Comment by EdwardCoffin

I think your problem with /usr/bin/iosnoop might be due to SIP. I no longer remember exactly which I did, but I know that I either partially or completely disabled SIP when I started to use DTrace, a number of months ago. I might have used one of the procedures outlined in this post [1] to do so. I do know that /usr/bin/iosnoop seems to work for me - at least, I just this moment invoked it, and got regular DTrace-style output with no errors like you mention. I am running an up-to-date High Sierra (10.13.6).

Edit: SIP is only partially disabled on my system, just enough to allow DTrace to work.

[1] https://web.archive.org/web/20160809042951/https://internals...