Does `dtruss -p PID` list system calls made before dtruss was run? I'm trying to diagnose an intermittently slow command. When I run the command and see it hanging, I press control + t to get the PID, then in another tab, run diagnose [PID] - eg, diagnose 123. I've defined diagnose as a function in my zsh configuration:

# See system calls of the process with a given PID
function diagnose() { sudo dtruss -cade -p "$1" 2&gt;&amp;1 | tee /tmp/dtruss_output }


Obviously, since I'm reacting when I notice a hang, I run diagnose several seconds after the process started. The output lists many system calls, but I wonder whether I'm missing anything important.

Does dtruss list commands retroactively? In other words, does the output of dtruss -p [PID] include system calls made by that process before dtruss was run?
No

I've just run an experiment to test this. I wrote and ran this Ruby script:

puts "going to read foo"
puts File.read('/tmp/foo.txt')

sleep 5
puts "going to read bar"
puts File.read('/tmp/bar.txt')

sleep 5
puts "going to read baz"
puts File.read('/tmp/baz.txt')


After it started, I ran diagnose on its PID, as described above. I only saw one call to open:

20309/0x4a7118:     34082      41     34 open("/tmp/baz.txt\0", 0x1000000, 0x1B6)        = 7 0