What does this dtrace error mean?

The errors are getting output to stderr, and can be filtered out by running the command as such:

sudo iotop -C 5 12 2>/dev/null

This does have the side effect of filtering out any other errors that might come up. I've found it to be an ok tradeoff, in that it's made my iotop output readable.

I'm not sure what the cause of the errors are, unfortunately. I've searched, but have not been able to find anything as of yet.


According to this blog post (with more information here), it's caused by iTunes, which DTrace "filters" so it can't be used to try to break iTunes' DRM.

Quitting iTunes resolves the error.


In short, the error is shown when attempting to trace a process that has requested not to be traced.

The error isn't technically cause by iTunes, but by a process that has disabled tracing, using code like the following.

ptrace(PT_DENY_ATTACH, 0, 0, 0);

This code sets a flag on the process on the kernel level, which prevents debugging and tracing of the process.

The best-known application that does this just happens to be iTunes, the application whose DRM this API was probably invented for, but the API is available to other processes. I have seen a number of 3rd party application use this API.

Of course, like all DRM it can be broken. Options for bypassing this anti-tracing and anti-debugging feature range from using a debugger to skip the API call to kernel extensions that patch the feature out in kernel space.