dtruss

Trace system calls and kernel activities on osx using DTrace. tldr-pages

On macOS

macOS

Trace system calls and kernel activities on osx using DTrace. Note: Requires System Integrity Protection to be disabled.

Trace a running process by PID

sudo dtruss -p process_idIdentify

Run a program and trace it

sudo dtruss programIdentify

Wait for a process with a matching name and trace it

sudo dtruss -W nameIdentify

Print elapsed time, on-cpu time, and count of each system call

sudo dtruss -eoc -p process_idIdentify

Trace a process and follow children

sudo dtruss -f -p process_idIdentify

Print occurrences of a specific system call

sudo dtruss -t syscall -p process_idIdentify