Sample Header Ad - 728x90

Error on enabled probe: syscall::open_nocancel:entry): invalid user access in action #2 at DIF

14 votes
1 answer
7260 views
I've the following one-liner to show files opened by process: sudo dtrace -n 'syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0)); }' however I've plenty of repeated errors such as: > dtrace: error on enabled probe ID 4 (ID 946: syscall::open_nocancel:entry): invalid user access in action #2 at DIF offset 24 > > dtrace: error on enabled probe ID 7 (ID 160: syscall::open:entry): invalid user access in action #2 at DIF offset 24 I'm aware that I can suppress them by redirecting to 2> /dev/null. What these errors means and why they're happening? Is it dtrace fault, or some specific process causing that? And how this problem can be addressed? I'm using OS X 10.11.2
Asked by kenorb (22004 rep)
Apr 8, 2016, 03:45 PM
Last activity: Apr 27, 2016, 02:05 PM