refactor

11 files changed, 235 insertions, 236 deletions

diff --git a/README.md b/README.md
index 538966c..156ed5a 100644
--- a/README.md
+++ b/README.md
@@ -2,12 +2,10 @@
 
 <img src=assets/ioriotng-small.png align=right />
 
-I/O Riot NG is an experiments with BPF.
+I/O Riot NG is an experiments with BPF. This program traces for synchronous I/O syscalls and then analyses the time taken for each of those syscalls. 
 

 Maybe a spiritual successor of one of my previous projects, I/O Riot https://codeberg.org/snonux/ioriot, the latter was based on SystemTap and C. The NG is based on Go, C and BPF (via libbpfgo).
 
-This program traces for I/O syscalls and then analyses the time taken for each of those syscalls. And also the time between of those syscalls.
-
 ## Fedora
 
 To get this running on Fedora 39, run:
diff --git a/internal/c/generated/tracepoints.c b/internal/c/generated/tracepoints.c
index 6e17c0c..21b38d7 100644
--- a/internal/c/generated/tracepoints.c
+++ b/internal/c/generated/tracepoints.c
@@ -78,7 +78,7 @@ int handle_sys_exit_cachestat(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_CACHESTAT;
+    ev->trace_id = SYS_EXIT_CACHESTAT;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -99,7 +99,7 @@ int handle_sys_enter_cachestat(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_CACHESTAT;
+    ev->trace_id = SYS_ENTER_CACHESTAT;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -120,7 +120,7 @@ int handle_sys_exit_close_range(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_CLOSE_RANGE;
+    ev->trace_id = SYS_EXIT_CLOSE_RANGE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -141,7 +141,7 @@ int handle_sys_enter_close_range(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_CLOSE_RANGE;
+    ev->trace_id = SYS_ENTER_CLOSE_RANGE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -162,7 +162,7 @@ int handle_sys_exit_close(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_CLOSE;
+    ev->trace_id = SYS_EXIT_CLOSE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -183,7 +183,7 @@ int handle_sys_enter_close(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_CLOSE;
+    ev->trace_id = SYS_ENTER_CLOSE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -204,7 +204,7 @@ int handle_sys_exit_fchown(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_FCHOWN;
+    ev->trace_id = SYS_EXIT_FCHOWN;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -225,7 +225,7 @@ int handle_sys_enter_fchown(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_FCHOWN;
+    ev->trace_id = SYS_ENTER_FCHOWN;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -246,7 +246,7 @@ int handle_sys_exit_fchmod(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_FCHMOD;
+    ev->trace_id = SYS_EXIT_FCHMOD;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -267,7 +267,7 @@ int handle_sys_enter_fchmod(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_FCHMOD;
+    ev->trace_id = SYS_ENTER_FCHMOD;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -288,7 +288,7 @@ int handle_sys_exit_fchdir(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_FCHDIR;
+    ev->trace_id = SYS_EXIT_FCHDIR;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -309,7 +309,7 @@ int handle_sys_enter_fchdir(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_FCHDIR;
+    ev->trace_id = SYS_ENTER_FCHDIR;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -330,7 +330,7 @@ int handle_sys_exit_ftruncate(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_FTRUNCATE;
+    ev->trace_id = SYS_EXIT_FTRUNCATE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -351,7 +351,7 @@ int handle_sys_enter_ftruncate(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_FTRUNCATE;
+    ev->trace_id = SYS_ENTER_FTRUNCATE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -372,7 +372,7 @@ int handle_sys_exit_copy_file_range(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_COPY_FILE_RANGE;
+    ev->trace_id = SYS_EXIT_COPY_FILE_RANGE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -393,7 +393,7 @@ int handle_sys_enter_copy_file_range(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_NULL_EVENT;
-    ev->syscall_id = SYS_ENTER_COPY_FILE_RANGE;
+    ev->trace_id = SYS_ENTER_COPY_FILE_RANGE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -414,7 +414,7 @@ int handle_sys_exit_pwrite64(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_PWRITE64;
+    ev->trace_id = SYS_EXIT_PWRITE64;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -435,7 +435,7 @@ int handle_sys_enter_pwrite64(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_PWRITE64;
+    ev->trace_id = SYS_ENTER_PWRITE64;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -456,7 +456,7 @@ int handle_sys_exit_pread64(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_PREAD64;
+    ev->trace_id = SYS_EXIT_PREAD64;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -477,7 +477,7 @@ int handle_sys_enter_pread64(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_PREAD64;
+    ev->trace_id = SYS_ENTER_PREAD64;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -498,7 +498,7 @@ int handle_sys_exit_write(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_WRITE;
+    ev->trace_id = SYS_EXIT_WRITE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -519,7 +519,7 @@ int handle_sys_enter_write(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_WRITE;
+    ev->trace_id = SYS_ENTER_WRITE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -540,7 +540,7 @@ int handle_sys_exit_read(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_READ;
+    ev->trace_id = SYS_EXIT_READ;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -561,7 +561,7 @@ int handle_sys_enter_read(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_READ;
+    ev->trace_id = SYS_ENTER_READ;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -582,7 +582,7 @@ int handle_sys_exit_lseek(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_LSEEK;
+    ev->trace_id = SYS_EXIT_LSEEK;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -603,7 +603,7 @@ int handle_sys_enter_lseek(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_LSEEK;
+    ev->trace_id = SYS_ENTER_LSEEK;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -624,7 +624,7 @@ int handle_sys_exit_newfstat(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_NEWFSTAT;
+    ev->trace_id = SYS_EXIT_NEWFSTAT;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -645,7 +645,7 @@ int handle_sys_enter_newfstat(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_NEWFSTAT;
+    ev->trace_id = SYS_ENTER_NEWFSTAT;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -666,7 +666,7 @@ int handle_sys_exit_rename(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_RENAME;
+    ev->trace_id = SYS_EXIT_RENAME;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -687,7 +687,7 @@ int handle_sys_enter_rename(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_NAME_EVENT;
-    ev->syscall_id = SYS_ENTER_RENAME;
+    ev->trace_id = SYS_ENTER_RENAME;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -710,7 +710,7 @@ int handle_sys_exit_renameat(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_RENAMEAT;
+    ev->trace_id = SYS_EXIT_RENAMEAT;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -731,7 +731,7 @@ int handle_sys_enter_renameat(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_NAME_EVENT;
-    ev->syscall_id = SYS_ENTER_RENAMEAT;
