Also auto-generate open syscalls.

5 files changed, 1669 insertions, 727 deletions

diff --git a/internal/c/generated/tracepoints.c b/internal/c/generated/tracepoints.c
index 8ba2028..e1cb7d6 100644
--- a/internal/c/generated/tracepoints.c
+++ b/internal/c/generated/tracepoints.c
@@ -1,114 +1,177 @@
 // Code generated - don't change manually!
 
-#define SYS_EXIT_CACHESTAT 527
-#define SYS_ENTER_CACHESTAT 528
-#define SYS_EXIT_CLOSE_RANGE 700
-#define SYS_ENTER_CLOSE_RANGE 701
-#define SYS_EXIT_CLOSE 702
-#define SYS_ENTER_CLOSE 703
-#define SYS_EXIT_CREAT 704
-#define SYS_ENTER_CREAT 705
-#define SYS_EXIT_FCHOWN 712
-#define SYS_ENTER_FCHOWN 713
-#define SYS_EXIT_FCHMOD 726
-#define SYS_ENTER_FCHMOD 727
-#define SYS_EXIT_FCHDIR 730
-#define SYS_ENTER_FCHDIR 731
-#define SYS_EXIT_FTRUNCATE 742
-#define SYS_ENTER_FTRUNCATE 743
-#define SYS_EXIT_COPY_FILE_RANGE 746
-#define SYS_ENTER_COPY_FILE_RANGE 747
-#define SYS_EXIT_PWRITE64 762
-#define SYS_ENTER_PWRITE64 763
-#define SYS_EXIT_PREAD64 764
-#define SYS_ENTER_PREAD64 765
-#define SYS_EXIT_WRITE 766
-#define SYS_ENTER_WRITE 767
-#define SYS_EXIT_READ 768
-#define SYS_ENTER_READ 769
-#define SYS_EXIT_LSEEK 770
-#define SYS_ENTER_LSEEK 771
-#define SYS_EXIT_READLINKAT 776
-#define SYS_ENTER_READLINKAT 777
-#define SYS_EXIT_NEWFSTAT 778
-#define SYS_ENTER_NEWFSTAT 779
-#define SYS_EXIT_RENAME 794
-#define SYS_ENTER_RENAME 795
-#define SYS_EXIT_RENAMEAT 796
-#define SYS_ENTER_RENAMEAT 797
-#define SYS_EXIT_RENAMEAT2 798
-#define SYS_ENTER_RENAMEAT2 799
-#define SYS_EXIT_LINK 800
-#define SYS_ENTER_LINK 801
-#define SYS_EXIT_LINKAT 802
-#define SYS_ENTER_LINKAT 803
-#define SYS_EXIT_SYMLINK 804
-#define SYS_ENTER_SYMLINK 805
-#define SYS_EXIT_SYMLINKAT 806
-#define SYS_ENTER_SYMLINKAT 807
-#define SYS_EXIT_UNLINK 808
-#define SYS_ENTER_UNLINK 809
-#define SYS_EXIT_UNLINKAT 810
-#define SYS_ENTER_UNLINKAT 811
-#define SYS_EXIT_RMDIR 812
-#define SYS_ENTER_RMDIR 813
-#define SYS_EXIT_MKDIR 814
-#define SYS_ENTER_MKDIR 815
-#define SYS_EXIT_MKDIRAT 816
-#define SYS_ENTER_MKDIRAT 817
-#define SYS_EXIT_FCNTL 822
-#define SYS_ENTER_FCNTL 823
-#define SYS_EXIT_IOCTL 824
-#define SYS_ENTER_IOCTL 825
-#define SYS_EXIT_GETDENTS64 826
-#define SYS_ENTER_GETDENTS64 827
-#define SYS_EXIT_GETDENTS 828
-#define SYS_ENTER_GETDENTS 829
-#define SYS_EXIT_LREMOVEXATTR 862
-#define SYS_ENTER_LREMOVEXATTR 863
-#define SYS_EXIT_REMOVEXATTR 864
-#define SYS_ENTER_REMOVEXATTR 865
-#define SYS_EXIT_LLISTXATTR 868
-#define SYS_ENTER_LLISTXATTR 869
-#define SYS_EXIT_LISTXATTR 870
-#define SYS_ENTER_LISTXATTR 871
-#define SYS_EXIT_LGETXATTR 874
-#define SYS_ENTER_LGETXATTR 875
-#define SYS_EXIT_GETXATTR 876
-#define SYS_ENTER_GETXATTR 877
-#define SYS_EXIT_LSETXATTR 880
-#define SYS_ENTER_LSETXATTR 881
-#define SYS_EXIT_SETXATTR 882
-#define SYS_ENTER_SETXATTR 883
-#define SYS_EXIT_SYNC_FILE_RANGE 922
-#define SYS_ENTER_SYNC_FILE_RANGE 923
-#define SYS_EXIT_FDATASYNC 924
-#define SYS_ENTER_FDATASYNC 925
-#define SYS_EXIT_FSYNC 926
-#define SYS_ENTER_FSYNC 927
-#define SYS_EXIT_FSTATFS 944
-#define SYS_ENTER_FSTATFS 945
-#define SYS_EXIT_STATFS 946
-#define SYS_ENTER_STATFS 947
-#define SYS_EXIT_INOTIFY_RM_WATCH 954
-#define SYS_ENTER_INOTIFY_RM_WATCH 955
-#define SYS_EXIT_INOTIFY_ADD_WATCH 956
-#define SYS_ENTER_INOTIFY_ADD_WATCH 957
-#define SYS_EXIT_FANOTIFY_MARK 962
-#define SYS_ENTER_FANOTIFY_MARK 963
-#define SYS_EXIT_FLOCK 1020
-#define SYS_ENTER_FLOCK 1021
-#define SYS_EXIT_QUOTACTL_FD 1051
-#define SYS_ENTER_QUOTACTL_FD 1052
-#define SYS_EXIT_MQ_UNLINK 1321
-#define SYS_ENTER_MQ_UNLINK 1322
