolaris.org
>