Home > Articles > Home & Office Computing > Mac OS X

  • Print
  • + Share This
This chapter is from the book

This chapter is from the book

The Instruments

Here are the instruments built in to Instruments as of the time of this writing, grouped as they are in the Library window (select Show Group Banners from the Action (gear_xcu.jpg) pop-up at bottom left).

Most instruments are DTrace based (see the section on "Custom Instruments" later in this chapter). DTrace automatically records thread ID and a stack trace, and implicitly the stack depth, at the time of the event. Every numeric-valued property of the event is eligible for graphing in the instrument's track, which accounts for the odd offer of "Thread ID" for plotting in such instruments.

All instruments can target any single process, or all processes on the system, unless the description says otherwise.

Core Data

Core Data Saves

At each save operation in Core Data, the Core Data Saves instrument records the thread ID, stack trace, and how long the save took.

Core Data Fetches

This instrument captures the thread ID and stack trace of every fetch operation under Core Data, along with the number of objects fetched and how long it took to complete the fetch.

Core Data Faults

Core Data objects can be expensive both in terms of memory and of the time it takes to load them into memory. Often, an NSManagedObject or a to-many relationship is given to you as a fault, a kind of IOU that will be paid off in actual data when you reference data in the object.

This instrument captures every firing (payoff) of an object or relationship fault. It can display the thread ID and stack depth of the fault, as well as how long it took to satisfy object and relationship faults.

Core Data Cache Misses

A faulted Core Data object may already be in memory; it may be held in its NSPersistentStoreCoordinator's cache. If you fire a fault on an object that isn't in the cache (a "cache miss"), however, you've come into an expensive operation, because the object has to be freshly read from the database. You want to minimize the effect of cache faults by preloading the objects when it doesn't impair user experience.

This instrument shows where cache misses happen. It records the thread ID and stack trace of each miss, and how much time was taken up satisfying the miss, for objects and relationships.

File System

These instruments record POSIX calls that affect the properties of files and directories. This does not include reads and writes; for those, see the Reads / Writes instrument under Input / Output.

File Locks

This is an event instrument that records the thread ID, stack trace, function, option flags, and path for every call to the flock system function.

File Attributes

For every event of changing the owner, group, or access mode of a file (chown, chgrp, chmod), this instrument records thread ID, a stack trace, the called function, the file descriptor number, the group and user IDs, the mode flags, and the path to the file affected.

File Activity

This is an event instrument that records every call to open, close, fstat, open$UNIX2003, and close$UNIX2003. It captures thread ID, call stack, the call, the file descriptor, and path.

Directory I/O

This instrument records every event of system calls affecting directories, such as creation, moving, mounting, unmounting, renaming, and linking. The data include thread ID, stack trace, call, path to the file directory affected, and the destination path.

Garbage Collection

GC Total

GC Total collects statistics on the state of garbage collection in a process (or in all garbage-collected processes) at the time collection ends. In addition to thread ID and stack traces, it records the number of objects, and bytes, just reclaimed, the number of bytes still in use, and the total number of reclaimed and in-use bytes.

Garbage Collection

This is slightly different from the GC Total instrument. It measures across the beginning and end of the scavenge phase of garbage collection. It records whether the reclamation was generational, and how long scavenging took. It also records the number of objects and bytes reclaimed.


OpenGL Driver

This instrument taps the OpenGL drivers for the graphics displays to collect a huge number of statistics on OpenGL usage, by the target process (or the entire system), at an interval of your choosing (initially one second). The graphical trace itself doesn't signify anything, and can't be usefully configured in the inspector. The substance of the recording is to be found in the Detail table, and the Detail-control view has check boxes that determine which statistics appear there (there are nearly 60).

Input / Output

Reads / Writes

The events recorded by this instrument include reads and writes to file descriptors. Each event includes the thread ID, the name of the function being called, a stack trace, the descriptor and path of the file, and the number of bytes read or written.