-#define SYS_EXIT_IO_URING_REGISTER 1377
-#define SYS_ENTER_IO_URING_REGISTER 1378
-#define SYS_EXIT_IO_URING_ENTER 1381
 #define SYS_ENTER_IO_URING_ENTER 1382
+#define SYS_EXIT_IO_URING_ENTER 1381
+#define SYS_ENTER_IO_URING_REGISTER 1378
+#define SYS_EXIT_IO_URING_REGISTER 1377
+#define SYS_ENTER_QUOTACTL_FD 1052
+#define SYS_EXIT_QUOTACTL_FD 1051
+#define SYS_ENTER_FLOCK 1021
+#define SYS_EXIT_FLOCK 1020
+#define SYS_ENTER_FANOTIFY_MARK 963
+#define SYS_EXIT_FANOTIFY_MARK 962
+#define SYS_ENTER_INOTIFY_ADD_WATCH 957
+#define SYS_EXIT_INOTIFY_ADD_WATCH 956
+#define SYS_ENTER_STATFS 947
+#define SYS_EXIT_STATFS 946
+#define SYS_ENTER_FSTATFS 945
+#define SYS_EXIT_FSTATFS 944
+#define SYS_ENTER_UTIMENSAT 939
+#define SYS_EXIT_UTIMENSAT 938
+#define SYS_ENTER_FUTIMESAT 937
+#define SYS_EXIT_FUTIMESAT 936
+#define SYS_ENTER_FSYNC 927
+#define SYS_EXIT_FSYNC 926
+#define SYS_ENTER_FDATASYNC 925
+#define SYS_EXIT_FDATASYNC 924
+#define SYS_ENTER_SETXATTR 883
+#define SYS_EXIT_SETXATTR 882
+#define SYS_ENTER_LSETXATTR 881
+#define SYS_EXIT_LSETXATTR 880
+#define SYS_ENTER_GETXATTR 877
+#define SYS_EXIT_GETXATTR 876
+#define SYS_ENTER_LGETXATTR 875
+#define SYS_EXIT_LGETXATTR 874
+#define SYS_ENTER_LISTXATTR 871
+#define SYS_EXIT_LISTXATTR 870
+#define SYS_ENTER_LLISTXATTR 869
+#define SYS_EXIT_LLISTXATTR 868
+#define SYS_ENTER_REMOVEXATTR 865
+#define SYS_EXIT_REMOVEXATTR 864
+#define SYS_ENTER_LREMOVEXATTR 863
+#define SYS_EXIT_LREMOVEXATTR 862
+#define SYS_ENTER_OPEN_TREE 857
+#define SYS_EXIT_OPEN_TREE 856
+#define SYS_ENTER_GETDENTS 829
+#define SYS_EXIT_GETDENTS 828
+#define SYS_ENTER_GETDENTS64 827
+#define SYS_EXIT_GETDENTS64 826
+#define SYS_ENTER_IOCTL 825
+#define SYS_EXIT_IOCTL 824
+#define SYS_ENTER_FCNTL 823
+#define SYS_EXIT_FCNTL 822
+#define SYS_ENTER_MKNODAT 821
+#define SYS_EXIT_MKNODAT 820
+#define SYS_ENTER_MKNOD 819
+#define SYS_EXIT_MKNOD 818
+#define SYS_ENTER_MKDIRAT 817
+#define SYS_EXIT_MKDIRAT 816
+#define SYS_ENTER_MKDIR 815
+#define SYS_EXIT_MKDIR 814
+#define SYS_ENTER_RMDIR 813
+#define SYS_EXIT_RMDIR 812
+#define SYS_ENTER_UNLINKAT 811
+#define SYS_EXIT_UNLINKAT 810
+#define SYS_ENTER_UNLINK 809
+#define SYS_EXIT_UNLINK 808
+#define SYS_ENTER_SYMLINKAT 807
+#define SYS_EXIT_SYMLINKAT 806
+#define SYS_ENTER_SYMLINK 805
+#define SYS_EXIT_SYMLINK 804
+#define SYS_ENTER_LINKAT 803
+#define SYS_EXIT_LINKAT 802
+#define SYS_ENTER_LINK 801
+#define SYS_EXIT_LINK 800
+#define SYS_ENTER_RENAMEAT2 799
+#define SYS_EXIT_RENAMEAT2 798
+#define SYS_ENTER_RENAMEAT 797
+#define SYS_EXIT_RENAMEAT 796
+#define SYS_ENTER_RENAME 795
+#define SYS_EXIT_RENAME 794
+#define SYS_ENTER_EXECVE 789
+#define SYS_EXIT_EXECVE 788
+#define SYS_ENTER_EXECVEAT 787
+#define SYS_EXIT_EXECVEAT 786
+#define SYS_ENTER_NEWSTAT 785
+#define SYS_EXIT_NEWSTAT 784
+#define SYS_ENTER_NEWLSTAT 783
+#define SYS_EXIT_NEWLSTAT 782
+#define SYS_ENTER_NEWFSTATAT 781
+#define SYS_EXIT_NEWFSTATAT 780
+#define SYS_ENTER_NEWFSTAT 779
+#define SYS_EXIT_NEWFSTAT 778
+#define SYS_ENTER_READLINKAT 777
+#define SYS_EXIT_READLINKAT 776
+#define SYS_ENTER_STATX 773
+#define SYS_EXIT_STATX 772
+#define SYS_ENTER_LSEEK 771
+#define SYS_EXIT_LSEEK 770
+#define SYS_ENTER_READ 769
+#define SYS_EXIT_READ 768
+#define SYS_ENTER_WRITE 767
+#define SYS_EXIT_WRITE 766
+#define SYS_ENTER_PREAD64 765
+#define SYS_EXIT_PREAD64 764
+#define SYS_ENTER_PWRITE64 763
+#define SYS_EXIT_PWRITE64 762
+#define SYS_ENTER_FTRUNCATE 743
+#define SYS_EXIT_FTRUNCATE 742
+#define SYS_ENTER_FACCESSAT 739
+#define SYS_EXIT_FACCESSAT 738
+#define SYS_ENTER_FACCESSAT2 737
