# Print arguments of successfully started processes dtrace -n 'proc:::exec-success { printf("%s", curpsinfo->pr_psargs); }' (See http://docs.oracle.com/cd/E19253-01/817-6223/gelrh/index.html for probes and special variables) See also: http://dsc.sun.com/solaris/articles/dtrace_quickref/dtrace_built_in_vars.html # Files opened by process, dtrace -n 'syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0)); }' Observe the "copyinstr" used to copy the syscall's string argument into kernel space. [What happens without it? Why?] # Syscall count by program, dtrace -n 'syscall:::entry { @num[execname] = count(); }'