#!/usr/sbin/dtrace -s #pragma D option flowindent /* fds[] is not documented in DTrace Guide. fds[file_descriptor] is a fileinfo_t struct used in io::: probes (and documented there in the Guide) */ fbt::getdents64:entry /execname == "ps"/ { printf("%s\n", fds[args[0]].fi_pathname); self->in = 1; } fbt::getdents64:return /execname == "ps"/ { self->in = 0; } fbt:procfs::entry,fbt:procfs::return /execname == "ps" && self->in/ { } fbt::gfs*:entry,fbt::gfs*:return /execname == "ps" && self->in/ { } fbt::pid_entry:entry /execname == "ps" && self->in/ { trace(arg0); } fbt::pid_entry:return /execname == "ps" && self->in && args[1]/ { trace( ((proc_t*)args[1])->p_user.u_comm ); } fbt::pid*:entry,fbt::pid*:return /execname == "ps" && self->in/ { }