An open() or opendir() request generates an open record. No open record is written for dup(), pipe(), or fork(). A fork() or dup() function results in more than one file descriptor accessing the same file with the same cursor. (A cursor refers to the current position in the file.) In this case, when you have more than one file descriptor with the same cursor, if a close() or closedir() request occurs, no close record is written until the last file descriptor associated with the cursor is closed.
Because of the fork() function, a close record may be written by a process other than the one that opened the file. Open records that are created have a correlator, called the open file token. The open file token can be used to correlate open and close records.