the scope of DTrace far exceeds that of procmon. procmon will show you params and return code for file accesses, and provides filtering, but that's the limit.

the scope of DTrace far exceeds that of procmon. procmon will show you params and return code for file accesses, and provides filtering, but that's the limit. whereas DTrace could tell you "these are the file accesses that took longer than 5ms" or "here's a histogram/heatmap of file access durations". DTrace can correlate — file accesses by a given process in-between a given function's entry and exit — telling you _why_ a file was accessed. well, maybe you're just asking how performant DTrace would be at achieving the same output. sadly I can't answer that.