I've the following one-liner to show files opened by process:

sudo dtrace -n 'syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0)); }'

however I've plenty of repeated errors such as:

dtrace: error on enabled probe ID 4 (ID 946: syscall::open_nocancel:entry): invalid user access in action #2 at DIF offset 24

dtrace: error on enabled probe ID 7 (ID 160: syscall::open:entry): invalid user access in action #2 at DIF offset 24

I'm aware that I can suppress them by redirecting to 2> /dev/null.

What these errors means and why they're happening?

Is it dtrace fault, or some specific process causing that? And how this problem can be addressed?

I'm using OS X 10.11.2

up vote 13 down vote accepted

This is potentially related to El Capitan and its System Integrity Protection (csrutil status) which can affect the dtrace behaviour.

The potential fix includes rebooting Mac into recovery mode (-R at boot time), then in Terminal run:

csrutil enable --without dtrace

to keep SIP enabled, but disable DTrace restrictions (note: this is undocumented parameter).

Or disable SIP completely by:

csrutil disable # Not recommended.


Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.