fix BPF tracepoint context type for RHEL 9 stock kernel

The BPF handler generator emitted struct trace_event_raw_sys_enter/
trace_event_raw_sys_exit (the BTF-blessed aliases). RHEL 9 carries an
rt-tree backport that adds preempt_lazy_count to struct trace_entry,
which widens those aliases by 8 bytes and shifts args/ret. The actual
tracepoint context the kernel hands the program is still
syscall_trace_enter / syscall_trace_exit, where the offsets did not
move. Programs typed against the wider alias read past max_ctx_offset
and the verifier rejects the attach with EACCES.

Switching the generator to emit syscall_trace_enter/exit lines up with
the real context on RHEL 9 (and is identical on every other distro,
since the two structs only diverge there). Same fix bcc shipped in
iovisor/bcc#4920 and inspektor-gadget did in inspektor-gadget#2546.
Field accesses (ctx->args[N], ctx->ret) are unchanged.

Verified end-to-end on Rocky Linux 9.7 stock 5.14.0-611.5.1.el9_7
(no kernel-ml needed) and Fedora 6.19. README rewritten accordingly:
drops the elrepo kernel-ml step and the trailing 'permission denied'
troubleshooting paragraph; adds a historical note explaining why the
old workaround existed.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

6 files changed, 716 insertions, 706 deletions

diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c
index b4d4e0f..5bc3110 100644
--- a/internal/c/generated_tracepoints.c
+++ b/internal/c/generated_tracepoints.c
@@ -86,6 +86,7 @@
 /// Ignoring sys_enter_landlock_restrict_self sys_exit_landlock_restrict_self as possibly not file I/O related
 /// Ignoring sys_enter_listen sys_exit_listen as possibly not file I/O related
 /// Ignoring sys_enter_listmount sys_exit_listmount as possibly not file I/O related
+/// Ignoring sys_enter_listns sys_exit_listns as possibly not file I/O related
 /// Ignoring sys_enter_lsm_get_self_attr sys_exit_lsm_get_self_attr as possibly not file I/O related
 /// Ignoring sys_enter_lsm_list_modules sys_exit_lsm_list_modules as possibly not file I/O related
 /// Ignoring sys_enter_lsm_set_self_attr sys_exit_lsm_set_self_attr as possibly not file I/O related
@@ -250,236 +251,236 @@
 /// Ignoring sys_enter_wait4 sys_exit_wait4 as possibly not file I/O related
 /// Ignoring sys_enter_waitid sys_exit_waitid as possibly not file I/O related
 
-#define SYS_ENTER_IO_URING_REGISTER 1515
-#define SYS_EXIT_IO_URING_REGISTER 1514
-#define SYS_ENTER_IO_URING_ENTER 1496
-#define SYS_EXIT_IO_URING_ENTER 1495
-#define SYS_ENTER_IO_URING_SETUP 1494
-#define SYS_EXIT_IO_URING_SETUP 1493
-#define SYS_ENTER_QUOTACTL_FD 1151
-#define SYS_EXIT_QUOTACTL_FD 1150
-#define SYS_ENTER_NAME_TO_HANDLE_AT 1135
-#define SYS_EXIT_NAME_TO_HANDLE_AT 1134
-#define SYS_ENTER_OPEN_BY_HANDLE_AT 1133
-#define SYS_EXIT_OPEN_BY_HANDLE_AT 1132
-#define SYS_ENTER_FLOCK 1119
-#define SYS_EXIT_FLOCK 1118
-#define SYS_ENTER_IO_SETUP 1105
-#define SYS_EXIT_IO_SETUP 1104
-#define SYS_ENTER_IO_DESTROY 1103
-#define SYS_EXIT_IO_DESTROY 1102
-#define SYS_ENTER_IO_SUBMIT 1101
-#define SYS_EXIT_IO_SUBMIT 1100
-#define SYS_ENTER_IO_CANCEL 1099
