DTrace notes 01: the vminfo and sysinfo providers
06 October 2011

I’ve been brushing up on my DTrace, and I thought it might be helpful to someone somewhere if I wrote my notes up. They’re more Solaris background stuff that helped me understand what DTrace was doing than any kind of DTrace HOWTO. Regular readers will know I hate the HOWTO culture, so I’ve tried to flesh out my notes into a kind of noddy guide to Solaris internals.


First, some definitions. And remember that the vminfo provider looks at the same kinds of things as vmstat.


When a process is started by fork(), memory is allocated. Memory appears to the process as a contiguous block, but it isn’t really - this is a layer of abstraction provided by the MMU.

Each process has different areas (segments) of memory.

the size(1) command shows you which parts of the binary are what.

$ size /bin/ls
33576 + 2206 + 3894 = 39676

executable text + executable data + uninitialized data =

page faults

Rather than allocate all the physical memory a program may require in one go, which would be slow, and soon eat up all available memory, pages are allocated “on demand”. First all the spaces above are created as virtual memory. When an address is accessed which doesn’t have a physical mapping, the MMU raises a “page fault” which tells the kernel to send a trap to temporarily halt the process, give the process a page of physical memory, or restore the page to physical memory from the backup store (“swap it in”), then tell it to resume. So they’re not really faults, and definitely not errors. There are a few kinds:


Again, more definitions so you know what you can look at. This provider helps with the kinds of things we used to have to rely on mpstat to tell us about.

The main stuff in the sysinfo provider is looking at forks and execs, but you can also (perhaps surprisingly?) get quite a lot of I/O info through the bread and bwrite probes which are used for buffered reading and writng. There’s also some UFS stuff in there but hey, who’s using UFS these days? (In fact, who’s using Solaris these days…?)