The following is an example fo the rwbytype.d script. We run rwbytype.d for a few seconds then hit Ctrl-C, # rwbytype.d Tracing... Hit Ctrl-C to end. ^C PID CMD VTYPE DIR BYTES 1545 sshd chr W 1 10357 more chr R 30 2357 sshd chr W 31 10354 dtrace chr W 32 1545 sshd chr R 34 6778 bash chr W 44 1545 sshd sock R 52 405 poold reg W 68 1545 sshd sock W 136 10357 bash reg R 481 10356 find reg R 481 10355 bash reg R 481 10357 more reg R 1652 2357 sshd sock R 1664 10357 more chr W 96925 10357 more fifo R 97280 2357 sshd chr R 98686 10356 grep fifo W 117760 2357 sshd sock W 118972 10356 grep reg R 147645 Here we can see that the grep process with PID 10356 read 147645 bytes from "regular" files. These are I/O bytes at the application level, so much of these read bytes would have been cached by the filesystem page cache. vnode file types are listed in /usr/include/sys/vnode.h, and give an idea of what the file descriptor refers to.