--- wikisrc/tutorials/how_to_enable_and_run_dtrace.mdwn	2017/04/08 21:38:18	1.18
+++ wikisrc/tutorials/how_to_enable_and_run_dtrace.mdwn	2018/07/22 17:18:06	1.26
@@ -12,12 +12,16 @@ DTrace is a work-in-progress effort and 
 
 ## Supported providers
 
-* SDT: Statically Defined Tracing
+* DTrace: What to do when a script BEGINs, ENDs, ERRORs
 * FBT: Function Boundary Tracing
+* IO: Disk I/O
 * Lockstat: Kernel Lock Statistics
+* Proc: Process and thread related events
 * Profile: Time based interrupt event source for Profiling
+* SDT: Statically Defined Tracing
 * Syscall: System Calls
 * Syscall Linux (32bit & 64 bit): System calls via the Linux binary emulation layer
+* VFS: Filesystem operations (confined to namecache events at time of writing - 8.99.22)
 
 ## TODO for netbsd-7
 
@@ -25,13 +29,6 @@ DTrace is a work-in-progress effort and 
 * Determine whether the profile module works and list it here.
 * Integrate [[riz|users/riz]]'s syscall provider patch.
 
-## TODO for netbsd-6
-
-Need to identify changes to pull up to netbsd-6 and pull them up.
-Candidates:
-
-* Profile provider.
-
 # How to use
 
 ##  Building DTrace 
@@ -51,13 +48,14 @@ Set the system to load the solaris and d
 
 For example, add the following to `/etc/modules.conf` (the file may not exist already on a system):
     
-    solaris
-    dtrace
-    dtrace_sdt
-    dtrace_fbt
-    dtrace_lockstat
-    dtrace_profile
-    dtrace_syscall
+- `solaris`
+- `dtrace`
+- `dtrace_fbt`
+- `dtrace_lockstat`
+- `dtrace_profile`
+- `dtrace_sdt`
+- `dtrace_syscall`
+- `dtrace_syscall_linux`
     
 A `dtrace` device node is created automatically in `/dev/dtrace` when the modules are loaded into place.
     
@@ -85,7 +83,7 @@ List the dtrace probes 
     29141       proc                                                     lwp_exit
 
 
-##  Running hello world 
+## Running hello world 
 
 Put the following into the file hello.d:
     
@@ -105,26 +103,48 @@ Run the hello world script: 
       0      1                           :BEGIN   Hello world
     
 
-A more complex example that traces the execution of a sleep operation
+## A more complex example
+
+The following script traces the execution of a sleep operation
 in the kernel. Put it in sleep.d:
     
     #pragma D option flowindent
-    
-    fbt::syscall:entry
+
+    syscall::nanosleep:entry
     /execname == "sleep" && guard++ == 0/
     {
             self->traceme = 1;
-            printf("fd: %d", arg0);
     }
-    
-    fbt::syscall:entry /self->traceme/ {}
-    
-    fbt::syscall:return
+
+    fbt:::
+    /self->traceme/
+    {}
+
+    syscall::nanosleep:return
     /self->traceme/
     {
             self->traceme = 0;
             exit(0);
     }
-    
 
-Start the script running (dtrace -s sleep.d) and then execute a "sleep 2" in another shell. 
+Start the script running:
+
+    dtrace -s sleep.d
+
+This will take a while as the script instruments every function in the
+kernel. When it's ready, it will print a message like "dtrace: script
+'sleep.d' matched 59268 probes".  Then execute a "sleep 2" in another
+shell.
+
+## Tools included in base
+
+Starting with NetBSD-8, on builds where `MKDTRACE=yes` is set, scripts from
+[Brendan Gregg's DTrace toolkit](https://github.com/opendtrace/toolkit/) are installed in base as standard.
+
+At present, the following scripts are installed in `/usr/sbin`: 
+
+- `dtruss` - An implementation of the truss utility in DTrace which traces the system calls
+made by a process
+- `execsnoop` - snoop on execution of processes as they occur
+- `opensnoop` - snoop on openning of files as they occur
+- `procsystime` -  print process system call time details.