DTrace is composed of a compiler, a framework, providers of probes written within that framework, and consumers of those probes.
DTrace providers create probes. Kernel structures exist to keep track of all probes that the providers have created.
The probes are stored in a hash-table data structure that is hashed by name and indexed according to unique probe identifiers.
When a probe is enabled, a bit of code in the area to be probed is rewritten to call dtrace probe(probe identifier) and then continue with the code’s
original operation. Different providers create different kinds of probes. For example,
a kernel system-call probe works differently from a user-process probe, and that is different from an I/O probe.