#!/usr/sbin/dtrace -s
/*
 * creatbyproc.d - file creat()s by process name. DTrace OneLiner.
 *
 * This is a DTrace (not exactly) OneLiner from the DTraceToolkit.
 *
 * $Id: creatbyproc.d 3 2007-08-01 10:50:08Z brendan $
 */

/*
 * In libc, the creat() function has become:
 *
 *	creat(const char *path, mode_t mode)
 *	{
 *		return (openat(AT_FDCWD, path, O_WRONLY|O_CREAT|O_TRUNC, mode));
 *	}
 */

inline uint_t AT_FDCWD = 0xffd19553;
inline int CREAT_FLAGS = 0x301;		/* O_WRONLY|O_CREAT|O_TRUNC */

syscall::openat*:entry
/(uint_t)arg0 == AT_FDCWD && arg2 == CREAT_FLAGS/
{ printf("%s %s", execname, copyinstr(arg1)); }