-#define SYS_EXIT_IO_CANCEL 1098
-#define SYS_ENTER_IO_GETEVENTS 1097
-#define SYS_EXIT_IO_GETEVENTS 1096
-#define SYS_ENTER_IO_PGETEVENTS 1095
-#define SYS_EXIT_IO_PGETEVENTS 1094
-#define SYS_ENTER_FANOTIFY_MARK 1063
-#define SYS_EXIT_FANOTIFY_MARK 1062
-#define SYS_ENTER_FILE_GETATTR 1053
-#define SYS_EXIT_FILE_GETATTR 1052
-#define SYS_ENTER_FILE_SETATTR 1051
-#define SYS_EXIT_FILE_SETATTR 1050
-#define SYS_ENTER_FSPICK 1047
-#define SYS_EXIT_FSPICK 1046
-#define SYS_ENTER_FSCONFIG 1045
-#define SYS_EXIT_FSCONFIG 1044
-#define SYS_ENTER_STATFS 1043
-#define SYS_EXIT_STATFS 1042
-#define SYS_ENTER_FSTATFS 1041
-#define SYS_EXIT_FSTATFS 1040
-#define SYS_ENTER_GETCWD 1037
-#define SYS_EXIT_GETCWD 1036
-#define SYS_ENTER_UTIMENSAT 1035
-#define SYS_EXIT_UTIMENSAT 1034
-#define SYS_ENTER_FUTIMESAT 1033
-#define SYS_EXIT_FUTIMESAT 1032
-#define SYS_ENTER_SYNC 1027
-#define SYS_EXIT_SYNC 1026
-#define SYS_ENTER_SYNCFS 1025
-#define SYS_EXIT_SYNCFS 1024
-#define SYS_ENTER_FSYNC 1023
-#define SYS_EXIT_FSYNC 1022
-#define SYS_ENTER_FDATASYNC 1021
-#define SYS_EXIT_FDATASYNC 1020
-#define SYS_ENTER_SYNC_FILE_RANGE 1019
-#define SYS_EXIT_SYNC_FILE_RANGE 1018
-#define SYS_ENTER_VMSPLICE 1017
-#define SYS_EXIT_VMSPLICE 1016
-#define SYS_ENTER_SETXATTRAT 978
-#define SYS_EXIT_SETXATTRAT 977
-#define SYS_ENTER_SETXATTR 976
-#define SYS_EXIT_SETXATTR 975
-#define SYS_ENTER_LSETXATTR 974
-#define SYS_EXIT_LSETXATTR 973
-#define SYS_ENTER_FSETXATTR 972
-#define SYS_EXIT_FSETXATTR 971
-#define SYS_ENTER_GETXATTRAT 970
-#define SYS_EXIT_GETXATTRAT 969
-#define SYS_ENTER_GETXATTR 968
-#define SYS_EXIT_GETXATTR 967
-#define SYS_ENTER_LGETXATTR 966
-#define SYS_EXIT_LGETXATTR 965
-#define SYS_ENTER_FGETXATTR 964
-#define SYS_EXIT_FGETXATTR 963
-#define SYS_ENTER_LISTXATTRAT 962
-#define SYS_EXIT_LISTXATTRAT 961
-#define SYS_ENTER_LISTXATTR 960
-#define SYS_EXIT_LISTXATTR 959
-#define SYS_ENTER_LLISTXATTR 958
-#define SYS_EXIT_LLISTXATTR 957
-#define SYS_ENTER_FLISTXATTR 956
-#define SYS_EXIT_FLISTXATTR 955
-#define SYS_ENTER_REMOVEXATTRAT 954
-#define SYS_EXIT_REMOVEXATTRAT 953
-#define SYS_ENTER_REMOVEXATTR 952
-#define SYS_EXIT_REMOVEXATTR 951
-#define SYS_ENTER_LREMOVEXATTR 950
-#define SYS_EXIT_LREMOVEXATTR 949
-#define SYS_ENTER_FREMOVEXATTR 948
-#define SYS_EXIT_FREMOVEXATTR 947
-#define SYS_ENTER_OPEN_TREE 944
-#define SYS_EXIT_OPEN_TREE 943
-#define SYS_ENTER_MOUNT_SETATTR 934
-#define SYS_EXIT_MOUNT_SETATTR 933
-#define SYS_ENTER_OPEN_TREE_ATTR 932
-#define SYS_EXIT_OPEN_TREE_ATTR 931
-#define SYS_ENTER_CLOSE_RANGE 924
-#define SYS_EXIT_CLOSE_RANGE 923
-#define SYS_ENTER_DUP3 922
-#define SYS_EXIT_DUP3 921
-#define SYS_ENTER_DUP2 920
-#define SYS_EXIT_DUP2 919
-#define SYS_ENTER_DUP 918
-#define SYS_EXIT_DUP 917
-#define SYS_ENTER_GETDENTS 904
-#define SYS_EXIT_GETDENTS 903
-#define SYS_ENTER_GETDENTS64 902
-#define SYS_EXIT_GETDENTS64 901
-#define SYS_ENTER_IOCTL 900
-#define SYS_EXIT_IOCTL 899
-#define SYS_ENTER_FCNTL 898
-#define SYS_EXIT_FCNTL 897
-#define SYS_ENTER_MKDIRAT 892
-#define SYS_EXIT_MKDIRAT 891
-#define SYS_ENTER_MKDIR 890
-#define SYS_EXIT_MKDIR 889
-#define SYS_ENTER_RMDIR 888