+#define SYS_EXIT_FACCESSAT2 736
+#define SYS_ENTER_ACCESS 735
+#define SYS_EXIT_ACCESS 734
+#define SYS_ENTER_CHDIR 733
+#define SYS_EXIT_CHDIR 732
+#define SYS_ENTER_FCHDIR 731
+#define SYS_EXIT_FCHDIR 730
+#define SYS_ENTER_CHROOT 729
+#define SYS_EXIT_CHROOT 728
+#define SYS_ENTER_FCHMOD 727
+#define SYS_EXIT_FCHMOD 726
+#define SYS_ENTER_FCHMODAT2 725
+#define SYS_EXIT_FCHMODAT2 724
+#define SYS_ENTER_FCHMODAT 723
+#define SYS_EXIT_FCHMODAT 722
+#define SYS_ENTER_CHMOD 721
+#define SYS_EXIT_CHMOD 720
+#define SYS_ENTER_FCHOWNAT 719
+#define SYS_EXIT_FCHOWNAT 718
+#define SYS_ENTER_CHOWN 717
+#define SYS_EXIT_CHOWN 716
+#define SYS_ENTER_LCHOWN 715
+#define SYS_EXIT_LCHOWN 714
+#define SYS_ENTER_FCHOWN 713
+#define SYS_EXIT_FCHOWN 712
+#define SYS_ENTER_OPEN 711
+#define SYS_EXIT_OPEN 710
+#define SYS_ENTER_OPENAT 709
+#define SYS_EXIT_OPENAT 708
+#define SYS_ENTER_OPENAT2 707
+#define SYS_EXIT_OPENAT2 706
+#define SYS_ENTER_CREAT 705
+#define SYS_EXIT_CREAT 704
+#define SYS_ENTER_CLOSE 703
+#define SYS_EXIT_CLOSE 702
+#define SYS_ENTER_CLOSE_RANGE 701
+#define SYS_EXIT_CLOSE_RANGE 700
+#define SYS_ENTER_CACHESTAT 528
+#define SYS_EXIT_CACHESTAT 527
 
-SEC("tracepoint/syscalls/sys_exit_cachestat")
-int handle_sys_exit_cachestat(struct trace_event_raw_sys_exit *ctx) {
+SEC("tracepoint/syscalls/sys_enter_io_uring_enter")
+int handle_sys_enter_io_uring_enter(struct trace_event_raw_sys_enter *ctx) {
+    __u32 pid, tid;
+    if (filter(&pid, &tid))
+        return 0;
+
+    struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
+    if (!ev)
+        return 0;
+
+    ev->event_type = ENTER_FD_EVENT;
+    ev->trace_id = SYS_ENTER_IO_URING_ENTER;
+    ev->pid = pid;
+    ev->tid = tid;
+    ev->time = bpf_ktime_get_ns() / 1000;
+    ev->fd = (__s32)ctx->args[0];
+
+    bpf_ringbuf_submit(ev, 0);
+    return 0;
+}
+
+SEC("tracepoint/syscalls/sys_exit_io_uring_enter")
+int handle_sys_exit_io_uring_enter(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -118,18 +181,18 @@ int handle_sys_exit_cachestat(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->trace_id = SYS_EXIT_CACHESTAT;
+    ev->trace_id = SYS_EXIT_IO_URING_ENTER;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
-    ev->ret = ctx->ret;
+    ev->ret = ctx->ret; 
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_cachestat")
-int handle_sys_enter_cachestat(struct trace_event_raw_sys_enter *ctx) {
+SEC("tracepoint/syscalls/sys_enter_io_uring_register")
+int handle_sys_enter_io_uring_register(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -139,7 +202,7 @@ int handle_sys_enter_cachestat(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->trace_id = SYS_ENTER_CACHESTAT;
+    ev->trace_id = SYS_ENTER_IO_URING_REGISTER;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -149,8 +212,8 @@ int handle_sys_enter_cachestat(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_close_range")
-int handle_sys_exit_close_range(struct trace_event_raw_sys_exit *ctx) {
+SEC("tracepoint/syscalls/sys_exit_io_uring_register")
+int handle_sys_exit_io_uring_register(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -160,18 +223,18 @@ int handle_sys_exit_close_range(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->trace_id = SYS_EXIT_CLOSE_RANGE;
+    ev->trace_id = SYS_EXIT_IO_URING_REGISTER;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
-    ev->ret = ctx->ret;
+    ev->ret = ctx->ret; 
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_close_range")
-int handle_sys_enter_close_range(struct trace_event_raw_sys_enter *ctx) {
