DTrace

Before the modern Linux tracing tools existed, the question 'how do I safely ask arbitrary questions of a live production system?' was largely answered, first and most influentially, by DTrace. Created at Sun Microsystems in the early 2000s for the Solaris operating system, DTrace was a comprehensive dynamic tracing framework that let an operator instrument almost anything — kernel functions, system calls, and application probes — on a running production machine, safely, with a single coherent tool. It is the intellectual ancestor of much of what this whole field describes.

Concretely, DTrace unified ideas that Linux later grew piecemeal. It exposed thousands of probes (in kernel and in user space via USDT), and you wrote scripts in a small, deliberately restricted language called D — awk-like, with predicates and aggregations — that compiled to safe bytecode run by an in-kernel virtual machine. That sounds familiar because it is: the eBPF + bpftrace combination on Linux deliberately echoes DTrace's design. DTrace was engineered from the start around production safety: probes that are essentially free when disabled, a language with no loops or arbitrary memory writes so a trace cannot crash or wedge the system, and bounded resource use. Its reach extends well beyond Solaris: DTrace was ported to the BSD family (notably FreeBSD) and to macOS, where for years it underpinned tools like Instruments, so a Mac developer profiling an app has likely used DTrace without naming it.

It matters as the origin story and as a living tool: the metrics-logs-traces-and-probes mindset, the safe-by-design tracing language, USDT probes, and aggregation-in-the-kernel all trace back to DTrace's influence. The honest framing for a learner today: on Linux you will usually reach for eBPF/bpftrace rather than DTrace itself, because DTrace's home was Solaris and the BSDs and its Linux ports never became the mainstream path; but understanding DTrace explains WHY the modern tools look the way they do, and on macOS and FreeBSD DTrace is still very much the real, in-use tool.