-#define SYS_EXIT_RMDIR 887
-#define SYS_ENTER_UNLINKAT 886
-#define SYS_EXIT_UNLINKAT 885
-#define SYS_ENTER_UNLINK 884
-#define SYS_EXIT_UNLINK 883
-#define SYS_ENTER_SYMLINKAT 882
-#define SYS_EXIT_SYMLINKAT 881
-#define SYS_ENTER_SYMLINK 880
-#define SYS_EXIT_SYMLINK 879
-#define SYS_ENTER_LINKAT 878
-#define SYS_EXIT_LINKAT 877
-#define SYS_ENTER_LINK 876
-#define SYS_EXIT_LINK 875
-#define SYS_ENTER_RENAMEAT2 874
-#define SYS_EXIT_RENAMEAT2 873
-#define SYS_ENTER_RENAMEAT 872
-#define SYS_EXIT_RENAMEAT 871
-#define SYS_ENTER_RENAME 870
-#define SYS_EXIT_RENAME 869
-#define SYS_ENTER_NEWSTAT 860
-#define SYS_EXIT_NEWSTAT 859
-#define SYS_ENTER_NEWLSTAT 858
-#define SYS_EXIT_NEWLSTAT 857
-#define SYS_ENTER_NEWFSTATAT 856
-#define SYS_EXIT_NEWFSTATAT 855
-#define SYS_ENTER_NEWFSTAT 854
-#define SYS_EXIT_NEWFSTAT 853
-#define SYS_ENTER_READLINKAT 852
-#define SYS_EXIT_READLINKAT 851
-#define SYS_ENTER_READLINK 850
-#define SYS_EXIT_READLINK 849
-#define SYS_ENTER_STATX 848
-#define SYS_EXIT_STATX 847
-#define SYS_ENTER_LSEEK 846
-#define SYS_EXIT_LSEEK 845
-#define SYS_ENTER_READ 844
-#define SYS_EXIT_READ 843
-#define SYS_ENTER_WRITE 842
-#define SYS_EXIT_WRITE 841
-#define SYS_ENTER_PREAD64 840
-#define SYS_EXIT_PREAD64 839
-#define SYS_ENTER_PWRITE64 838
-#define SYS_EXIT_PWRITE64 837
-#define SYS_ENTER_READV 836
-#define SYS_EXIT_READV 835
-#define SYS_ENTER_WRITEV 834
-#define SYS_EXIT_WRITEV 833
-#define SYS_ENTER_PREADV 832
-#define SYS_EXIT_PREADV 831
-#define SYS_ENTER_PREADV2 830
-#define SYS_EXIT_PREADV2 829
-#define SYS_ENTER_PWRITEV 828
-#define SYS_EXIT_PWRITEV 827
-#define SYS_ENTER_PWRITEV2 826
-#define SYS_EXIT_PWRITEV2 825
-#define SYS_ENTER_COPY_FILE_RANGE 822
-#define SYS_EXIT_COPY_FILE_RANGE 821
-#define SYS_ENTER_TRUNCATE 820
-#define SYS_EXIT_TRUNCATE 819
-#define SYS_ENTER_FTRUNCATE 818
-#define SYS_EXIT_FTRUNCATE 817
-#define SYS_ENTER_FALLOCATE 816
-#define SYS_EXIT_FALLOCATE 815
-#define SYS_ENTER_FACCESSAT 814
-#define SYS_EXIT_FACCESSAT 813
-#define SYS_ENTER_FACCESSAT2 812
-#define SYS_EXIT_FACCESSAT2 811
-#define SYS_ENTER_ACCESS 810
-#define SYS_EXIT_ACCESS 809
-#define SYS_ENTER_CHDIR 808
-#define SYS_EXIT_CHDIR 807
-#define SYS_ENTER_FCHDIR 806
-#define SYS_EXIT_FCHDIR 805
-#define SYS_ENTER_CHROOT 804
-#define SYS_EXIT_CHROOT 803
-#define SYS_ENTER_FCHMOD 802
-#define SYS_EXIT_FCHMOD 801
-#define SYS_ENTER_FCHMODAT2 800
-#define SYS_EXIT_FCHMODAT2 799
-#define SYS_ENTER_FCHMODAT 798
-#define SYS_EXIT_FCHMODAT 797
-#define SYS_ENTER_CHMOD 796
-#define SYS_EXIT_CHMOD 795
-#define SYS_ENTER_FCHOWNAT 794
-#define SYS_EXIT_FCHOWNAT 793
-#define SYS_ENTER_CHOWN 792
-#define SYS_EXIT_CHOWN 791
-#define SYS_ENTER_LCHOWN 790
-#define SYS_EXIT_LCHOWN 789
-#define SYS_ENTER_FCHOWN 788
-#define SYS_EXIT_FCHOWN 787
-#define SYS_ENTER_OPEN 786
-#define SYS_EXIT_OPEN 785
-#define SYS_ENTER_OPENAT 784
-#define SYS_EXIT_OPENAT 783
-#define SYS_ENTER_OPENAT2 782
-#define SYS_EXIT_OPENAT2 781
-#define SYS_ENTER_CREAT 780
-#define SYS_EXIT_CREAT 779
-#define SYS_ENTER_CLOSE 778
-#define SYS_EXIT_CLOSE 777
-#define SYS_ENTER_MSYNC 707