+SEC("tracepoint/syscalls/sys_enter_quotactl_fd")
+int handle_sys_enter_quotactl_fd(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -181,7 +244,7 @@ int handle_sys_enter_close_range(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->trace_id = SYS_ENTER_CLOSE_RANGE;
+    ev->trace_id = SYS_ENTER_QUOTACTL_FD;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -191,8 +254,8 @@ int handle_sys_enter_close_range(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_close")
-int handle_sys_exit_close(struct trace_event_raw_sys_exit *ctx) {
+SEC("tracepoint/syscalls/sys_exit_quotactl_fd")
+int handle_sys_exit_quotactl_fd(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -202,18 +265,18 @@ int handle_sys_exit_close(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->trace_id = SYS_EXIT_CLOSE;
+    ev->trace_id = SYS_EXIT_QUOTACTL_FD;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
-    ev->ret = ctx->ret;
+    ev->ret = ctx->ret; 
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_close")
-int handle_sys_enter_close(struct trace_event_raw_sys_enter *ctx) {
+SEC("tracepoint/syscalls/sys_enter_flock")
+int handle_sys_enter_flock(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -223,7 +286,7 @@ int handle_sys_enter_close(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->trace_id = SYS_ENTER_CLOSE;
+    ev->trace_id = SYS_ENTER_FLOCK;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -233,8 +296,8 @@ int handle_sys_enter_close(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_creat")
-int handle_sys_exit_creat(struct trace_event_raw_sys_exit *ctx) {
+SEC("tracepoint/syscalls/sys_exit_flock")
+int handle_sys_exit_flock(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -244,18 +307,18 @@ int handle_sys_exit_creat(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->trace_id = SYS_EXIT_CREAT;
+    ev->trace_id = SYS_EXIT_FLOCK;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
-    ev->ret = ctx->ret;
+    ev->ret = ctx->ret; 
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_creat")
-int handle_sys_enter_creat(struct trace_event_raw_sys_enter *ctx) {
+SEC("tracepoint/syscalls/sys_enter_fanotify_mark")
+int handle_sys_enter_fanotify_mark(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -265,7 +328,93 @@ int handle_sys_enter_creat(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_PATH_EVENT;
-    ev->trace_id = SYS_ENTER_CREAT;
+    ev->trace_id = SYS_ENTER_FANOTIFY_MARK;
+    ev->pid = pid;
+    ev->tid = tid;
+    ev->time = bpf_ktime_get_ns() / 1000;
+    __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
+    bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[4]);
+
+    bpf_ringbuf_submit(ev, 0);
+    return 0;
+}
+
+SEC("tracepoint/syscalls/sys_exit_fanotify_mark")
+int handle_sys_exit_fanotify_mark(struct trace_event_raw_sys_exit *ctx) {
+    __u32 pid, tid;
+    if (filter(&pid, &tid))
+        return 0;
+
+    struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
+    if (!ev)
+        return 0;
+
+    ev->event_type = EXIT_RET_EVENT;
+    ev->trace_id = SYS_EXIT_FANOTIFY_MARK;
+    ev->pid = pid;
+    ev->tid = tid;
+    ev->time = bpf_ktime_get_ns() / 1000;
+    ev->ret = ctx->ret; 
+
+    bpf_ringbuf_submit(ev, 0);
+    return 0;
+}
+
+SEC("tracepoint/syscalls/sys_enter_inotify_add_watch")
+int handle_sys_enter_inotify_add_watch(struct trace_event_raw_sys_enter *ctx) {
+    __u32 pid, tid;
+    if (filter(&pid, &tid))
+        return 0;
+
+    struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0);
+    if (!ev)
+        return 0;
+
+    ev->event_type = ENTER_PATH_EVENT;
