How does DTrace differ from truss?
DTrace differs from truss(1) in two major ways: one is that the method by which it gathers information is significantly less invasive than truss, and the other is that DTrace offers system-wide introspection into many different areas of the system, not just processes. I’ll expand on each of these in more detail. truss(1) is a utility for tracing the system calls of one or more processes and it uses the proc(4) filesystem as the way it gathers information. /proc is something that is designed for traditional debugging utilities, so it is based around the idea of stopping a process, reading or writing various bits of its state, and then resuming it. truss therefore has the effect of stopping the process on return from each system call it performs, reporting this result, and the continuing the process. As a tracing framework, DTrace operates a bit differently in how data is gathered. DTrace performs dynamic instrumentation of various code paths in the system and permits data to be recorded
