Man page or keyword search:   man All Sections 1 - General Commands 2 - System Calls 3 - Subroutines, Functions 4 - Special Files 5 - File Formats 6 - Games and Screensavers 7 - Macros and Conventions 8 - Maintenence Commands 9 - Kernel Interface New Commands Server 4.4BSD AIX Alpinelinux Archlinux Aros BSDOS BSDi Bifrost CentOS Cygwin Darwin Debian DigitalUNIX DragonFly ElementaryOS Fedora FreeBSD Gentoo GhostBSD HP-UX Haiku Hurd IRIX Inferno JazzOS Kali Knoppix LinuxMint MacOSX Mageia Mandriva Manjaro Minix MirBSD NeXTSTEP NetBSD OPENSTEP OSF1 OpenBSD OpenDarwin OpenIndiana OpenMandriva OpenServer OpenSuSE OpenVMS Oracle PC-BSD Peanut Pidora Plan9 QNX Raspbian RedHat Scientific Slackware SmartOS Solaris SuSE SunOS Syllable Tru64 UNIXv7 Ubuntu Ultrix UnixWare Xenix YellowDog aLinux   23457 pages apropos Keyword Search (all sections) Output format html ascii pdf view pdf save postscript

creatbyproc.d(1m)		 USER COMMANDS		     creatbyproc.d(1m)

NAME
       creatbyproc.d - snoop creat()s by process name. Uses DTrace.

SYNOPSIS
       creatbyproc.d

DESCRIPTION
       creatbyproc.d  is  a  DTrace  OneLiner  to  print  file creations as it
       occurs, including the name of the process calling the open.

       This matches file creates from the creat() system call;	not  all  file
       creation	 occurs	 in  this  way,	 sometimes it is through open() with a
       O_CREAT flag, this script will not monitor that activity.

       Docs/oneliners.txt  and	Docs/Examples/oneliners_examples.txt  in   the
       DTraceToolkit  contain  this  as	 a oneliner that can be cut-n-paste to
       run.

       Since this uses DTrace, only users with root privileges	can  run  this
       command.

EXAMPLES
       This prints process names and new pathnames until Ctrl-C is hit.
	      # creatbyproc.d

FIELDS
       CPU    The CPU that recieved the event

       ID     A DTrace probe ID for the event

       FUNCTION:NAME
	      The DTrace probe name for the event

       remaining fields
	      The  first  is  the  name of the process, the second is the file
	      pathname.

DOCUMENTATION
       See the DTraceToolkit for further documentation under the  Docs	direc‐
       tory. The DTraceToolkit docs may include full worked examples with ver‐
       bose descriptions explaining the output.

EXIT
       creatbyproc.d will run forever until Ctrl-C is hit.

AUTHOR
       Brendan Gregg [Sydney, Australia]

SEE ALSO
       dtrace(1M)

version 1.00			 Jun 11, 2005		     creatbyproc.d(1m)

Vote for polarhome