-#define SYS_EXIT_MSYNC 706
-#define SYS_ENTER_READAHEAD 613
-#define SYS_EXIT_READAHEAD 612
-#define SYS_ENTER_FADVISE64 611
-#define SYS_EXIT_FADVISE64 610
-#define SYS_ENTER_CACHESTAT 592
-#define SYS_EXIT_CACHESTAT 591
-#define SYS_ENTER_FINIT_MODULE 403
-#define SYS_EXIT_FINIT_MODULE 402
-#define SYS_ENTER_SYSLOG 347
-#define SYS_EXIT_SYSLOG 346
+#define SYS_ENTER_IO_URING_REGISTER 1521
+#define SYS_EXIT_IO_URING_REGISTER 1520
+#define SYS_ENTER_IO_URING_ENTER 1502
+#define SYS_EXIT_IO_URING_ENTER 1501
+#define SYS_ENTER_IO_URING_SETUP 1500
+#define SYS_EXIT_IO_URING_SETUP 1499
+#define SYS_ENTER_QUOTACTL_FD 1155
+#define SYS_EXIT_QUOTACTL_FD 1154
+#define SYS_ENTER_NAME_TO_HANDLE_AT 1139
+#define SYS_EXIT_NAME_TO_HANDLE_AT 1138
+#define SYS_ENTER_OPEN_BY_HANDLE_AT 1137
+#define SYS_EXIT_OPEN_BY_HANDLE_AT 1136
+#define SYS_ENTER_FLOCK 1123
+#define SYS_EXIT_FLOCK 1122
+#define SYS_ENTER_IO_SETUP 1109
+#define SYS_EXIT_IO_SETUP 1108
+#define SYS_ENTER_IO_DESTROY 1107
+#define SYS_EXIT_IO_DESTROY 1106
+#define SYS_ENTER_IO_SUBMIT 1105
+#define SYS_EXIT_IO_SUBMIT 1104
+#define SYS_ENTER_IO_CANCEL 1103
+#define SYS_EXIT_IO_CANCEL 1102
+#define SYS_ENTER_IO_GETEVENTS 1101
+#define SYS_EXIT_IO_GETEVENTS 1100
+#define SYS_ENTER_IO_PGETEVENTS 1099
+#define SYS_EXIT_IO_PGETEVENTS 1098
+#define SYS_ENTER_FANOTIFY_MARK 1067
+#define SYS_EXIT_FANOTIFY_MARK 1066
+#define SYS_ENTER_FILE_GETATTR 1057
+#define SYS_EXIT_FILE_GETATTR 1056
+#define SYS_ENTER_FILE_SETATTR 1055
+#define SYS_EXIT_FILE_SETATTR 1054
+#define SYS_ENTER_FSPICK 1051
+#define SYS_EXIT_FSPICK 1050
+#define SYS_ENTER_FSCONFIG 1049
+#define SYS_EXIT_FSCONFIG 1048
+#define SYS_ENTER_STATFS 1047
+#define SYS_EXIT_STATFS 1046
+#define SYS_ENTER_FSTATFS 1045
+#define SYS_EXIT_FSTATFS 1044
+#define SYS_ENTER_GETCWD 1041
+#define SYS_EXIT_GETCWD 1040
+#define SYS_ENTER_UTIMENSAT 1039
+#define SYS_EXIT_UTIMENSAT 1038
+#define SYS_ENTER_FUTIMESAT 1037
+#define SYS_EXIT_FUTIMESAT 1036
+#define SYS_ENTER_SYNC 1031
+#define SYS_EXIT_SYNC 1030
+#define SYS_ENTER_SYNCFS 1029
+#define SYS_EXIT_SYNCFS 1028
+#define SYS_ENTER_FSYNC 1027
+#define SYS_EXIT_FSYNC 1026
+#define SYS_ENTER_FDATASYNC 1025
+#define SYS_EXIT_FDATASYNC 1024
+#define SYS_ENTER_SYNC_FILE_RANGE 1023
+#define SYS_EXIT_SYNC_FILE_RANGE 1022
+#define SYS_ENTER_VMSPLICE 1021
+#define SYS_EXIT_VMSPLICE 1020
+#define SYS_ENTER_SETXATTRAT 982
+#define SYS_EXIT_SETXATTRAT 981
+#define SYS_ENTER_SETXATTR 980
+#define SYS_EXIT_SETXATTR 979
+#define SYS_ENTER_LSETXATTR 978
+#define SYS_EXIT_LSETXATTR 977
+#define SYS_ENTER_FSETXATTR 976
+#define SYS_EXIT_FSETXATTR 975
+#define SYS_ENTER_GETXATTRAT 974
+#define SYS_EXIT_GETXATTRAT 973
+#define SYS_ENTER_GETXATTR 972
+#define SYS_EXIT_GETXATTR 971
+#define SYS_ENTER_LGETXATTR 970
+#define SYS_EXIT_LGETXATTR 969
+#define SYS_ENTER_FGETXATTR 968
+#define SYS_EXIT_FGETXATTR 967
+#define SYS_ENTER_LISTXATTRAT 966
+#define SYS_EXIT_LISTXATTRAT 965
+#define SYS_ENTER_LISTXATTR 964
+#define SYS_EXIT_LISTXATTR 963
+#define SYS_ENTER_LLISTXATTR 962
+#define SYS_EXIT_LLISTXATTR 961
+#define SYS_ENTER_FLISTXATTR 960
+#define SYS_EXIT_FLISTXATTR 959
