title: iosnoop, iotop, opensnoop, execsnoop, opensnoop, dtruss and other dtrace based commands don't work on osx El capitan, macOS Sierra
body: <p>While running iosnoop command on OSX 10.11.1 I get an error with the following text:</p>
  
  <pre><code>dtrace: invalid probe specifier
   /*
    * Command line arguments
    */
   inline int OPT_dump    = 0;
   inline int OPT_device  = 0;
   inline int OPT_delta   = 0;
   inline int OPT_devname = 0;
   inline int OPT_file    = 0;
   inline int OPT_args    = 0;
   inline int OPT_ins     = 0;
   inline int OPT_nums    = 0;
   inline int OPT_dtime   = 0;
   inline int OPT_mount   = 0;
   inline int OPT_start   = 0;
   inline int OPT_pid     = 0;
   inline int OPT_name    = 0;
   inline int OPT_end     = 0;
   inline int OPT_endstr  = 0;
   inline int FILTER  = 0;
   inline int PID     = 0;
   inline string DEVICE   = ".";
   inline string FILENAME = ".";
   inline string MOUNT    = ".";
   inline string NAME     = ".";
  
   #pragma D option quiet
   #pragma D option switchrate=10hz
  
   /*
    * Print header
    */
   dtrace:::BEGIN
   {
      last_event[""] = 0;
  
      /* print optional headers */
      OPT_start   ? printf("%-14s ","STIME")   : 1;
      OPT_end     ? printf("%-14s ","TIME")    : 1;
      OPT_endstr  ? printf("%-20s ","STRTIME") : 1;
      OPT_devname ? printf("%-7s ","DEVICE")   : 1;
      OPT_ins     ? printf("%-3s ","INS")      : 1;
      OPT_nums    ? printf("%-3s %-3s ","MAJ","MIN") : 1;
      OPT_delta   ? printf("%-10s ","DELTA")   : 1;
      OPT_dtime   ? printf("%-10s ","DTIME")   : 1;
  
      /* print main headers */
      OPT_dump ?
          printf("%s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s %s\n",
          "TIME", "STIME", "DELTA", "DEVICE", "INS", "MAJ", "MIN", "UID",
          "PID", "PPID", "D", "BLOCK", "SIZE", "MOUNT", "FILE", "PATH",
          "COMM","ARGS") :
          printf("%5s %5s %1s %8s %6s ", "UID", "PID", "D", "BLOCK", "SIZE");
      OPT_args == 0 ? printf("%10s %s\n", "COMM", "PATHNAME") : 1;
      OPT_args == 1 ? printf("%28s %s\n", "PATHNAME", "ARGS") : 1;
   }
  
   /*
    * Check event is being traced
    */
   io:::start
   {
      /* default is to trace unless filtering, */
      self-&gt;ok = FILTER ? 0 : 1;
  
      /* check each filter, */
      (OPT_device == 1 &amp;&amp; DEVICE == args[1]-&gt;dev_statname)? self-&gt;ok = 1 : 1;
      (OPT_file == 1 &amp;&amp; FILENAME == args[2]-&gt;fi_pathname) ? self-&gt;ok = 1 : 1;
      (OPT_mount == 1 &amp;&amp; MOUNT == args[2]-&gt;fi_mount) ? self-&gt;ok = 1 : 1;
      (OPT_name == 1 &amp;&amp; NAME == strstr(NAME, execname)) ? self-&gt;ok = 1 : 1;
      (OPT_name == 1 &amp;&amp; execname == strstr(execname, NAME)) ? self-&gt;ok = 1 : 1;
      (OPT_pid == 1 &amp;&amp; PID == pid) ? self-&gt;ok = 1 : 1;
   }
  
   /*
    * Reset last_event for disk idle -&gt; start
    * this prevents idle time being counted as disk time.
    */
   io:::start
   /! pending[args[1]-&gt;dev_statname]/
   {
      /* save last disk event */
      last_event[args[1]-&gt;dev_statname] = timestamp;
   }
  
   /*
    * Store entry details
    */
   io:::start
   /self-&gt;ok/
   {
      /* these are used as a unique disk event key, */
      this-&gt;dev = args[0]-&gt;b_edev;
      this-&gt;blk = args[0]-&gt;b_blkno;
  
      /* save disk event details, */
      start_uid[this-&gt;dev, this-&gt;blk] = (int)uid;
      start_pid[this-&gt;dev, this-&gt;blk] = pid;
      start_ppid[this-&gt;dev, this-&gt;blk] = ppid;
      start_args[this-&gt;dev, this-&gt;blk] = (char *)curpsinfo-&gt;pr_psargs;
      start_comm[this-&gt;dev, this-&gt;blk] = execname;
      start_time[this-&gt;dev, this-&gt;blk] = timestamp;
  
