Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When running iotop -C 5 12 on my late-2010 Macbook Pro (10.6.7) I get repeated instances of this error:

dtrace: error on enabled probe ID 5 (ID 19507: io:mach_kernel:buf_strategy:start): illegal operation in action #3 at DIF offset 0

What's the cause of this and how do I fix it?

share|improve this question
up vote 6 down vote accepted

According to this blog post (with more information here), it's caused by iTunes, which DTrace "filters" so it can't be used to try to break iTunes' DRM.

Quitting iTunes resolves the error.

share|improve this answer
I get this error even when iTunes isn't running. – studgeek Nov 25 '12 at 14:52

The errors are getting output to stderr, and can be filtered out by running the command as such:

sudo iotop -C 5 12 2>/dev/null

This does have the side effect of filtering out any other errors that might come up. I've found it to be an ok tradeoff, in that it's made my iotop output readable.

I'm not sure what the cause of the errors are, unfortunately. I've searched, but have not been able to find anything as of yet.

share|improve this answer

In short, the error is shown when attempting to trace a process that has requested not to be traced.

The error isn't technically cause by iTunes, but by a process that has disabled tracing, using code like the following.

ptrace(PT_DENY_ATTACH, 0, 0, 0);

This code sets a flag on the process on the kernel level, which prevents debugging and tracing of the process.

The best-known application that does this just happens to be iTunes, the application whose DRM this API was probably invented for, but the API is available to other processes. I have seen a number of 3rd party application use this API.

Of course, like all DRM it can be broken. Options for bypassing this anti-tracing and anti-debugging feature range from using a debugger to skip the API call to kernel extensions that patch the feature out in kernel space.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .