DTrace END probe never fires

Question

I have a mid-2009 MacBook Pro and a new 2012 MacBook Pro and I am in the process of learning DTrace ( a pretty amazing tool). When I calculate aggregates on the new 2012 MBP, the aggregates don't print out.

sudo dtrace -n 'syscall:::entry { @[execname] = count() }'

On my mid-2009 MBP, it shows something like:

  usbmuxd                                                           1
  GrowlHelperApp                                                    2
  imklaunchagent                                                    2
  installd                                                          2
  stackshot                                                         2
  ...

The 2012 MBP doesn't show anything.

I added a printf in a BEING and END probe to see if the END probe would even fire like so:

BEGIN
{
    printf("Hi!");
}

syscall:::entry
{
   @[execname] = count();
}

END
{
    printf("Bye!")
}

On the mid-2009 MBP both probes fired and printed and on the 2012 MBP only the BEGIN probe fired. The END never fired.

Both MBPs are running Lion 10.7.3. I'm not sure what to try next. The only difference that comes to mind right now is that I haven't installed the developer command line tools on the 2012 MBP. That just doesn't make sense to me though and is a shot in the dark.

Any help or ideas would be appreciated. Thanks.

=============[ Enabled Root Account ]====================

So I enabled the root account and re-ran the command

sudo dtrace -n 'syscall:::entry { @[execname] = count() }'

with no success but if I do

su
dtrace -n 'syscall:::entry { @[execname] = count() }'

it works!

=============[ kill -s INT ]=============================

I did a little more experimenting. If I run:

sudo kill -s INT [pid of dtrace]

everything works and the output is displayed.

If I run:

sudo kill -s INT [pid of sudo running dtrace]

this also works!

But if I use control-c in the terminal, it doesn't show the output.

What is the difference between control-c and kill -s INT?

Answer 1

I noticed that on linux too.

Ctrl-C doesn't work if dtrace is spawned by sudo.

If you sudo -i to get a root shell and then invoke dtrace it works.