Barely supported by Apple these days - in addition to needing to disable SIP which is a pain, it was broken causing system freezes for several major macOS releases.

dtruss requires disabling SIP. This seems like a better option for basic "what just happened?" debugging.

You need to disable SIP to use DTrace

Not entirely. You can selectively remove protections:

csrutil enable --without dtrace

That’s disabling SIP

Another silly question, did everyone forgot about instruments?

Does instruments allow you to track file reads/writes and other syscalls/mach stuff? Their docs are quite bad at describing the capabilities, so I'm not really sure. From what I can see it's a profiler rather than a tracing tool.

Isn't Instruments built on dtrace?