While SSH'ed into a machine I do the following... wxs@ack wxs % cat test.d #!/usr/sbin/dtrace -s syscall::open:return { printf("%s\n", copyinstr(arg0)); } wxs@ack wxs % sudo ./test.d dtrace: script './test.d' matched 1 probe I then ssh in to the machine from another terminal and I get the following as output from dtrace: CPU ID FUNCTION:NAME 0 39850 open:return /dev/random 1 39850 open:return /etc/libmap.conf 1 39850 open:return /var/run/ld-elf.so.hints 1 39850 open:return /usr/lib/libssh.so.4 1 39850 open:return /lib/libutil.so.7 1 39850 open:return /lib/libz.so.4 1 39850 open:return /usr/lib/libwrap.so.5 1 39850 open:return /usr/lib/libpam.so.4 1 39850 open:return /usr/lib/libbsm.so.2 1 39850 open:return /usr/lib/libgssapi.so.10 1 39850 open:return /usr/lib/libgssapi_krb5.so.10 1 39850 open:return /lib/libcrypto.so.5 1 39850 open:return /lib/libcrypt.so.4 1 39850 open:return /lib/libc.so.7 1 39850 open:return /usr/lib/libkrb5.so.10 1 39850 open:return /usr/lib/libhx509.so.10 1 39850 open:return /usr/lib/libasn1.so.10 1 39850 open:return /usr/lib/libcom_err.so.4 1 39850 open:return /lib/libmd.so.4 1 39850 open:return /usr/lib/libroken.so.10 1 39850 open:return /dev/null 1 39850 open:return /dev/crypto 1 39850 open:return /dev/crypto 1 39850 open:return /dev/urandom 1 39850 open:return /etc/nsswitch.conf 1 39850 open:return /etc/spwd.db dtrace: error on enabled probe ID 1 (ID 39850: syscall::open:return): invalid address (0xffffff803e61faf0) in action #1 at DIF offset 28 dtrace: error on enabled probe ID 1 (ID 39850: syscall::open:return): invalid address (0xffffff803e61faf0) in action #1 at DIF offset 28 dtrace: error on enabled probe ID 1 (ID 39850: syscall::open:return): invalid address (0xffffff803e61faf0) in action #1 at DIF offset 28 dtrace: error on enabled probe ID 1 (ID 39850: syscall::open:return): invalid address (0xffffff803e61faf0) in action #1 at DIF offset 28 dtrace: error on enabled probe ID 1 (ID 39850: syscall::open:return): invalid address (0xffffff803e61faf0) in action #1 at DIF offset 28 dtrace: error on enabled probe ID 1 (ID 39850: syscall::open:return): invalid address (0xffffff803e61faf0) in action #1 at DIF offset 28 dtrace: error on enabled probe ID 1 (ID 39850: syscall::open:return): invalid address (0xffffff803e61faf0) in action #1 at DIF offset 28 dtrace: error on enabled probe ID 1 (ID 39850: syscall::open:return): invalid address (0xffffff803e61faf0) in action #1 at DIF offset 28 dtrace: error on enabled probe ID 1 (ID 39850: syscall::open:return): invalid address (0xffffff803e61faf0) in action #1 at DIF offset 28 dtrace: error on enabled probe ID 1 (ID 39850: syscall::open:return): invalid address (0xffffff803e61faf0) in action #1 at DIF offset 28 1 39850 open:return /dev/random dtrace: error on enabled probe ID 1 (ID 39850: syscall::open:return): invalid address (0xffffff803e61faf0) in action #1 at DIF offset 28 The output on the serial console is: FreeBSD/amd64 (ack.atarininja.org) (ttyu0) login: [thread pid 30887 tid 100187 ] Stopped at vpanic_common+0x2e: ret db> bt Tracing pid 30887 tid 100187 td 0xffffff0013578390 vpanic_common() at vpanic_common+0x2e dtrace_assfail() at dtrace_assfail+0x2d dtrace_copycheck() at dtrace_copycheck+0x90 dtrace_copyinstr() at dtrace_copyinstr+0x2c dtrace_dif_emulate() at dtrace_dif_emulate+0x31a3 dtrace_probe() at dtrace_probe+0x44a systrace_probe() at systrace_probe+0x45 syscall() at syscall+0x60d Xfast_syscall() at Xfast_syscall+0xd0 --- syscall (5, FreeBSD ELF64, open), rip = 0x8013bf2ac, rsp = 0x7fffffffd938, rbp = 0x4 --- db>