Skip to content

Instantly share code, notes, and snippets.

@bdelacretaz
Created June 22, 2017 05:22
Show Gist options
  • Save bdelacretaz/0c2a6d994efcf726dd9c43b1dee6babb to your computer and use it in GitHub Desktop.
Save bdelacretaz/0c2a6d994efcf726dd9c43b1dee6babb to your computer and use it in GitHub Desktop.
dtrace script to dump all file open calls for a specific process
#!/usr/sbin/dtrace -s
/* dump all "open" syscalls */
/* $1 is the PID to observe */
syscall::open:entry
/pid == $1/
{
printf("'%s' (PID: %d): syscall:open %s", execname, pid, copyinstr(arg0));
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment