.TH newproc.d 1m  "$Date:: 2007-08-05 #$" "USER COMMANDS"
.SH NAME
newproc.d \- snoop new processes. Uses DTrace.
.SH SYNOPSIS
.B newproc.d
.SH DESCRIPTION
newproc.d is a DTrace OneLiner to snoop new processes as they are run.
The argument listing is printed.

This is useful to identify short lived processes that are usually
difficult to spot using traditional tools.

Docs/oneliners.txt and Docs/Examples/oneliners_examples.txt
in the DTraceToolkit contain this as a oneliner that can be cut-n-paste
to run.

Since this uses DTrace, only the root user or users with the
dtrace_kernel privilege can run this command.
.SH OS
Solaris
.SH STABILITY
stable - needs the proc provider.
.SH EXAMPLES
.TP
This prints new processes until Ctrl\-C is hit.
# 
.B newproc.d
.PP
.SH FIELDS
.TP
CPU
The CPU that recieved the event
.TP
ID
A DTrace probe ID for the event
.TP
FUNCTION:NAME
The DTrace probe name for the event
.TP
remaining fields
These contains the argument listing for the new process
.PP
.SH DOCUMENTATION
See the DTraceToolkit for further documentation under the 
Docs directory. The DTraceToolkit docs may include full worked
examples with verbose descriptions explaining the output.
.SH EXIT
newproc.d will run forever until Ctrl\-C is hit.
.SH AUTHOR
Brendan Gregg
[Sydney, Australia]
.SH SEE ALSO
execsnoop(1M), dtrace(1M), truss(1)