Correct usage: one of {-p pid, command} is required. Open output file when command line is fully analyzed: incorrect `truss -o f' command does not create an empty file anymore.