+    ev->trace_id = SYS_ENTER_RENAMEAT;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -754,7 +754,7 @@ int handle_sys_exit_renameat2(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_RENAMEAT2;
+    ev->trace_id = SYS_EXIT_RENAMEAT2;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -775,7 +775,7 @@ int handle_sys_enter_renameat2(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_NAME_EVENT;
-    ev->syscall_id = SYS_ENTER_RENAMEAT2;
+    ev->trace_id = SYS_ENTER_RENAMEAT2;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -798,7 +798,7 @@ int handle_sys_exit_link(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_LINK;
+    ev->trace_id = SYS_EXIT_LINK;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -819,7 +819,7 @@ int handle_sys_enter_link(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_NAME_EVENT;
-    ev->syscall_id = SYS_ENTER_LINK;
+    ev->trace_id = SYS_ENTER_LINK;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -842,7 +842,7 @@ int handle_sys_exit_linkat(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_LINKAT;
+    ev->trace_id = SYS_EXIT_LINKAT;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -863,7 +863,7 @@ int handle_sys_enter_linkat(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_NAME_EVENT;
-    ev->syscall_id = SYS_ENTER_LINKAT;
+    ev->trace_id = SYS_ENTER_LINKAT;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -886,7 +886,7 @@ int handle_sys_exit_symlink(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_SYMLINK;
+    ev->trace_id = SYS_EXIT_SYMLINK;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -907,7 +907,7 @@ int handle_sys_enter_symlink(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_NAME_EVENT;
-    ev->syscall_id = SYS_ENTER_SYMLINK;
+    ev->trace_id = SYS_ENTER_SYMLINK;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -930,7 +930,7 @@ int handle_sys_exit_symlinkat(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_SYMLINKAT;
+    ev->trace_id = SYS_EXIT_SYMLINKAT;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -951,7 +951,7 @@ int handle_sys_enter_symlinkat(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_NAME_EVENT;
-    ev->syscall_id = SYS_ENTER_SYMLINKAT;
+    ev->trace_id = SYS_ENTER_SYMLINKAT;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -974,7 +974,7 @@ int handle_sys_exit_fcntl(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_FCNTL;
+    ev->trace_id = SYS_EXIT_FCNTL;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -995,7 +995,7 @@ int handle_sys_enter_fcntl(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_FCNTL;
+    ev->trace_id = SYS_ENTER_FCNTL;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1016,7 +1016,7 @@ int handle_sys_exit_ioctl(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_IOCTL;
+    ev->trace_id = SYS_EXIT_IOCTL;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1037,7 +1037,7 @@ int handle_sys_enter_ioctl(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_IOCTL;
+    ev->trace_id = SYS_ENTER_IOCTL;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1058,7 +1058,7 @@ int handle_sys_exit_getdents64(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_GETDENTS64;
+    ev->trace_id = SYS_EXIT_GETDENTS64;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1079,7 +1079,7 @@ int handle_sys_enter_getdents64(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_GETDENTS64;
+    ev->trace_id = SYS_ENTER_GETDENTS64;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1100,7 +1100,7 @@ int handle_sys_exit_getdents(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_GETDENTS;
+    ev->trace_id = SYS_EXIT_GETDENTS;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1121,7 +1121,7 @@ int handle_sys_enter_getdents(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_GETDENTS;
+    ev->trace_id = SYS_ENTER_GETDENTS;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1142,7 +1142,7 @@ int handle_sys_exit_sync_file_range(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_SYNC_FILE_RANGE;
+    ev->trace_id = SYS_EXIT_SYNC_FILE_RANGE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1163,7 +1163,7 @@ int handle_sys_enter_sync_file_range(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_NULL_EVENT;
-    ev->syscall_id = SYS_ENTER_SYNC_FILE_RANGE;
+    ev->trace_id = SYS_ENTER_SYNC_FILE_RANGE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1184,7 +1184,7 @@ int handle_sys_exit_fdatasync(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_FDATASYNC;
+    ev->trace_id = SYS_EXIT_FDATASYNC;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1205,7 +1205,7 @@ int handle_sys_enter_fdatasync(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_FDATASYNC;
+    ev->trace_id = SYS_ENTER_FDATASYNC;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1226,7 +1226,7 @@ int handle_sys_exit_fsync(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_FSYNC;
+    ev->trace_id = SYS_EXIT_FSYNC;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1247,7 +1247,7 @@ int handle_sys_enter_fsync(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_FSYNC;
+    ev->trace_id = SYS_ENTER_FSYNC;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1268,7 +1268,7 @@ int handle_sys_exit_fstatfs(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_FSTATFS;
+    ev->trace_id = SYS_EXIT_FSTATFS;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1289,7 +1289,7 @@ int handle_sys_enter_fstatfs(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_FSTATFS;
+    ev->trace_id = SYS_ENTER_FSTATFS;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1310,7 +1310,7 @@ int handle_sys_exit_flock(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_FLOCK;
+    ev->trace_id = SYS_EXIT_FLOCK;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1331,7 +1331,7 @@ int handle_sys_enter_flock(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_FLOCK;
+    ev->trace_id = SYS_ENTER_FLOCK;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1352,7 +1352,7 @@ int handle_sys_exit_quotactl_fd(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_QUOTACTL_FD;
+    ev->trace_id = SYS_EXIT_QUOTACTL_FD;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1373,7 +1373,7 @@ int handle_sys_enter_quotactl_fd(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_QUOTACTL_FD;
+    ev->trace_id = SYS_ENTER_QUOTACTL_FD;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1394,7 +1394,7 @@ int handle_sys_exit_io_uring_register(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_IO_URING_REGISTER;
+    ev->trace_id = SYS_EXIT_IO_URING_REGISTER;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1415,7 +1415,7 @@ int handle_sys_enter_io_uring_register(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_IO_URING_REGISTER;
+    ev->trace_id = SYS_ENTER_IO_URING_REGISTER;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1436,7 +1436,7 @@ int handle_sys_exit_io_uring_enter(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->syscall_id = SYS_EXIT_IO_URING_ENTER;
+    ev->trace_id = SYS_EXIT_IO_URING_ENTER;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1457,7 +1457,7 @@ int handle_sys_enter_io_uring_enter(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->syscall_id = SYS_ENTER_IO_URING_ENTER;
+    ev->trace_id = SYS_ENTER_IO_URING_ENTER;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
diff --git a/internal/c/generated/tracepoints.raku b/internal/c/generated/tracepoints.raku
index 6eb938b..cc78fbb 100644
--- a/internal/c/generated/tracepoints.raku
+++ b/internal/c/generated/tracepoints.raku
@@ -88,7 +88,7 @@ class Format {
                 return 0;
 