+    ev->trace_id = SYS_ENTER_INOTIFY_ADD_WATCH;
+    ev->pid = pid;
+    ev->tid = tid;
+    ev->time = bpf_ktime_get_ns() / 1000;
+    __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
+    bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[1]);
+
+    bpf_ringbuf_submit(ev, 0);
+    return 0;
+}
+
+SEC("tracepoint/syscalls/sys_exit_inotify_add_watch")
+int handle_sys_exit_inotify_add_watch(struct trace_event_raw_sys_exit *ctx) {
+    __u32 pid, tid;
+    if (filter(&pid, &tid))
+        return 0;
+
+    struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
+    if (!ev)
+        return 0;
+
+    ev->event_type = EXIT_RET_EVENT;
+    ev->trace_id = SYS_EXIT_INOTIFY_ADD_WATCH;
+    ev->pid = pid;
+    ev->tid = tid;
+    ev->time = bpf_ktime_get_ns() / 1000;
+    ev->ret = ctx->ret; 
+
+    bpf_ringbuf_submit(ev, 0);
+    return 0;
+}
+
+SEC("tracepoint/syscalls/sys_enter_statfs")
+int handle_sys_enter_statfs(struct trace_event_raw_sys_enter *ctx) {
+    __u32 pid, tid;
+    if (filter(&pid, &tid))
+        return 0;
+
+    struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0);
+    if (!ev)
+        return 0;
+
+    ev->event_type = ENTER_PATH_EVENT;
+    ev->trace_id = SYS_ENTER_STATFS;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -276,8 +425,8 @@ int handle_sys_enter_creat(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_fchown")
-int handle_sys_exit_fchown(struct trace_event_raw_sys_exit *ctx) {
+SEC("tracepoint/syscalls/sys_exit_statfs")
+int handle_sys_exit_statfs(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -287,18 +436,18 @@ int handle_sys_exit_fchown(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->trace_id = SYS_EXIT_FCHOWN;
+    ev->trace_id = SYS_EXIT_STATFS;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
-    ev->ret = ctx->ret;
+    ev->ret = ctx->ret; 
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_fchown")
-int handle_sys_enter_fchown(struct trace_event_raw_sys_enter *ctx) {
+SEC("tracepoint/syscalls/sys_enter_fstatfs")
+int handle_sys_enter_fstatfs(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -308,7 +457,7 @@ int handle_sys_enter_fchown(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->trace_id = SYS_ENTER_FCHOWN;
+    ev->trace_id = SYS_ENTER_FSTATFS;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -318,8 +467,8 @@ int handle_sys_enter_fchown(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_fchmod")
-int handle_sys_exit_fchmod(struct trace_event_raw_sys_exit *ctx) {
+SEC("tracepoint/syscalls/sys_exit_fstatfs")
+int handle_sys_exit_fstatfs(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -329,39 +478,41 @@ int handle_sys_exit_fchmod(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->trace_id = SYS_EXIT_FCHMOD;
+    ev->trace_id = SYS_EXIT_FSTATFS;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
-    ev->ret = ctx->ret;
+    ev->ret = ctx->ret; 
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_fchmod")
-int handle_sys_enter_fchmod(struct trace_event_raw_sys_enter *ctx) {
+SEC("tracepoint/syscalls/sys_enter_utimensat")
+int handle_sys_enter_utimensat(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
+    struct open_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct open_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_FD_EVENT;
-    ev->trace_id = SYS_ENTER_FCHMOD;
+    ev->event_type = ENTER_OPEN_EVENT;
+    ev->trace_id = SYS_ENTER_UTIMENSAT;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
-    ev->fd = (__s32)ctx->args[0];
+    __builtin_memset(&(ev->filename), 0, sizeof(ev->filename) + sizeof(ev->comm));