      /* increase disk event pending count */
      pending[args[1]-&gt;dev_statname]++;
  
      self-&gt;ok = 0;
   }
  
   /*
    * Process and Print completion
    */
   io:::done
   /start_time[args[0]-&gt;b_edev, args[0]-&gt;b_blkno]/
   {
      /* decrease disk event pending count */
      pending[args[1]-&gt;dev_statname]--;
  
      /*
       * Process details
       */
  
      /* fetch entry values */
      this-&gt;dev = args[0]-&gt;b_edev;
      this-&gt;blk = args[0]-&gt;b_blkno;
      this-&gt;suid = start_uid[this-&gt;dev, this-&gt;blk];
      this-&gt;spid = start_pid[this-&gt;dev, this-&gt;blk];
      this-&gt;sppid = start_ppid[this-&gt;dev, this-&gt;blk];
      self-&gt;sargs = (int)start_args[this-&gt;dev, this-&gt;blk] == 0 ?
          "" : start_args[this-&gt;dev, this-&gt;blk];
      self-&gt;scomm = start_comm[this-&gt;dev, this-&gt;blk];
      this-&gt;stime = start_time[this-&gt;dev, this-&gt;blk];
      this-&gt;etime = timestamp; /* endtime */
      this-&gt;delta = this-&gt;etime - this-&gt;stime;
      this-&gt;dtime = last_event[args[1]-&gt;dev_statname] == 0 ? 0 :
          timestamp - last_event[args[1]-&gt;dev_statname];
  
      /* memory cleanup */
      start_uid[this-&gt;dev, this-&gt;blk]  = 0;
      start_pid[this-&gt;dev, this-&gt;blk]  = 0;
      start_ppid[this-&gt;dev, this-&gt;blk] = 0;
      start_args[this-&gt;dev, this-&gt;blk] = 0;
      start_time[this-&gt;dev, this-&gt;blk] = 0;
      start_comm[this-&gt;dev, this-&gt;blk] = 0;
      start_rw[this-&gt;dev, this-&gt;blk]   = 0;
  
      /*
       * Print details
       */
  
      /* print optional fields */
      OPT_start   ? printf("%-14d ", this-&gt;stime/1000) : 1;
      OPT_end     ? printf("%-14d ", this-&gt;etime/1000) : 1;
      OPT_endstr  ? printf("%-20Y ", walltimestamp) : 1;
      OPT_devname ? printf("%-7s ", args[1]-&gt;dev_statname) : 1;
      OPT_ins     ? printf("%3d ", args[1]-&gt;dev_instance) : 1;
      OPT_nums    ? printf("%3d %3d ",
          args[1]-&gt;dev_major, args[1]-&gt;dev_minor) : 1;
      OPT_delta   ? printf("%-10d ", this-&gt;delta/1000) : 1;
      OPT_dtime   ? printf("%-10d ", this-&gt;dtime/1000) : 1;
  
      /* print main fields */
      OPT_dump ?
          printf("%d %d %d %s %d %d %d %d %d %d %s %d %d %s %s %s %s %S\n",
          this-&gt;etime/1000, this-&gt;stime/1000, this-&gt;delta/1000,
          args[1]-&gt;dev_statname, args[1]-&gt;dev_instance, args[1]-&gt;dev_major,
          args[1]-&gt;dev_minor, this-&gt;suid, this-&gt;spid, this-&gt;sppid,
          args[0]-&gt;b_flags &amp; B_READ ? "R" : "W",
          args[0]-&gt;b_blkno, args[0]-&gt;b_bcount, args[2]-&gt;fi_mount,
          args[2]-&gt;fi_name, args[2]-&gt;fi_pathname, self-&gt;scomm, self-&gt;sargs) :
          printf("%5d %5d %1s %8d %6d ",
          this-&gt;suid, this-&gt;spid, args[0]-&gt;b_flags &amp; B_READ ? "R" : "W",
          args[0]-&gt;b_blkno, args[0]-&gt;b_bcount);
      OPT_args == 0 ? printf("%10s %s\n", self-&gt;scomm, args[2]-&gt;fi_pathname)
          : 1;
      OPT_args == 1 ? printf("%28s %S\n",
          args[2]-&gt;fi_pathname, self-&gt;sargs) : 1;
  
      /* save last disk event */
      last_event[args[1]-&gt;dev_statname] = timestamp;
  
      /* cleanup */
      self-&gt;scomm = 0;
      self-&gt;sargs = 0;
   }
  
   /*
    * Prevent pending from underflowing
    * this can happen if this program is started during disk events.
    */
   io:::done
   /pending[args[1]-&gt;dev_statname] &lt; 0/
   {
      pending[args[1]-&gt;dev_statname] = 0;
   }
  : probe description io:::start does not match any probes
  </code></pre>
  
  <p>Tested on two machines running the same version of OSX and got the same error. Also tested on 10.10 and it worked as it should.</p>