The following demonstrates iosnoop. It was run on a system that was fairly quiet until a tar command was run, # ./iosnoop UID PID D BLOCK SIZE COMM PATHNAME 0 0 W 1067 512 sched <none> 0 0 W 6496304 1024 sched <none> 0 3 W 6498797 512 fsflush <none> 0 0 W 1067 512 sched <none> 0 0 W 6496304 1024 sched <none> 100 443 R 892288 4096 Xsun /usr/openwin/bin/Xsun 100 443 R 891456 4096 Xsun /usr/openwin/bin/Xsun 100 15795 R 3808 8192 tar /usr/bin/eject 100 15795 R 35904 6144 tar /usr/bin/eject 100 15795 R 39828 6144 tar /usr/bin/env 100 15795 R 3872 8192 tar /usr/bin/expr 100 15795 R 21120 7168 tar /usr/bin/expr 100 15795 R 43680 6144 tar /usr/bin/false 100 15795 R 44176 6144 tar /usr/bin/fdetach 100 15795 R 3920 8192 tar /usr/bin/fdformat 100 15795 R 3936 8192 tar /usr/bin/fdformat 100 15795 R 4080 8192 tar /usr/bin/fdformat 100 15795 R 9680 3072 tar /usr/bin/fdformat 100 15795 R 4096 8192 tar /usr/bin/fgrep 100 15795 R 46896 6144 tar /usr/bin/fgrep 100 15795 R 4112 8192 tar /usr/bin/file 100 15795 R 4128 8192 tar /usr/bin/file 100 15795 R 4144 8192 tar /usr/bin/file 100 15795 R 21552 7168 tar /usr/bin/file 100 15795 R 4192 8192 tar /usr/bin/fmli 100 15795 R 4208 8192 tar /usr/bin/fmli 100 15795 R 4224 57344 tar /usr/bin/fmli 100 15795 R 4336 24576 tar /usr/bin/fmli 100 15795 R 695792 8192 tar <none> 100 15795 R 696432 57344 tar /usr/bin/fmli [...] |