+    bpf_probe_read_user_str(ev->filename, sizeof(ev->filename), (void *)ctx->args[1]);
+    bpf_get_current_comm(&ev->comm, sizeof(ev->comm));
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_fchdir")
-int handle_sys_exit_fchdir(struct trace_event_raw_sys_exit *ctx) {
+SEC("tracepoint/syscalls/sys_exit_utimensat")
+int handle_sys_exit_utimensat(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -371,18 +522,62 @@ int handle_sys_exit_fchdir(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->trace_id = SYS_EXIT_FCHDIR;
+    ev->trace_id = SYS_EXIT_UTIMENSAT;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
-    ev->ret = ctx->ret;
+    ev->ret = ctx->ret; 
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_fchdir")
-int handle_sys_enter_fchdir(struct trace_event_raw_sys_enter *ctx) {
+SEC("tracepoint/syscalls/sys_enter_futimesat")
+int handle_sys_enter_futimesat(struct trace_event_raw_sys_enter *ctx) {
+    __u32 pid, tid;
+    if (filter(&pid, &tid))
+        return 0;
+
+    struct open_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct open_event), 0);
+    if (!ev)
+        return 0;
+
+    ev->event_type = ENTER_OPEN_EVENT;
+    ev->trace_id = SYS_ENTER_FUTIMESAT;
+    ev->pid = pid;
+    ev->tid = tid;
+    ev->time = bpf_ktime_get_ns() / 1000;
+    __builtin_memset(&(ev->filename), 0, sizeof(ev->filename) + sizeof(ev->comm));
+    bpf_probe_read_user_str(ev->filename, sizeof(ev->filename), (void *)ctx->args[1]);
+    bpf_get_current_comm(&ev->comm, sizeof(ev->comm));
+
+    bpf_ringbuf_submit(ev, 0);
+    return 0;
+}
+
+SEC("tracepoint/syscalls/sys_exit_futimesat")
+int handle_sys_exit_futimesat(struct trace_event_raw_sys_exit *ctx) {
+    __u32 pid, tid;
+    if (filter(&pid, &tid))
+        return 0;
+
+    struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
+    if (!ev)
+        return 0;
+
+    ev->event_type = EXIT_RET_EVENT;
+    ev->trace_id = SYS_EXIT_FUTIMESAT;
+    ev->pid = pid;
+    ev->tid = tid;
+    ev->time = bpf_ktime_get_ns() / 1000;
+    ev->ret = ctx->ret; 
+
+    bpf_ringbuf_submit(ev, 0);
+    return 0;
+}
+
+SEC("tracepoint/syscalls/sys_enter_fsync")
+int handle_sys_enter_fsync(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -392,7 +587,7 @@ int handle_sys_enter_fchdir(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->trace_id = SYS_ENTER_FCHDIR;
+    ev->trace_id = SYS_ENTER_FSYNC;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -402,8 +597,8 @@ int handle_sys_enter_fchdir(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_ftruncate")
-int handle_sys_exit_ftruncate(struct trace_event_raw_sys_exit *ctx) {
+SEC("tracepoint/syscalls/sys_exit_fsync")
+int handle_sys_exit_fsync(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -413,18 +608,18 @@ int handle_sys_exit_ftruncate(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->trace_id = SYS_EXIT_FTRUNCATE;
+    ev->trace_id = SYS_EXIT_FSYNC;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
-    ev->ret = ctx->ret;
+    ev->ret = ctx->ret; 
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_ftruncate")
-int handle_sys_enter_ftruncate(struct trace_event_raw_sys_enter *ctx) {
+SEC("tracepoint/syscalls/sys_enter_fdatasync")
+int handle_sys_enter_fdatasync(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -434,7 +629,7 @@ int handle_sys_enter_ftruncate(struct trace_event_raw_sys_enter *ctx) {
         return 0;
 
     ev->event_type = ENTER_FD_EVENT;
-    ev->trace_id = SYS_ENTER_FTRUNCATE;