+#define SYS_ENTER_REMOVEXATTRAT 958
+#define SYS_EXIT_REMOVEXATTRAT 957
+#define SYS_ENTER_REMOVEXATTR 956
+#define SYS_EXIT_REMOVEXATTR 955
+#define SYS_ENTER_LREMOVEXATTR 954
+#define SYS_EXIT_LREMOVEXATTR 953
+#define SYS_ENTER_FREMOVEXATTR 952
+#define SYS_EXIT_FREMOVEXATTR 951
+#define SYS_ENTER_OPEN_TREE 948
+#define SYS_EXIT_OPEN_TREE 947
+#define SYS_ENTER_MOUNT_SETATTR 938
+#define SYS_EXIT_MOUNT_SETATTR 937
+#define SYS_ENTER_OPEN_TREE_ATTR 936
+#define SYS_EXIT_OPEN_TREE_ATTR 935
+#define SYS_ENTER_CLOSE_RANGE 928
+#define SYS_EXIT_CLOSE_RANGE 927
+#define SYS_ENTER_DUP3 926
+#define SYS_EXIT_DUP3 925
+#define SYS_ENTER_DUP2 924
+#define SYS_EXIT_DUP2 923
+#define SYS_ENTER_DUP 922
+#define SYS_EXIT_DUP 921
+#define SYS_ENTER_GETDENTS 908
+#define SYS_EXIT_GETDENTS 907
+#define SYS_ENTER_GETDENTS64 906
+#define SYS_EXIT_GETDENTS64 905
+#define SYS_ENTER_IOCTL 904
+#define SYS_EXIT_IOCTL 903
+#define SYS_ENTER_FCNTL 902
+#define SYS_EXIT_FCNTL 901
+#define SYS_ENTER_MKDIRAT 896
+#define SYS_EXIT_MKDIRAT 895
+#define SYS_ENTER_MKDIR 894
+#define SYS_EXIT_MKDIR 893
+#define SYS_ENTER_RMDIR 892
+#define SYS_EXIT_RMDIR 891
+#define SYS_ENTER_UNLINKAT 890
+#define SYS_EXIT_UNLINKAT 889
+#define SYS_ENTER_UNLINK 888
+#define SYS_EXIT_UNLINK 887
+#define SYS_ENTER_SYMLINKAT 886
+#define SYS_EXIT_SYMLINKAT 885
+#define SYS_ENTER_SYMLINK 884
+#define SYS_EXIT_SYMLINK 883
+#define SYS_ENTER_LINKAT 882
+#define SYS_EXIT_LINKAT 881
+#define SYS_ENTER_LINK 880
+#define SYS_EXIT_LINK 879
+#define SYS_ENTER_RENAMEAT2 878
+#define SYS_EXIT_RENAMEAT2 877
+#define SYS_ENTER_RENAMEAT 876
+#define SYS_EXIT_RENAMEAT 875
+#define SYS_ENTER_RENAME 874
+#define SYS_EXIT_RENAME 873
+#define SYS_ENTER_NEWSTAT 864
+#define SYS_EXIT_NEWSTAT 863
+#define SYS_ENTER_NEWLSTAT 862
+#define SYS_EXIT_NEWLSTAT 861
+#define SYS_ENTER_NEWFSTATAT 860
+#define SYS_EXIT_NEWFSTATAT 859
+#define SYS_ENTER_NEWFSTAT 858
+#define SYS_EXIT_NEWFSTAT 857
+#define SYS_ENTER_READLINKAT 856
+#define SYS_EXIT_READLINKAT 855
+#define SYS_ENTER_READLINK 854
+#define SYS_EXIT_READLINK 853
+#define SYS_ENTER_STATX 852
+#define SYS_EXIT_STATX 851
+#define SYS_ENTER_LSEEK 850
+#define SYS_EXIT_LSEEK 849
+#define SYS_ENTER_READ 848
+#define SYS_EXIT_READ 847
+#define SYS_ENTER_WRITE 846
+#define SYS_EXIT_WRITE 845
+#define SYS_ENTER_PREAD64 844
+#define SYS_EXIT_PREAD64 843
+#define SYS_ENTER_PWRITE64 842
+#define SYS_EXIT_PWRITE64 841
+#define SYS_ENTER_READV 840
+#define SYS_EXIT_READV 839
+#define SYS_ENTER_WRITEV 838
+#define SYS_EXIT_WRITEV 837
+#define SYS_ENTER_PREADV 836
+#define SYS_EXIT_PREADV 835
+#define SYS_ENTER_PREADV2 834
+#define SYS_EXIT_PREADV2 833
+#define SYS_ENTER_PWRITEV 832
+#define SYS_EXIT_PWRITEV 831
+#define SYS_ENTER_PWRITEV2 830
+#define SYS_EXIT_PWRITEV2 829
+#define SYS_ENTER_COPY_FILE_RANGE 826
+#define SYS_EXIT_COPY_FILE_RANGE 825
+#define SYS_ENTER_TRUNCATE 824
+#define SYS_EXIT_TRUNCATE 823
+#define SYS_ENTER_FTRUNCATE 822
+#define SYS_EXIT_FTRUNCATE 821
+#define SYS_ENTER_FALLOCATE 820
+#define SYS_EXIT_FALLOCATE 819
+#define SYS_ENTER_FACCESSAT 818