             ev->event_type = {(is-enter ?? 'ENTER_' !! 'EXIT_') ~ event-struct.uc};
-            ev->syscall_id = {$!name.uc};
+            ev->trace_id = {$!name.uc};
             ev->pid = pid;
             ev->tid = tid;
             ev->time = bpf_ktime_get_ns() / 1000;
diff --git a/internal/c/tracepoints/open.c b/internal/c/tracepoints/open.c
index ef57d90..b4e8757 100644
--- a/internal/c/tracepoints/open.c
+++ b/internal/c/tracepoints/open.c
@@ -5,17 +5,17 @@
 #define SYS_EXIT_OPENAT 3
 #define SYS_ENTER_OPENAT 4
 
-static __always_inline int _handle_sys_enter_open(struct trace_event_raw_sys_enter *ctx, __u32 syscall_id) {
+static __always_inline int _handle_sys_enter_open(struct trace_event_raw_sys_enter *ctx, __u32 trace_id) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct open_enter_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct open_enter_event), 0);
+    struct open_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct open_event), 0);
     if (!ev)
         return 0;
 
     ev->event_type = ENTER_OPEN_EVENT;
-    ev->syscall_id = syscall_id;
+    ev->trace_id = trace_id;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -29,7 +29,7 @@ static __always_inline int _handle_sys_enter_open(struct trace_event_raw_sys_ent
     return 0;
 }
 
-static __always_inline int _handle_sys_exit_open(struct trace_event_raw_sys_exit *ctx, __u32 syscall_id) {
+static __always_inline int _handle_sys_exit_open(struct trace_event_raw_sys_exit *ctx, __u32 trace_id) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -39,7 +39,7 @@ static __always_inline int _handle_sys_exit_open(struct trace_event_raw_sys_exit
         return 0;
 
     ev->event_type = EXIT_FD_EVENT;
-    ev->syscall_id = syscall_id;
+    ev->trace_id = trace_id;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
diff --git a/internal/c/types.h b/internal/c/types.h
index 57f39f0..017e1fb 100644
--- a/internal/c/types.h
+++ b/internal/c/types.h
@@ -14,9 +14,9 @@
 #define ENTER_NAME_EVENT 9
 #define EXIT_NAME_EVENT 10
 
-struct open_enter_event {
+struct open_event {
     __u32 event_type;
-    __u32 syscall_id; 
+    __u32 trace_id; 
     __u32 pid;
     __u32 tid;
     __u32 time;
@@ -26,7 +26,7 @@ struct open_enter_event {
 
 struct null_event {
     __u32 event_type;
-    __u32 syscall_id;
+    __u32 trace_id;
     __u32 pid;
     __u32 tid;
     __u32 time;
@@ -34,7 +34,7 @@ struct null_event {
 
 struct fd_event {
     __u32 event_type;
-    __u32 syscall_id;
+    __u32 trace_id;
     __u32 pid;
     __u32 tid;
     __u32 time;
@@ -43,7 +43,7 @@ struct fd_event {
 
 struct ret_event {
     __u32 event_type;
-    __u32 syscall_id;
+    __u32 trace_id;
     __u32 pid;
     __u32 tid;
     __s64 ret;
@@ -52,7 +52,7 @@ struct ret_event {
 
 struct name_event {
     __u32 event_type;
-    __u32 syscall_id;
+    __u32 trace_id;
     __u32 pid;
     __u32 tid;
     __u32 time;
diff --git a/internal/event.go b/internal/event.go
index 371a79b..beb8af6 100644
--- a/internal/event.go
+++ b/internal/event.go
@@ -9,7 +9,7 @@ import (
 
 type event interface {
 	String() string
-	GetSyscallId() SyscallId
+	GetTraceId() TraceId
 	GetPid() uint32
 	GetTid() uint32
 	GetTime() uint32
@@ -23,8 +23,8 @@ type enterExitEvent struct {
 	tracepointMismatch bool
 }
 
-func (e enterExitEvent) is(id SyscallId) bool {
-	return e.enterEv.GetSyscallId() == id
+func (e enterExitEvent) is(id TraceId) bool {
+	return e.enterEv.GetTraceId() == id
 }
 
 func (e enterExitEvent) String() string {
@@ -46,7 +46,7 @@ func (e enterExitEvent) String() string {
 	sb.WriteString(strconv.FormatInt(int64(e.enterEv.GetTid()), 10))
 
 	sb.WriteString(" ")
-	sb.WriteString(e.enterEv.GetSyscallId().Name())
+	sb.WriteString(e.enterEv.GetTraceId().Name())
 	if retEv, ok := e.exitEv.(*RetEvent); ok {
 		sb.WriteString(":")
 		sb.WriteString(strconv.FormatInt(int64(retEv.Ret), 10))
diff --git a/internal/eventloop.go b/internal/eventloop.go
index bf0ddf2..2ebd01c 100644
--- a/internal/eventloop.go
+++ b/internal/eventloop.go
@@ -43,56 +43,54 @@ func events(rawCh <-chan []byte) <-chan enterExitEvent {
 		delete(enterEvs, exitEv.GetTid())
 		ev.exitEv = exitEv
 
-		// TODO: Rename SyscallId to TraceId
 		// Expect ID one lower, otherwise, enter and exit tracepoints
 		// don't match up. E.g.:
 		// enterEv:SYS_ENTER_OPEN => exitEv:SYS_EXIT_OPEN
-		if ev.enterEv.GetSyscallId()-1 != ev.exitEv.GetSyscallId() {
+		if ev.enterEv.GetTraceId()-1 != ev.exitEv.GetTraceId() {
 			ev.tracepointMismatch = true
 		}
 
-		// TODO: switch here on type?
-
-		// Handle file open.
-		if ev.is(SYS_ENTER_OPENAT) || ev.is(SYS_ENTER_OPEN) {
-			openEnterEv := ev.enterEv.(*OpenEnterEvent)
+		switch v := ev.enterEv.(type) {
+		case *OpenEvent:
+			openEv := ev.enterEv.(*OpenEvent)
 
 			fd := ev.exitEv.(*FdEvent).Fd
-			file := fdFile{fd, string(openEnterEv.Filename[:])}
+			file := fdFile{fd, string(openEv.Filename[:])}
 			if fd >= 0 {
 				files[fd] = file
 			}
 			ev.file = file
 
-			comm := string(openEnterEv.Comm[:])
-			comms[openEnterEv.Tid] = comm
-			ev.comm = comm
-
-			evCh <- ev
-			return
-		}
+			comm := string(openEv.Comm[:])
+			comms[openEv.Tid] = comm
 
-		// Generic handling of any syscall with newname/oldname arguments
-		if nameEvent, ok := ev.enterEv.(*NameEvent); ok {
+		case *NameEvent:
+			nameEvent := ev.enterEv.(*NameEvent)
 			ev.file = oldnameNewnameFile{
 				oldname: string(nameEvent.Oldname[:]),
 				newname: string(nameEvent.Newname[:]),
 			}
-		}
+			ev.comm, _ = comms[ev.enterEv.GetTid()]
 
-		// Generic handling of any syscall expecting a file descriptor (fd)
-		if fdEvent, ok := ev.enterEv.(*FdEvent); ok {
-			if file_, ok := files[fdEvent.Fd]; ok {
+		case *FdEvent:
+			fd := ev.enterEv.(*FdEvent).Fd
+			if file_, ok := files[fd]; ok {
 				ev.file = file_
+				if ev.is(SYS_ENTER_CLOSE) {
+					delete(files, fd)
+				}
 			} else {
-				ev.file = fdFile{fdEvent.Fd, "?"}
-			}
-			if ev.is(SYS_ENTER_CLOSE) {
-				delete(files, fdEvent.Fd)
+				ev.file = fdFile{fd, "?"}
 			}
+			ev.comm, _ = comms[ev.enterEv.GetTid()]
+
+		case *NullEvent:
+			ev.comm, _ = comms[ev.enterEv.GetTid()]
+
+		default:
+			panic(fmt.Sprintf("unknown type: %v", v))
 		}
 
-		ev.comm, _ = comms[ev.enterEv.GetTid()]
 		evCh <- ev
 	}
 
@@ -102,7 +100,7 @@ func events(rawCh <-chan []byte) <-chan enterExitEvent {
 		for raw := range rawCh {
 			switch EventType(raw[0]) {
 			case ENTER_OPEN_EVENT:
-				enter(NewOpenEnterEvent(raw))
+				enter(NewOpenEvent(raw))
 			case EXIT_OPEN_EVENT:
 				exit(NewFdEvent(raw))
 			case ENTER_FD_EVENT:
@@ -116,7 +114,7 @@ func events(rawCh <-chan []byte) <-chan enterExitEvent {
 			case ENTER_NAME_EVENT:
 				enter(NewNameEvent(raw))
 			default:
-				panic(fmt.Sprintf("Unhandled event type %s", EventType(raw[0])))
+				panic(fmt.Sprintf("unhandled event type %v", EventType(raw[0])))
 			}
 		}
 	}()
diff --git a/internal/generated/nqc.raku b/internal/generated/nqc.raku
index 82d2a34..1a293f0 100644
--- a/internal/generated/nqc.raku
+++ b/internal/generated/nqc.raku
@@ -28,10 +28,13 @@ class NQCToGoActions {
     has Bool $!constant-type-set;
 
     method TOP($/) {
-        make "// This file was generated - don't change manually!\n"
-        ~ "package types\n\n"
-        ~ self!constant-go-methods ~ "\n"
-        ~ $<construct>.map(*.made).join('');
+        make qq:to/END/;
+        // Code generated - don't change manually!
+        package types
+        
+        {self!constant-go-methods}
+        {$<construct>.map(*.made).join('')}
+        END
     }
 
     method construct($/) {
@@ -44,7 +47,7 @@ class NQCToGoActions {
 
     method constant($/) {
         push @!const-names: ~$<identifier>;
-        my $const-type = $<identifier>.starts-with('SYS_') ?? ' SyscallId ' !! '';
+        my $const-type = $<identifier>.starts-with('SYS_') ?? ' TraceId ' !! '';
 
         make qq:to/END/;
         const {$<identifier>}$const-type = {$<number>}
@@ -54,23 +57,23 @@ class NQCToGoActions {
     method !constant-go-methods returns Str {
         qq:to/END/;
         type EventType uint32
-        type SyscallId uint32
+        type TraceId uint32
 
-        func (s SyscallId) String() string \{
+        func (s TraceId) String() string \{
             switch (s) \{
             {@!const-names.grep(/^SYS_/).map({
                 "case $_: return \"{$_.subst('SYS_', '').lc}\""
             }).join('; ')}
-            default: panic(fmt.Sprintf("Unknown SyscallId: %d", s))
+            default: panic(fmt.Sprintf("Unknown TraceId: %d", s))
             \}
         \}
 
-        func (s SyscallId) Name() string \{
+        func (s TraceId) Name() string \{
             switch (s) \{
             {@!const-names.grep(/^SYS_/).map({
                 "case $_: return \"{$_.subst(/'SYS_ENTER_'|'SYS_EXIT_'/, '').lc}\""
             }).join('; ')}
-            default: panic(fmt.Sprintf("Unknown SyscallId: %d", s))
+            default: panic(fmt.Sprintf("Unknown TraceId: %d", s))
             \}
         \}
         END
@@ -107,8 +110,8 @@ class NQCToGoActions {
             return $self-ref.EventType
         \}
 
-        func ($self-ref *{$<identifier>.made}) GetSyscallId() SyscallId \{
-            return $self-ref.SyscallId
+        func ($self-ref *{$<identifier>.made}) GetTraceId() TraceId \{
+            return $self-ref.TraceId
         \}
 
         func ($self-ref *{$<identifier>.made}) GetPid() uint32 \{
@@ -150,7 +153,7 @@ class NQCToGoActions {
     }
 
     method member($/) {
-        my Str $type = $<identifier>.made eq 'SyscallId' ?? 'SyscallId' !! $<type>.made;
+        my Str $type = $<identifier>.made eq 'TraceId' ?? 'TraceId' !! $<type>.made;
         $type = 'EventType' if $<identifier>.made eq 'EventType';
         make $<identifier>.made ~ ' ' ~ ($<arraysize> // '') ~ $type;
     }
diff --git a/internal/generated/tracepoints.raku b/internal/generated/tracepoints.raku
index 6cdc0d0..90834a1 100644
--- a/internal/generated/tracepoints.raku
+++ b/internal/generated/tracepoints.raku
@@ -7,7 +7,7 @@ my @tracepoints = gather for $*IN.slurp.split("\n") {
 }
 
 say qq:to/END/;
-// This file was generated - don't change manually!
+// Code generated - don't change manually!
 package tracepoints
 
 var List = []string\{
diff --git a/internal/generated/tracepoints/tracepoints.go b/internal/generated/tracepoints/tracepoints.go
index 41c7d60..22eed77 100644
--- a/internal/generated/tracepoints/tracepoints.go
+++ b/internal/generated/tracepoints/tracepoints.go
@@ -1,4 +1,4 @@
-// This file was generated - don't change manually!
+// Code generated - don't change manually!
 package tracepoints
 
 var List = []string{
diff --git a/internal/generated/types/types.go b/internal/generated/types/types.go
index 30f5936..4abcadc 100644
--- a/internal/generated/types/types.go
+++ b/internal/generated/types/types.go
@@ -1,4 +1,4 @@
-// This file was generated - don't change manually!
+// Code generated - don't change manually!
 package types
 
 import (
@@ -9,9 +9,9 @@ import (
 )
 
 type EventType uint32
-type SyscallId uint32
+type TraceId uint32
 
-func (s SyscallId) String() string {
+func (s TraceId) String() string {
 	switch s {
 	case SYS_EXIT_CACHESTAT:
 		return "exit_cachestat"
@@ -154,11 +154,11 @@ func (s SyscallId) String() string {
 	case SYS_ENTER_OPENAT:
 		return "enter_openat"
 	default:
-		panic(fmt.Sprintf("Unknown SyscallId: %d", s))
+		panic(fmt.Sprintf("Unknown TraceId: %d", s))
 	}
 }
 
-func (s SyscallId) Name() string {
+func (s TraceId) Name() string {
 	switch s {
 	case SYS_EXIT_CACHESTAT:
 		return "cachestat"
@@ -301,7 +301,7 @@ func (s SyscallId) Name() string {
 	case SYS_ENTER_OPENAT:
 		return "openat"
 	default:
-		panic(fmt.Sprintf("Unknown SyscallId: %d", s))
+		panic(fmt.Sprintf("Unknown TraceId: %d", s))
 	}
 }
 
@@ -318,9 +318,9 @@ const EXIT_RET_EVENT = 8
 const ENTER_NAME_EVENT = 9
 const EXIT_NAME_EVENT = 10
 
-type OpenEnterEvent struct {
+type OpenEvent struct {
 	EventType EventType
-	SyscallId SyscallId
+	TraceId   TraceId
 	Pid       uint32
 	Tid       uint32
 	Time      uint32
@@ -328,36 +328,36 @@ type OpenEnterEvent struct {
 	Comm      [MAX_PROGNAME_LENGTH]byte
 }
 
-func (o OpenEnterEvent) String() string {
-	return fmt.Sprintf("EventType:%v SyscallId:%v Pid:%v Tid:%v Time:%v Filename:%v Comm:%v", o.EventType, o.SyscallId, o.Pid, o.Tid, o.Time, string(o.Filename[:]), string(o.Comm[:]))
+func (o OpenEvent) String() string {
+	return fmt.Sprintf("EventType:%v TraceId:%v Pid:%v Tid:%v Time:%v Filename:%v Comm:%v", o.EventType, o.TraceId, o.Pid, o.Tid, o.Time, string(o.Filename[:]), string(o.Comm[:]))
 }
 
-func (o *OpenEnterEvent) GetEventType() EventType {
+func (o *OpenEvent) GetEventType() EventType {
 	return o.EventType
 }
 
-func (o *OpenEnterEvent) GetSyscallId() SyscallId {
-	return o.SyscallId
+func (o *OpenEvent) GetTraceId() TraceId {
+	return o.TraceId
 }
 
-func (o *OpenEnterEvent) GetPid() uint32 {
+func (o *OpenEvent) GetPid() uint32 {
 	return o.Pid
 }
 
-func (o *OpenEnterEvent) GetTid() uint32 {
+func (o *OpenEvent) GetTid() uint32 {
 	return o.Tid
 }
 
-func (o *OpenEnterEvent) GetTime() uint32 {
+func (o *OpenEvent) GetTime() uint32 {
 	return o.Time
 }
 
-var poolOfOpenEnterEvents = sync.Pool{
-	New: func() interface{} { return &OpenEnterEvent{} },
+var poolOfOpenEvents = sync.Pool{
+	New: func() interface{} { return &OpenEvent{} },
 }
 
-func NewOpenEnterEvent(raw []byte) *OpenEnterEvent {
-	o := poolOfOpenEnterEvents.Get().(*OpenEnterEvent)
+func NewOpenEvent(raw []byte) *OpenEvent {
+	o := poolOfOpenEvents.Get().(*OpenEvent)
 	if err := binary.Read(bytes.NewReader(raw), binary.LittleEndian, o); err != nil {
 		fmt.Println(o, raw, len(raw), err)
 		panic(raw)
@@ -365,28 +365,28 @@ func NewOpenEnterEvent(raw []byte) *OpenEnterEvent {
 	return o
 }
 
-func (o *OpenEnterEvent) Recycle() {
-	poolOfOpenEnterEvents.Put(o)
+func (o *OpenEvent) Recycle() {
+	poolOfOpenEvents.Put(o)
 }
 
 type NullEvent struct {
 	EventType EventType
-	SyscallId SyscallId
+	TraceId   TraceId
 	Pid       uint32
 	Tid       uint32
 	Time      uint32
 }
 
 func (n NullEvent) String() string {
-	return fmt.Sprintf("EventType:%v SyscallId:%v Pid:%v Tid:%v Time:%v", n.EventType, n.SyscallId, n.Pid, n.Tid, n.Time)
+	return fmt.Sprintf("EventType:%v TraceId:%v Pid:%v Tid:%v Time:%v", n.EventType, n.TraceId, n.Pid, n.Tid, n.Time)
 }
 
 func (n *NullEvent) GetEventType() EventType {
 	return n.EventType
 }
 
-func (n *NullEvent) GetSyscallId() SyscallId {
-	return n.SyscallId
+func (n *NullEvent) GetTraceId() TraceId {
+	return n.TraceId
 }
 
 func (n *NullEvent) GetPid() uint32 {
@@ -420,7 +420,7 @@ func (n *NullEvent) Recycle() {
 
 type FdEvent struct {
 	EventType EventType
-	SyscallId SyscallId
+	TraceId   TraceId
 	Pid       uint32
 	Tid       uint32
 	Time      uint32
@@ -428,15 +428,15 @@ type FdEvent struct {
 }
 
 func (f FdEvent) String() string {
-	return fmt.Sprintf("EventType:%v SyscallId:%v Pid:%v Tid:%v Time:%v Fd:%v", f.EventType, f.SyscallId, f.Pid, f.Tid, f.Time, f.Fd)
+	return fmt.Sprintf("EventType:%v TraceId:%v Pid:%v Tid:%v Time:%v Fd:%v", f.EventType, f.TraceId, f.Pid, f.Tid, f.Time, f.Fd)
 }
 
 func (f *FdEvent) GetEventType() EventType {
 	return f.EventType
 }
 
-func (f *FdEvent) GetSyscallId() SyscallId {
-	return f.SyscallId
+func (f *FdEvent) GetTraceId() TraceId {
+	return f.TraceId
 }
 
 func (f *FdEvent) GetPid() uint32 {
@@ -470,7 +470,7 @@ func (f *FdEvent) Recycle() {
 
 type RetEvent struct {
 	EventType EventType
-	SyscallId SyscallId
+	TraceId   TraceId
 	Pid       uint32
 	Tid       uint32
 	Ret       int64
@@ -478,15 +478,15 @@ type RetEvent struct {
 }
 
 func (r RetEvent) String() string {
-	return fmt.Sprintf("EventType:%v SyscallId:%v Pid:%v Tid:%v Ret:%v Time:%v", r.EventType, r.SyscallId, r.Pid, r.Tid, r.Ret, r.Time)
+	return fmt.Sprintf("EventType:%v TraceId:%v Pid:%v Tid:%v Ret:%v Time:%v", r.EventType, r.TraceId, r.Pid, r.Tid, r.Ret, r.Time)
 }
 
 func (r *RetEvent) GetEventType() EventType {
 	return r.EventType
 }
 
-func (r *RetEvent) GetSyscallId() SyscallId {
-	return r.SyscallId
+func (r *RetEvent) GetTraceId() TraceId {
+	return r.TraceId
 }
 
 func (r *RetEvent) GetPid() uint32 {
@@ -520,7 +520,7 @@ func (r *RetEvent) Recycle() {
 
 type NameEvent struct {
 	EventType EventType
-	SyscallId SyscallId
+	TraceId   TraceId
 	Pid       uint32
 	Tid       uint32
 	Time      uint32
@@ -529,15 +529,15 @@ type NameEvent struct {
 }
 
 func (n NameEvent) String() string {
-	return fmt.Sprintf("EventType:%v SyscallId:%v Pid:%v Tid:%v Time:%v Oldname:%v Newname:%v", n.EventType, n.SyscallId, n.Pid, n.Tid, n.Time, string(n.Oldname[:]), string(n.Newname[:]))
+	return fmt.Sprintf("EventType:%v TraceId:%v Pid:%v Tid:%v Time:%v Oldname:%v Newname:%v", n.EventType, n.TraceId, n.Pid, n.Tid, n.Time, string(n.Oldname[:]), string(n.Newname[:]))
 }
 
 func (n *NameEvent) GetEventType() EventType {
 	return n.EventType
 }
 
-func (n *NameEvent) GetSyscallId() SyscallId {
-	return n.SyscallId
+func (n *NameEvent) GetTraceId() TraceId {
+	return n.TraceId
 }
 
 func (n *NameEvent) GetPid() uint32 {
@@ -569,73 +569,73 @@ func (n *NameEvent) Recycle() {
 	poolOfNameEvents.Put(n)
 }
 
-const SYS_EXIT_CACHESTAT SyscallId = 520
-const SYS_ENTER_CACHESTAT SyscallId = 521
-const SYS_EXIT_CLOSE_RANGE SyscallId = 692
-const SYS_ENTER_CLOSE_RANGE SyscallId = 693
-const SYS_EXIT_CLOSE SyscallId = 694
-const SYS_ENTER_CLOSE SyscallId = 695
-const SYS_EXIT_FCHOWN SyscallId = 704
-const SYS_ENTER_FCHOWN SyscallId = 705
-const SYS_EXIT_FCHMOD SyscallId = 718
-const SYS_ENTER_FCHMOD SyscallId = 719
-const SYS_EXIT_FCHDIR SyscallId = 722
-const SYS_ENTER_FCHDIR SyscallId = 723
-const SYS_EXIT_FTRUNCATE SyscallId = 734
-const SYS_ENTER_FTRUNCATE SyscallId = 735
-const SYS_EXIT_COPY_FILE_RANGE SyscallId = 738
-const SYS_ENTER_COPY_FILE_RANGE SyscallId = 739
-const SYS_EXIT_PWRITE64 SyscallId = 754
-const SYS_ENTER_PWRITE64 SyscallId = 755
-const SYS_EXIT_PREAD64 SyscallId = 756
-const SYS_ENTER_PREAD64 SyscallId = 757
-const SYS_EXIT_WRITE SyscallId = 758
-const SYS_ENTER_WRITE SyscallId = 759
-const SYS_EXIT_READ SyscallId = 760
-const SYS_ENTER_READ SyscallId = 761
-const SYS_EXIT_LSEEK SyscallId = 762
-const SYS_ENTER_LSEEK SyscallId = 763
-const SYS_EXIT_NEWFSTAT SyscallId = 770
-const SYS_ENTER_NEWFSTAT SyscallId = 771
-const SYS_EXIT_RENAME SyscallId = 786
-const SYS_ENTER_RENAME SyscallId = 787
-const SYS_EXIT_RENAMEAT SyscallId = 788
-const SYS_ENTER_RENAMEAT SyscallId = 789
-const SYS_EXIT_RENAMEAT2 SyscallId = 790
-const SYS_ENTER_RENAMEAT2 SyscallId = 791
-const SYS_EXIT_LINK SyscallId = 792
-const SYS_ENTER_LINK SyscallId = 793
-const SYS_EXIT_LINKAT SyscallId = 794
-const SYS_ENTER_LINKAT SyscallId = 795
-const SYS_EXIT_SYMLINK SyscallId = 796
-const SYS_ENTER_SYMLINK SyscallId = 797
-const SYS_EXIT_SYMLINKAT SyscallId = 798
-const SYS_ENTER_SYMLINKAT SyscallId = 799
-const SYS_EXIT_FCNTL SyscallId = 814
-const SYS_ENTER_FCNTL SyscallId = 815
-const SYS_EXIT_IOCTL SyscallId = 816
-const SYS_ENTER_IOCTL SyscallId = 817
-const SYS_EXIT_GETDENTS64 SyscallId = 818
-const SYS_ENTER_GETDENTS64 SyscallId = 819
-const SYS_EXIT_GETDENTS SyscallId = 820
-const SYS_ENTER_GETDENTS SyscallId = 821
-const SYS_EXIT_SYNC_FILE_RANGE SyscallId = 914
-const SYS_ENTER_SYNC_FILE_RANGE SyscallId = 915
-const SYS_EXIT_FDATASYNC SyscallId = 916
-const SYS_ENTER_FDATASYNC SyscallId = 917
-const SYS_EXIT_FSYNC SyscallId = 918
-const SYS_ENTER_FSYNC SyscallId = 919
-const SYS_EXIT_FSTATFS SyscallId = 936
-const SYS_ENTER_FSTATFS SyscallId = 937
-const SYS_EXIT_FLOCK SyscallId = 1012
-const SYS_ENTER_FLOCK SyscallId = 1013
-const SYS_EXIT_QUOTACTL_FD SyscallId = 1043
-const SYS_ENTER_QUOTACTL_FD SyscallId = 1044
-const SYS_EXIT_IO_URING_REGISTER SyscallId = 1366
-const SYS_ENTER_IO_URING_REGISTER SyscallId = 1367
-const SYS_EXIT_IO_URING_ENTER SyscallId = 1370
-const SYS_ENTER_IO_URING_ENTER SyscallId = 1371
-const SYS_EXIT_OPEN SyscallId = 1
-const SYS_ENTER_OPEN SyscallId = 2
-const SYS_EXIT_OPENAT SyscallId = 3
-const SYS_ENTER_OPENAT SyscallId = 4
+const SYS_EXIT_CACHESTAT TraceId = 520
+const SYS_ENTER_CACHESTAT TraceId = 521
+const SYS_EXIT_CLOSE_RANGE TraceId = 692
+const SYS_ENTER_CLOSE_RANGE TraceId = 693
+const SYS_EXIT_CLOSE TraceId = 694
+const SYS_ENTER_CLOSE TraceId = 695
+const SYS_EXIT_FCHOWN TraceId = 704
+const SYS_ENTER_FCHOWN TraceId = 705
+const SYS_EXIT_FCHMOD TraceId = 718
+const SYS_ENTER_FCHMOD TraceId = 719
+const SYS_EXIT_FCHDIR TraceId = 722
+const SYS_ENTER_FCHDIR TraceId = 723
+const SYS_EXIT_FTRUNCATE TraceId = 734
+const SYS_ENTER_FTRUNCATE TraceId = 735
+const SYS_EXIT_COPY_FILE_RANGE TraceId = 738
+const SYS_ENTER_COPY_FILE_RANGE TraceId = 739
+const SYS_EXIT_PWRITE64 TraceId = 754
+const SYS_ENTER_PWRITE64 TraceId = 755
+const SYS_EXIT_PREAD64 TraceId = 756
+const SYS_ENTER_PREAD64 TraceId = 757
+const SYS_EXIT_WRITE TraceId = 758
+const SYS_ENTER_WRITE TraceId = 759
+const SYS_EXIT_READ TraceId = 760
+const SYS_ENTER_READ TraceId = 761
+const SYS_EXIT_LSEEK TraceId = 762
+const SYS_ENTER_LSEEK TraceId = 763
+const SYS_EXIT_NEWFSTAT TraceId = 770
+const SYS_ENTER_NEWFSTAT TraceId = 771
+const SYS_EXIT_RENAME TraceId = 786
+const SYS_ENTER_RENAME TraceId = 787
+const SYS_EXIT_RENAMEAT TraceId = 788
+const SYS_ENTER_RENAMEAT TraceId = 789
+const SYS_EXIT_RENAMEAT2 TraceId = 790
+const SYS_ENTER_RENAMEAT2 TraceId = 791
+const SYS_EXIT_LINK TraceId = 792
+const SYS_ENTER_LINK TraceId = 793
+const SYS_EXIT_LINKAT TraceId = 794
+const SYS_ENTER_LINKAT TraceId = 795
+const SYS_EXIT_SYMLINK TraceId = 796
+const SYS_ENTER_SYMLINK TraceId = 797
+const SYS_EXIT_SYMLINKAT TraceId = 798
+const SYS_ENTER_SYMLINKAT TraceId = 799
+const SYS_EXIT_FCNTL TraceId = 814
+const SYS_ENTER_FCNTL TraceId = 815
+const SYS_EXIT_IOCTL TraceId = 816
+const SYS_ENTER_IOCTL TraceId = 817
+const SYS_EXIT_GETDENTS64 TraceId = 818
+const SYS_ENTER_GETDENTS64 TraceId = 819
+const SYS_EXIT_GETDENTS TraceId = 820
+const SYS_ENTER_GETDENTS TraceId = 821
+const SYS_EXIT_SYNC_FILE_RANGE TraceId = 914
+const SYS_ENTER_SYNC_FILE_RANGE TraceId = 915
+const SYS_EXIT_FDATASYNC TraceId = 916
+const SYS_ENTER_FDATASYNC TraceId = 917
+const SYS_EXIT_FSYNC TraceId = 918
+const SYS_ENTER_FSYNC TraceId = 919
+const SYS_EXIT_FSTATFS TraceId = 936
+const SYS_ENTER_FSTATFS TraceId = 937
+const SYS_EXIT_FLOCK TraceId = 1012
+const SYS_ENTER_FLOCK TraceId = 1013
+const SYS_EXIT_QUOTACTL_FD TraceId = 1043
+const SYS_ENTER_QUOTACTL_FD TraceId = 1044
+const SYS_EXIT_IO_URING_REGISTER TraceId = 1366
+const SYS_ENTER_IO_URING_REGISTER TraceId = 1367
+const SYS_EXIT_IO_URING_ENTER TraceId = 1370
+const SYS_ENTER_IO_URING_ENTER TraceId = 1371
+const SYS_EXIT_OPEN TraceId = 1
+const SYS_ENTER_OPEN TraceId = 2
+const SYS_EXIT_OPENAT TraceId = 3
+const SYS_ENTER_OPENAT TraceId = 4