iosnoop relies on the dtrace subsystem. from: http://jimtechstuff.blogspot.com/2015/10/dtrace-broken-under-el-capitan.html
Dtrace is broken under El Capitan
One of the tools that I use quite a lot in debugging is ‘dtrace’ and the various utilities that use it. e.g. open snoop, iotop and a few that I wrote myself.
With the GA of El Capitan, any utility that resides in a system directory cannot be traced by dtrace which is a bit of a problem. I was wanting to see what open system calls the Photos app was using and came across this.
I know I could have used some other Mac utilities (fs_usage, sc_usage etc.) but I’m showing my Solaris roots here and I still wanted to use dtrace.
Fortunately there looks to be a way of enabling dtrace:
Reboot the mac
Hold ⌘R during reboot
From the Utilities menu, run Terminal
Enter the following command
csrutil enable --without dtrace
Note, that when doing so I got the following warning:
This is an unsupported configuration, likely to break in the future and leave your machine in an unknown state.
I’ll live with it just now.
(I wanted to just add a comment to Ara Yeressian’s mostly correct answer, but stackoverflow won’t let me with my current low reputation)