Master Track

User Interface

This track records your mouse movements, clicks, and keystrokes as you work with an application. Each event carries a thumbnail of the screen surrounding the mouse cursor.

The UI track's events serve as landmarks for the internal program events recorded by other instruments, but the real utility—the reason this is called a master track—is that once a UI track is recorded, it can be played back; it is said to "drive" the application. When a UI track containing events is available, the Record button is relabeled Drive & Record, and clicking it will replay the human-interface events.

You can divert from driving by using the i button in the instrument's label to open the instrument's configuration inspector, and switching the Action pop-up from Drive to Capture.

For an extended example of using the User Interface track, see the "Human-Interface Logging" section of Chapter 19.


Shared Memory

The Shared Memory instrument records an event when shared memory is opened or unlinked. The event includes calling thread ID and executable, stack trace, function (shm_open/shm_unlink), and parameters (name of the shared memory object, flags, and mode_t). Selecting an event in the Detail table puts a stack trace into the Extended Detail pane.


We saw ObjectAlloc and Leaks in Chapter 19, when we debugged a memory leak in Linear.

ObjectAlloc collects a comprehensive history of every block of memory allocated during the run of its target. It can track the total number of objects and bytes currently allocated in an application because it records every allocation and deallocation, and balances them for every block's address.

The main Detail Table view lists every class of block that was allocated, and aggregate object and byte counts; use the Inspection Range tool to focus on allocations and deallocations within a given period. The classes can be checked to plot them separately in the trace.

Mousing over a classname reveals an arrow button; if you click it, the Detail table drills in to a table of every block of that class allocated in the selected time interval. Drilling in on the address field in one of these reveals a history of every event that affected that address—mallocs and frees at least, and if Record Reference Counts was checked in the configuration inspector before launching, reference-counting events as well. Mac OS X may use the same address more than once as memory is recycled; you'll usually see malloc events after every free but the last one.

The breadcrumb control below the Detail pane reflects each stage in the drilling-down process. Click the label for an earlier stage to return to it.

The track-style options in the configuration inspector include Current Bytes, a filled-line chart that shows the total current allocations; Stack Depth, a filled-line chart that shows how deep the call stack is at each allocation event; and Allocation Density, a peak graph showing the change in allocated bytes at each event (essentially a first derivative of the Current Bytes display).

In the Outline view, the top level lists the allocation classes. Below them are stack trees for all the allocations of those classes. The data-mining and Extended Detail tools are available in this view.

The Diagram view of the Detail table lists every allocation event. As in the Detail view, clicking the arrow button in an address view displays a history of allocation, deallocation, and reference-count events for that address.

ObjectAlloc can be run only against a process that Instruments launched, and you should pay attention to the Launch Configuration switches in the configuration inspector before recording.

The ObjectAlloc instrument is powerful and subtle. It merits an entire section in the Instruments User Guide. Search for "Analyzing Data with the ObjectAlloc Instrument" in the Developer Tools Reference in the Xcode Documentation window.


Leaks also tracks the allocation and deallocation of objects in an application (which must be launched by Instruments itself), but does so to detect the objects' being allocated and then lost—in other words, memory leaks. Leaks does not rely just on balancing allocations and deallocations; it periodically sweeps your program's heap to detect blocks that are not referenced by active memory.

The table view of the Detail pane lists every object that was allocated in the selected time interval, but found to have no references at the end. The line items show the percentage of total leakage the block represents, its size, address, and class. Selecting a line fills the Extended Detail pane with a general description and a stack trace of the allocation. Each address entry has an arrow button that drills down to the allocation, deallocation, and reference-count events for that address. You have the entire history of the block; you should be able to determine where an over-retain occurred. Reducing the inspection range on the trace will not narrow this list; it's for the entire history of the address.

The stack tree in the outline view goes from the start function in the runtime down the various paths to the allocating function, usually calloc in the case of Objective-C objects. Paring system libraries from the tree will quickly narrow the list down to the calls in your code responsible for creating leaked blocks.

