#!/usr/sbin/dtrace -s #pragma D option destructive syscall::open*:entry / execname == "vim" && copyinstr(arg0) == "/etc/passwd" / { self->in_open = 1; } syscall::open*:return / execname == "vim" && self->in_open / { self->fd = arg0; printf("Got %d for /etc/passwd", self->fd); self->in_open = 0; } syscall::read:entry / execname == "vim" && self->fd == arg0 / { printf("Read from /etc/passwd\n"); /* stop(); */ self->in_read = 1; } syscall::read:return / execname == "vim" && self->in_read / { printf("<- read from /etc/passwd\n"); stop(); self->in_read = 0; }