The following is an example of the creatbyproc.d script, Here we run creatbyproc.d for several seconds, # ./creatbyproc.d dtrace: script './creatbyproc.d' matched 2 probes CPU ID FUNCTION:NAME 0 5438 creat64:entry touch /tmp/newfile 0 5438 creat64:entry sh /tmp/mpLaaOik 0 5438 creat64:entry sh /dev/null ^C In another window, the following commands were run, touch /tmp/newfile man ls The file creation activity caused by these commands can be seen in the output by creatbyproc.d