From a9ed300a03b358539b7ed01573044d060e383b66 Mon Sep 17 00:00:00 2001
From: Bill Thiede <git@xinu.tv>
Date: Wed, 21 Dec 2016 21:08:48 -0800
Subject: [PATCH] DTrace utility to watch for file modification in a Maildir.

---
 unread.d | 54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)
 create mode 100755 unread.d

diff --git a/unread.d b/unread.d
new file mode 100755
index 0000000..f6cdb05
--- /dev/null
+++ b/unread.d
@@ -0,0 +1,54 @@
+#!/usr/sbin/dtrace -s
+
+#pragma D option quiet
+#pragma D option defaultargs
+#pragma D option switchrate=10hz
+
+/*
+dtrace:::BEGIN
+{
+	printf("%-12s %6s %6s %-12.12s %s\n", "TIME(ms)", "UID",
+	    "PID", "PROCESS", "provider:module:function:name");
+}
+*/
+
+/*
+   printf("%-12d %6d %6d %-12.12s %s:%s:%s:%s\n", timestamp / 1000000,
+   uid, pid, execname, probeprov, probemod, probefunc, probename);
+   */
+
+syscall::open:entry
+/execname == "imap" && arg1 & O_CREAT/
+{
+    self->add = copyinstr(arg0)
+}
+
+syscall::unlink:entry
+/execname == "imap"/
+{
+    self->remove = copyinstr(arg0);
+}
+
+
+syscall::rename:entry
+/execname == "imap"/
+{
+	self->remove = copyinstr(arg0);
+    self->add = copyinstr(arg1);
+}
+
+syscall::unlink:entry,
+syscall::rename:entry
+/execname == "imap"/
+{
+	printf("- %s\n", self->remove);
+    self->remove = 0;
+}
+
+syscall::open:entry,
+syscall::rename:entry
+/execname == "imap" && self->add != 0/
+{
+    printf("+ %s\n", self->add);
+    self->add = 0;
+}