I'm trying to run:

$ sudo /usr/bin/newproc.d

which suppose to snoop new processes as they are executed, but it fails with the error:

dtrace: failed to compile script /usr/bin/newproc.d: line 22: probe description proc:::exec-success does not match any probes

This is on OS X 10.11.2 and as far as I remember, this was working before the upgrade.

It seems new OS X doesn't have anymore proc:::exec-success probe as I've checked by:

$ sudo dtrace -l | grep proc:::exec-success

Failing code of that script (note: this was provided by the system, I haven't changed it):

  print_pid[pid] = 1; /* This pid emerged from an exec, make a note of that. */

Is that probe was removed or renamed to different probe? Maybe I could activate it somehow? Otherwise what I can use instead?

  • My hunch this is same issue as the following message: probe description fbt::hfs_vnop_read:entry does not match any probes.
    – rogerdpack
    Nov 12, 2019 at 16:10

2 Answers 2


This is probably because of the "Rootless" feature in El Capitan.

You can disable this feature by rebooting into recovery mode and running the command csrutil disable (and you can similarly reenable it with csrutil enable).

There is a great explanation over at this Ask Different question: What is the “rootless” feature in El Capitan, really? The second answer addresses Dtrace directly.


To be even more secure, you can run:

csrutil enable --without dtrace

but this is not intended for production use according to Apple.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .