1 .TH filebyproc.d 1m "$Date:: 2007-08-05 #$" "USER COMMANDS"
3 filebyproc.d \- snoop opens by process name. Uses DTrace.
7 filebyproc.d is a DTrace OneLiner to print file pathnames as they are
8 opened, including the name of the process calling the open.
9 A line will be printed regardless of whether the open is actually
12 This is useful to learn which files applications are attempting to
13 open, such as config files, database files, log files, etc.
15 Docs/oneliners.txt and Docs/Examples/oneliners_examples.txt
16 in the DTraceToolkit contain this as a oneliner that can be cut-n-paste
19 Since this uses DTrace, only the root user or users with the
20 dtrace_kernel privilege can run this command.
24 stable - needs the syscall provider.
27 This prints new process name and pathnames until Ctrl\-C is hit.
34 The CPU that recieved the event
37 A DTrace probe ID for the event
40 The DTrace probe name for the event
43 The first is the name of the process, the second is the file pathname.
46 See the DTraceToolkit for further documentation under the
47 Docs directory. The DTraceToolkit docs may include full worked
48 examples with verbose descriptions explaining the output.
50 filebyproc.d will run forever until Ctrl\-C is hit.
55 opensnoop(1M), dtrace(1M), truss(1)