---
name: "dtruss"
section: "1m"
platform: "macos"
package: "dtrace"
version: "413"
release: "macOS 26.5"
platforms: ["macos"]
url: "https://new.carta.tech/dtruss"
---

# dtruss(1m)

process syscall details. Uses DTrace.

## NAME

dtruss - process syscall details. Uses DTrace.

## SYNOPSIS

**dtruss** \[-acdeflhoLs\] \[-t syscall\] { -p PID \| -n name \| command }

## DESCRIPTION

dtruss prints details on process system calls. It is like a DTrace version of truss, and has been designed to be less intrusive than truss.

Of particular interest is the elapsed times and on cpu times, which can identify both system calls that are slow to complete, and those which are consuming CPU cycles.

Since this uses DTrace, only users with root privileges can run this command.

## OPTIONS

- \-a

  print all details

- \-b bufsize

  dynamic variable buffer size. Increase this if you notice dynamic variable drop errors. The default is "4m" for 4 megabytes per CPU.

- \-c

  print system call counts

- \-d

  print relative timestamps, us

- \-e

  print elapsed times, us

- \-f

  follow children as they are forked

- \-l

  force printing of pid/lwpid per line

- \-L

  don't print pid/lwpid per line

- \-n name

  examine processes with this name

- \-W name

  wait for a process matching this name

- \-o

  print on-cpu times, us

- \-s

  print stack backtraces

- \-p PID

  examine this PID

- \-t syscall

  examine this syscall only

## EXAMPLES

- run and examine the "df -h" command

  \#  **dtruss** df -h

- examine PID 1871

  \#  **dtruss** -p 1871

- examine all processes called "tar"

  \# **dtruss** -n tar

- run test.sh and follow children

  \# **dtruss** -f test.sh

- run the "date" command and print elapsed and on cpu times,

  \# **dtruss** -eo date

## FIELDS

- PID/LWPID

  Process ID / Lightweight Process ID

- RELATIVE

  relative timestamps to the start of the thread, us (microseconds)

- ELAPSD

  elapsed time for this system call, us

- CPU

  on-cpu time for this system call, us

- SYSCALL(args)

  system call name, with arguments (some may be evaluated)

## DOCUMENTATION

See the DTraceToolkit for further documentation under the  Docs directory. The DTraceToolkit docs may include full worked examples with verbose descriptions explaining the output.

## EXIT

dtruss will run forever until Ctrl-C is hit, or if a command was executed dtruss will finish when the command ends.

## AUTHOR

Brendan Gregg \[Sydney, Australia\]

## SEE ALSO

procsystime(1M), dtrace(1M), [truss(1)](/truss/1.md)