+#define SYS_EXIT_FACCESSAT 817
+#define SYS_ENTER_FACCESSAT2 816
+#define SYS_EXIT_FACCESSAT2 815
+#define SYS_ENTER_ACCESS 814
+#define SYS_EXIT_ACCESS 813
+#define SYS_ENTER_CHDIR 812
+#define SYS_EXIT_CHDIR 811
+#define SYS_ENTER_FCHDIR 810
+#define SYS_EXIT_FCHDIR 809
+#define SYS_ENTER_CHROOT 808
+#define SYS_EXIT_CHROOT 807
+#define SYS_ENTER_FCHMOD 806
+#define SYS_EXIT_FCHMOD 805
+#define SYS_ENTER_FCHMODAT2 804
+#define SYS_EXIT_FCHMODAT2 803
+#define SYS_ENTER_FCHMODAT 802
+#define SYS_EXIT_FCHMODAT 801
+#define SYS_ENTER_CHMOD 800
+#define SYS_EXIT_CHMOD 799
+#define SYS_ENTER_FCHOWNAT 798
+#define SYS_EXIT_FCHOWNAT 797
+#define SYS_ENTER_CHOWN 796
+#define SYS_EXIT_CHOWN 795
+#define SYS_ENTER_LCHOWN 794
+#define SYS_EXIT_LCHOWN 793
+#define SYS_ENTER_FCHOWN 792
+#define SYS_EXIT_FCHOWN 791
+#define SYS_ENTER_OPEN 790
+#define SYS_EXIT_OPEN 789
+#define SYS_ENTER_OPENAT 788
+#define SYS_EXIT_OPENAT 787
+#define SYS_ENTER_OPENAT2 786
+#define SYS_EXIT_OPENAT2 785
+#define SYS_ENTER_CREAT 784
+#define SYS_EXIT_CREAT 783
+#define SYS_ENTER_CLOSE 782
+#define SYS_EXIT_CLOSE 781
+#define SYS_ENTER_MSYNC 710
+#define SYS_EXIT_MSYNC 709
+#define SYS_ENTER_READAHEAD 616
+#define SYS_EXIT_READAHEAD 615
+#define SYS_ENTER_FADVISE64 614
+#define SYS_EXIT_FADVISE64 613
+#define SYS_ENTER_CACHESTAT 595
+#define SYS_EXIT_CACHESTAT 594
+#define SYS_ENTER_FINIT_MODULE 406
+#define SYS_EXIT_FINIT_MODULE 405
+#define SYS_ENTER_SYSLOG 350
+#define SYS_EXIT_SYSLOG 349
 #define SYS_ENTER_PIDFD_GETFD 271
 #define SYS_EXIT_PIDFD_GETFD 270
 #define SYS_ENTER_MMAP 100
@@ -487,7 +488,7 @@
 
 /// sys_enter_io_uring_register is a struct fd_event
 SEC("tracepoint/syscalls/sys_enter_io_uring_register")
-int handle_sys_enter_io_uring_register(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_io_uring_register(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -509,7 +510,7 @@ int handle_sys_enter_io_uring_register(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_io_uring_register is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_io_uring_register")
-int handle_sys_exit_io_uring_register(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_io_uring_register(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -532,7 +533,7 @@ int handle_sys_exit_io_uring_register(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_io_uring_enter is a struct fd_event
 SEC("tracepoint/syscalls/sys_enter_io_uring_enter")
-int handle_sys_enter_io_uring_enter(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_io_uring_enter(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -554,7 +555,7 @@ int handle_sys_enter_io_uring_enter(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_io_uring_enter is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_io_uring_enter")
-int handle_sys_exit_io_uring_enter(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_io_uring_enter(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -577,7 +578,7 @@ int handle_sys_exit_io_uring_enter(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_io_uring_setup is a struct null_event
 SEC("tracepoint/syscalls/sys_enter_io_uring_setup")