+    ev->trace_id = SYS_ENTER_FDATASYNC;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -444,8 +639,8 @@ int handle_sys_enter_ftruncate(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_copy_file_range")
-int handle_sys_exit_copy_file_range(struct trace_event_raw_sys_exit *ctx) {
+SEC("tracepoint/syscalls/sys_exit_fdatasync")
+int handle_sys_exit_fdatasync(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -455,39 +650,40 @@ int handle_sys_exit_copy_file_range(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->trace_id = SYS_EXIT_COPY_FILE_RANGE;
+    ev->trace_id = SYS_EXIT_FDATASYNC;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
-    ev->ret = ctx->ret;
+    ev->ret = ctx->ret; 
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_copy_file_range")
-int handle_sys_enter_copy_file_range(struct trace_event_raw_sys_enter *ctx) {
+SEC("tracepoint/syscalls/sys_enter_setxattr")
+int handle_sys_enter_setxattr(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_NULL_EVENT;
-    ev->trace_id = SYS_ENTER_COPY_FILE_RANGE;
+    ev->event_type = ENTER_PATH_EVENT;
+    ev->trace_id = SYS_ENTER_SETXATTR;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
-    
+    __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
+    bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_pwrite64")
-int handle_sys_exit_pwrite64(struct trace_event_raw_sys_exit *ctx) {
+SEC("tracepoint/syscalls/sys_exit_setxattr")
+int handle_sys_exit_setxattr(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -497,39 +693,40 @@ int handle_sys_exit_pwrite64(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->trace_id = SYS_EXIT_PWRITE64;
+    ev->trace_id = SYS_EXIT_SETXATTR;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
-    ev->ret = ctx->ret;
+    ev->ret = ctx->ret; 
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_pwrite64")
-int handle_sys_enter_pwrite64(struct trace_event_raw_sys_enter *ctx) {
+SEC("tracepoint/syscalls/sys_enter_lsetxattr")
+int handle_sys_enter_lsetxattr(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
+    struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_FD_EVENT;
-    ev->trace_id = SYS_ENTER_PWRITE64;
+    ev->event_type = ENTER_PATH_EVENT;
+    ev->trace_id = SYS_ENTER_LSETXATTR;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
-    ev->fd = (__s32)ctx->args[0];
+    __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
+    bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_pread64")
-int handle_sys_exit_pread64(struct trace_event_raw_sys_exit *ctx) {
+SEC("tracepoint/syscalls/sys_exit_lsetxattr")
+int handle_sys_exit_lsetxattr(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -539,18 +736,320 @@ int handle_sys_exit_pread64(struct trace_event_raw_sys_exit *ctx) {
         return 0;
 
     ev->event_type = EXIT_RET_EVENT;
-    ev->trace_id = SYS_EXIT_PREAD64;
+    ev->trace_id = SYS_EXIT_LSETXATTR;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
-    ev->ret = ctx->ret;
+    ev->ret = ctx->ret; 
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_pread64")
-int handle_sys_enter_pread64(struct trace_event_raw_sys_enter *ctx) {
+SEC("tracepoint/syscalls/sys_enter_getxattr")
+int handle_sys_enter_getxattr(struct trace_event_raw_sys_enter *ctx) {
+    __u32 pid, tid;
+    if (filter(&pid, &tid))
+        return 0;
+
+    struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0);
+    if (!ev)
+        return 0;
+
+    ev->event_type = ENTER_PATH_EVENT;
+    ev->trace_id = SYS_ENTER_GETXATTR;
+    ev->pid = pid;
+    ev->tid = tid;
+    ev->time = bpf_ktime_get_ns() / 1000;
