How to use dtrace to detect file transfer

Question

I want to use "dtrace" to track file tranfer in OSX 10.8 , like when command "mv /folder1/file1 /folder2" is run .

I know there're probes like create/link/unlink/rename/chdir can be used in the form of

dtrace -n 'syscall::create:entry { printf("%s %s", execname, copyinstr(arg0)); }'

but how to trace this "mv" command ?

Answer 1

rename is the function you are after:

dtrace -n 'syscall::rename:entry { printf("mv %s %s\n",copyinstr(arg0),copyinstr(arg1)); }'

(Add sudo infront if required)