if
dtrace -n 'syscall::open*:entry { printf("%i %s %s %s",uid,execname,cwd,copyinstr(arg0)); }'
will show me all files that are opened as follows...
3 522 open:entry 0 init / /etc/inittab
3 522 open:entry 0 init /... (5 Replies)
systrace(7D) Devices systrace(7D)NAME
systrace - DTrace system call tracing provider
DESCRIPTION
The systrace driver implements the DTrace syscall dynamic tracing provider. The syscall provider performs dynamic instrumentation to offer
probes that fire whenever a thread enters or returns from a kernel system call entry point.
The systrace driver is not a public interface and you access the instrumentation offered by this provider through DTrace. Refer to the
Solaris Dynamic Tracing Guide for a description of the public documented interfaces available for the DTrace facility and the probes
offered by the syscall provider.
ATTRIBUTES
See attributes(5) for a description of the following attributes:
+-----------------------------+-----------------------------+
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
+-----------------------------+-----------------------------+
|Availability |SUNWdtrp |
+-----------------------------+-----------------------------+
|Interface Stability |Private |
+-----------------------------+-----------------------------+
SEE ALSO dtrace(1M), attributes(5), dtrace(7D)
Solaris Dynamic Tracing Guide
SunOS 5.10 4 Sep 2003 systrace(7D)