Opensnoop: dtrace: error on enabled probe ID 5 (ID 163: syscall::open:return): invalid user access in action #11 at DIF offset 12

After running Open Snoop for the first time, I noticed the following message is continuously repeated. I am not developing on this machine and some of the blogs state that this is caused by iiTunes; however, I'm not sure if I have an issue. If so, can someone kindly provide guidance on how to triage?

Solution 1:

Usually the errors you've posted are preceded by this information:

dtrace: system integrity protection is on, some features will not be available

You will have to disable SIP (System Integrity Protection) for dtrace. To do so, boot into "Recovery" by pressing cmdR at startup, then launch "Terminal" from the "Utilities" menu there and type:

csrutil enable --without dtrace

Then press enter
(It will warn you that this unsupported configuration might break in the future.)

Now you should be able to restart and boot back into your OS and run dtrace without those errors.

However, once you're finished using dtrace, you are usually advised to return SIP to its original state, again by booting into Recovery and fully enabling it again:

csrutil enable

...or somewhat faster, by typing

sudo csrutil clear

...in your usual OS environment (i.e. not Recovery) followed by a reboot.