0c promote aggregate-only sampling defaults in raw output modes

Default aggregate-only sampling (rate 0) for futex* and clock_gettime
causes BPF to suppress ring-buffer events. In -plain, -flamegraph, and
headless -parquet modes there is no aggregate sink, so these probes
would emit no rows even when explicitly selected. Promote those defaults
to rate 1 during flag resolution; user-explicit overrides are preserved.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

1 files changed, 17 insertions, 0 deletions

diff --git a/internal/flags/sampling.go b/internal/flags/sampling.go
index 0f0af2a..5656f0a 100644
--- a/internal/flags/sampling.go
+++ b/internal/flags/sampling.go
@@ -49,6 +49,23 @@ func mergeSyscallSamplingRates(overrides map[string]uint32) map[string]uint32 {
 	return out
 }
 
+// promoteAggregateOnlyForRawOutput replaces default aggregate-only rates (0)
+// with rate 1 (emit every event) when running in a raw output mode that lacks
+// an aggregate sink. Without this promotion, BPF suppresses ring-buffer
+// events for these syscalls and no rows appear in -plain, -flamegraph, or
+// headless -parquet output. User-explicit overrides (present in userOverrides)
+// are preserved unchanged.
+func promoteAggregateOnlyForRawOutput(merged map[string]uint32, userOverrides map[string]uint32) {
+	for _, syscall := range defaultAggregateOnlySyscalls {
+		if _, explicit := userOverrides[syscall]; explicit {
+			continue
+		}
+		if merged[syscall] == 0 {
+			merged[syscall] = 1
+		}
+	}
+}
+
 func parseFamilySamplingRates(raw string) (map[types.SyscallFamily]uint32, error) {
 	entries, err := parseSamplingEntries(raw)
 	if err != nil {