The configuration inspector for the Leaks instrument controls how the trace is displayed, but the actual behavior is controlled by the control section of the Detail pane. The defaults are useful, but expose the Detail pane before you run to verify the settings are what you want. The settings control whether memory sweeps for unreferenced blocks are to be performed, whether the contents of leaked blocks will be retained for inspection, and how often to perform sweeps.


Activity Monitor

This instrument is too varied to explain fully here, but its features should be easy to understand if you explore its configuration inspector. It collects 31 summary statistics on a running process, including thread counts, physical memory usage, virtual memory activity, network usage, disk operations, and percentages of CPU load. This instrument more or less replaces BigTop as a graphical presentation of application activity.

Remember that you can have more than one Activity Monitor instrument running, targeting different applications or the system as a whole.

The Detail table lists the statistics for every process covered by the instrument. Moving the playback head makes the table reflect the processes and statistics as of the selected time. The hierarchical view arranges the processes in a parent-and-child tree.


Sampler is the poor man's Shark. It samples the target application at fixed intervals (10ms by default, but you can set it in the inspector), and records a stack trace each time. It does not record the position in the target down to the instruction, and the analysis tools are limited, but it's often good enough to find bottlenecks or determine where an application has hung.

Sampler was formerly supplied as a standalone application. The Sampler application supplied with Xcode 3 simply opens the CPU Sampler template in Instruments.

Sampler must have a specific process or launched application as its target; sampling the entire system makes no sense.

Spin Monitor

Spin Monitor is the Instruments version of the Spin Control application. To mimic Spin Control, set the target to All Processes and leave the trace document recording. Whenever an application (or the target application) shows the spinning-rainbow cursor, indicating it has stopped accepting human-interface events, the Spin Monitor becomes Sampler, building a stack tree while the spin continues.

The table view of the Detail panel has a top-level entry for each spinning incident. Within these are items for each sample in the incident, which expand to show each thread in the target. The outline view displays an aggregate tree of stack traces for all the samples in each incident; the Call Tree controls in the Detail panel become available.


For each start (execve) and end (exit) event in a process, this instrument records thread ID, stack trace, process ID, exit status, and executable path.

Network Activity Monitor

This is actually the Activity Monitor with four of eight network statistics active: Network Packets/Bytes In/Out Per Second. It omits the absolute numbers of packets and bytes transmitted.

Memory Monitor

This is the Activity Monitor with Physical Memory Used/Free, Virtual Memory Size, and Page Ins/Outs checked.

Disk Monitor

This is the Activity Monitor with Disk Read/Write Operations Per Second, and Disk Bytes Read/Written Per second checked.

CPU Monitor

This is the Activity Monitor with % Total Load, % User Load, and % System Load selected.



The JavaThread instrument is unique, in that it does not display its trace as a vertical graph. Instead, the trace is a stack of bars, extending horizontally through time, that represent the threads in a Java application. A bar appears when a thread starts. It is colored green while it runs, yellow while it waits, and red while it is blocked. The bar disappears when the thread halts. A sample is taken whenever such thread events occur; the Detail table shows the time of day at which the sample was taken, and the number of threads existing at that time.

Clicking the arrow button in the clock time of an item drills down to the details of the event: a table listing all threads by name, their priorities, states, number of monitors, and whether they are daemon threads. The Extended Detail view for a thread shows a stack trace, and a list of monitors the thread owns.

User Interface

Cocoa Events

Cocoa Events records an event at every call to -[NSApplication sendEvent:]. It captures the thread ID, stack trace, the event code, and a string (such as "Left Mouse Down") that characterizes the event.

Carbon Events

Carbon Events records an event at every return from WaitNextEvent. It captures the thread ID, stack trace, the event code, and a string (such as "Key Down") that characterizes the event.

  • + Share This
  • 🔖 Save To Your Account