-int handle_sys_enter_io_uring_setup(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_io_uring_setup(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -598,7 +599,7 @@ int handle_sys_enter_io_uring_setup(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_io_uring_setup is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_io_uring_setup")
-int handle_sys_exit_io_uring_setup(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_io_uring_setup(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -621,7 +622,7 @@ int handle_sys_exit_io_uring_setup(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_quotactl_fd is a struct fd_event
 SEC("tracepoint/syscalls/sys_enter_quotactl_fd")
-int handle_sys_enter_quotactl_fd(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_quotactl_fd(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -643,7 +644,7 @@ int handle_sys_enter_quotactl_fd(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_quotactl_fd is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_quotactl_fd")
-int handle_sys_exit_quotactl_fd(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_quotactl_fd(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -666,7 +667,7 @@ int handle_sys_exit_quotactl_fd(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_name_to_handle_at is a struct path_event
 SEC("tracepoint/syscalls/sys_enter_name_to_handle_at")
-int handle_sys_enter_name_to_handle_at(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_name_to_handle_at(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -689,7 +690,7 @@ int handle_sys_enter_name_to_handle_at(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_name_to_handle_at is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_name_to_handle_at")
-int handle_sys_exit_name_to_handle_at(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_name_to_handle_at(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -712,7 +713,7 @@ int handle_sys_exit_name_to_handle_at(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_open_by_handle_at is a struct open_by_handle_at_event
 SEC("tracepoint/syscalls/sys_enter_open_by_handle_at")
-int handle_sys_enter_open_by_handle_at(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_open_by_handle_at(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -734,7 +735,7 @@ int handle_sys_enter_open_by_handle_at(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_open_by_handle_at is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_open_by_handle_at")
-int handle_sys_exit_open_by_handle_at(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_open_by_handle_at(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -757,7 +758,7 @@ int handle_sys_exit_open_by_handle_at(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_flock is a struct fd_event
 SEC("tracepoint/syscalls/sys_enter_flock")
-int handle_sys_enter_flock(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_flock(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -779,7 +780,7 @@ int handle_sys_enter_flock(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_flock is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_flock")
