The following is an example of the filebyproc.d script, # filebyproc.d dtrace: description 'syscall::open*:entry ' matched 2 probes CPU ID FUNCTION:NAME 0 14 open:entry gnome-netstatus- /dev/kstat 0 14 open:entry man /var/ld/ld.config 0 14 open:entry man /lib/libc.so.1 0 14 open:entry man /usr/share/man/man.cf 0 14 open:entry man /usr/share/man/windex 0 14 open:entry man /usr/share/man/man1/ls.1 0 14 open:entry man /usr/share/man/man1/ls.1 0 14 open:entry man /tmp/mpqea4RF 0 14 open:entry sh /var/ld/ld.config 0 14 open:entry sh /lib/libc.so.1 0 14 open:entry neqn /var/ld/ld.config 0 14 open:entry neqn /lib/libc.so.1 0 14 open:entry neqn /usr/share/lib/pub/eqnchar 0 14 open:entry tbl /var/ld/ld.config 0 14 open:entry tbl /lib/libc.so.1 0 14 open:entry tbl /usr/share/man/man1/ls.1 0 14 open:entry nroff /var/ld/ld.config [...] In the above example, the command "man ls" was run. Each file that was attempted to be opened can be seen, along with the program name responsible.