Move along, nothing to see here.
As some of you may know, Thomas and I have been working on a port of dtrace, mostly in our spare time. I was intrigued and enthused to see that it had also been ported to FreeBSD and Mac OS X Leopard.
I won’t repeat the details of it here, but the gist of it is that Apple allows for certain processes to be hidden from any debug/tracing systems. While you may or may not agree on whether that is Truly Evil Behaviour or not, it doesn’t really matter – what it means for sure is that the Leopard dtrace port is severely broken.
When a system wide tracer cannot trace the whole system, it pretty much ceases to be of any use!
You might as well pack up, and go home, folks!
The really sad thing is the way they broke it! They basically disable any probes from running at the same time as a protected process, the prime example being iTunes.
This means, for example, that anything based on the timer tick is useless, since you lose the regular heartbeat, and that any kernel activity that may have been deferred (say disk io) is lost, unnoticed by your dtrace probes!
It really means that you cannot trust any of the data that dtrace is supplying, as it may be at best incomplete, at worst incorrect.
I shake my head, I really do.