#!/usr/sbin/dtrace -qs /* Demonstrates system call write aggregation with function quantize This time with the executable name as well */ syscall::write:entry /execname == "bash" || execname == "ls" || execname == "find"/ { @[execname] = quantize(arg2); }