The following is an example of the filebyproc.d script,
dtrace: description 'syscall::openat*:entry ' matched 2 probes
CPU ID FUNCTION:NAME
0 14 openat:entry gnome-netstatus- /dev/kstat
0 14 openat:entry man /var/ld/ld.config
0 14 openat:entry man /lib/libc.so.1
0 14 openat:entry man /usr/share/man/man.cf
0 14 openat:entry man /usr/share/man/windex
0 14 openat:entry man /usr/share/man/man1/ls.1
0 14 openat:entry man /usr/share/man/man1/ls.1
0 14 openat:entry man /tmp/mpqea4RF
0 14 openat:entry sh /var/ld/ld.config
0 14 openat:entry sh /lib/libc.so.1
0 14 openat:entry neqn /var/ld/ld.config
0 14 openat:entry neqn /lib/libc.so.1
0 14 openat:entry neqn /usr/share/lib/pub/eqnchar
0 14 openat:entry tbl /var/ld/ld.config
0 14 openat:entry tbl /lib/libc.so.1
0 14 openat:entry tbl /usr/share/man/man1/ls.1
0 14 openat:entry nroff /var/ld/ld.config
[...]
In the above example, the command "man ls" was run. Each file that was
attempted to be opened can be seen, along with the program name responsible.