Mac OSX has supported dtrace since 10.5, and it’s pretty powerful stuff (as long as you’re not running iTunes or QuickTime). You need to be root in order to be able to run it, but there’s plenty of sample scripts in /usr/bin which end in .d that you can look at.

As part of trying to add Spotlight support to ZFS, I needed to check whether the add_fsevent was being called for ZFS mounted. Fortunately, it’s part of the kernel and exported by the fbt provider, so we can find out when and where it’s running. This gives us the opportunity to use the stack() primitive to generate the stack of what’s being called:

$ sudo dtrace -n fbt::add_fsevent:entry'{stack()}'
CPU     ID                    FUNCTION:NAME
  0   6985                add_fsevent:entry 
              mach_kernel`vn_open_auth+0x256
              mach_kernel`link+0x638
              mach_kernel`open_nocancel+0xf3
              mach_kernel`unix_syscall64+0x269
              mach_kernel`lo64_unix_scall+0x4d
  0   6985                add_fsevent:entry 
              mach_kernel`vn_close+0x5c
              mach_kernel`vn_close+0x185
              mach_kernel`closef_locked+0x149
              mach_kernel`fdrelse+0x13d
              mach_kernel`close_nocancel+0x8d
              mach_kernel`unix_syscall64+0x269
              mach_kernel`lo64_unix_scall+0x4d
  1   6985                add_fsevent:entry 
              mach_kernel`vn_open_auth+0x256
              mach_kernel`link+0x638
              mach_kernel`open_nocancel+0xf3
              mach_kernel`unix_syscall64+0x269
              mach_kernel`lo64_unix_scall+0x4d
  1   6985                add_fsevent:entry 
              mach_kernel`vn_close+0x5c
              mach_kernel`vn_close+0x185
              mach_kernel`closef_locked+0x149
              mach_kernel`fdrelse+0x13d
              mach_kernel`close_nocancel+0x8d
              mach_kernel`unix_syscall64+0x269
              mach_kernel`lo64_unix_scall+0x4d

So we’re definitely getting reports in for items in the add_fsevent coming through. Now, to try and hook up DTrace to the MacZFS implementation …