Dtrace script newproc.d stopped working after upgrade, because of missing proc:::exec-success probe

Question

I'm trying to run:

$ sudo /usr/bin/newproc.d

which suppose to snoop new processes as they are executed, but it fails with the error:

dtrace: failed to compile script /usr/bin/newproc.d: line 22: probe description proc:::exec-success does not match any probes

This is on OS X 10.11.2 and as far as I remember, this was working before the upgrade.

It seems new OS X doesn't have anymore proc:::exec-success probe as I've checked by:

$ sudo dtrace -l | grep proc:::exec-success

Failing code of that script (note: this was provided by the system, I haven't changed it):

proc:::exec-success
{
  print_pid[pid] = 1; /* This pid emerged from an exec, make a note of that. */
}

Is that probe was removed or renamed to different probe? Maybe I could activate it somehow? Otherwise what I can use instead?

Answer 1

This is probably because of the "Rootless" feature in El Capitan.

You can disable this feature by rebooting into recovery mode and running the command csrutil disable (and you can similarly reenable it with csrutil enable).

There is a great explanation over at this Ask Different question: What is the “rootless” feature in El Capitan, really? The second answer addresses Dtrace directly.

Answer 2

To be even more secure, you can run:

csrutil enable --without dtrace

but this is not intended for production use according to Apple.