+    __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
+    bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);
+
+    bpf_ringbuf_submit(ev, 0);
+    return 0;
+}
+
+SEC("tracepoint/syscalls/sys_exit_getxattr")
+int handle_sys_exit_getxattr(struct trace_event_raw_sys_exit *ctx) {
+    __u32 pid, tid;
+    if (filter(&pid, &tid))
+        return 0;
+
+    struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
+    if (!ev)
+        return 0;
+
+    ev->event_type = EXIT_RET_EVENT;
+    ev->trace_id = SYS_EXIT_GETXATTR;
+    ev->pid = pid;
+    ev->tid = tid;
+    ev->time = bpf_ktime_get_ns() / 1000;
+    ev->ret = ctx->ret; 
+
+    bpf_ringbuf_submit(ev, 0);
+    return 0;
+}
+
+SEC("tracepoint/syscalls/sys_enter_lgetxattr")
+int handle_sys_enter_lgetxattr(struct trace_event_raw_sys_enter *ctx) {
+    __u32 pid, tid;
+    if (filter(&pid, &tid))
+        return 0;
+
+    struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0);
+    if (!ev)
+        return 0;
+
+    ev->event_type = ENTER_PATH_EVENT;
+    ev->trace_id = SYS_ENTER_LGETXATTR;
+    ev->pid = pid;
+    ev->tid = tid;
+    ev->time = bpf_ktime_get_ns() / 1000;
+    __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
+    bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);
+
+    bpf_ringbuf_submit(ev, 0);
+    return 0;
+}
+
+SEC("tracepoint/syscalls/sys_exit_lgetxattr")
+int handle_sys_exit_lgetxattr(struct trace_event_raw_sys_exit *ctx) {
+    __u32 pid, tid;
+    if (filter(&pid, &tid))
+        return 0;
+
+    struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
+    if (!ev)
+        return 0;
+
+    ev->event_type = EXIT_RET_EVENT;
+    ev->trace_id = SYS_EXIT_LGETXATTR;
+    ev->pid = pid;
+    ev->tid = tid;
+    ev->time = bpf_ktime_get_ns() / 1000;
+    ev->ret = ctx->ret; 
+
+    bpf_ringbuf_submit(ev, 0);
+    return 0;
+}
+
+SEC("tracepoint/syscalls/sys_enter_listxattr")
+int handle_sys_enter_listxattr(struct trace_event_raw_sys_enter *ctx) {
+    __u32 pid, tid;
+    if (filter(&pid, &tid))
+        return 0;
+
+    struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0);
+    if (!ev)
+        return 0;
+
+    ev->event_type = ENTER_PATH_EVENT;
+    ev->trace_id = SYS_ENTER_LISTXATTR;
+    ev->pid = pid;
+    ev->tid = tid;
+    ev->time = bpf_ktime_get_ns() / 1000;
+    __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
+    bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);
+
+    bpf_ringbuf_submit(ev, 0);
+    return 0;
+}
+
+SEC("tracepoint/syscalls/sys_exit_listxattr")
+int handle_sys_exit_listxattr(struct trace_event_raw_sys_exit *ctx) {
+    __u32 pid, tid;
+    if (filter(&pid, &tid))
+        return 0;
+
+    struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
+    if (!ev)
+        return 0;
+
+    ev->event_type = EXIT_RET_EVENT;
+    ev->trace_id = SYS_EXIT_LISTXATTR;
+    ev->pid = pid;
+    ev->tid = tid;
+    ev->time = bpf_ktime_get_ns() / 1000;
+    ev->ret = ctx->ret; 
+
+    bpf_ringbuf_submit(ev, 0);
+    return 0;
+}
+
+SEC("tracepoint/syscalls/sys_enter_llistxattr")
+int handle_sys_enter_llistxattr(struct trace_event_raw_sys_enter *ctx) {
+    __u32 pid, tid;
+    if (filter(&pid, &tid))
+        return 0;
+
+    struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0);
+    if (!ev)
+        return 0;
+
+    ev->event_type = ENTER_PATH_EVENT;
+    ev->trace_id = SYS_ENTER_LLISTXATTR;
+    ev->pid = pid;
+    ev->tid = tid;
+    ev->time = bpf_ktime_get_ns() / 1000;
+    __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
+    bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);