-int handle_sys_exit_flock(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_flock(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -802,7 +803,7 @@ int handle_sys_exit_flock(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_io_setup is a struct null_event
 SEC("tracepoint/syscalls/sys_enter_io_setup")
-int handle_sys_enter_io_setup(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_io_setup(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -823,7 +824,7 @@ int handle_sys_enter_io_setup(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_io_setup is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_io_setup")
-int handle_sys_exit_io_setup(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_io_setup(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -846,7 +847,7 @@ int handle_sys_exit_io_setup(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_io_destroy is a struct null_event
 SEC("tracepoint/syscalls/sys_enter_io_destroy")
-int handle_sys_enter_io_destroy(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_io_destroy(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -867,7 +868,7 @@ int handle_sys_enter_io_destroy(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_io_destroy is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_io_destroy")
-int handle_sys_exit_io_destroy(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_io_destroy(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -890,7 +891,7 @@ int handle_sys_exit_io_destroy(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_io_submit is a struct null_event
 SEC("tracepoint/syscalls/sys_enter_io_submit")
-int handle_sys_enter_io_submit(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_io_submit(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -911,7 +912,7 @@ int handle_sys_enter_io_submit(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_io_submit is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_io_submit")
-int handle_sys_exit_io_submit(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_io_submit(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -934,7 +935,7 @@ int handle_sys_exit_io_submit(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_io_cancel is a struct null_event
 SEC("tracepoint/syscalls/sys_enter_io_cancel")
-int handle_sys_enter_io_cancel(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_io_cancel(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -955,7 +956,7 @@ int handle_sys_enter_io_cancel(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_io_cancel is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_io_cancel")
-int handle_sys_exit_io_cancel(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_io_cancel(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -978,7 +979,7 @@ int handle_sys_exit_io_cancel(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_io_getevents is a struct null_event
 SEC("tracepoint/syscalls/sys_enter_io_getevents")
-int handle_sys_enter_io_getevents(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_io_getevents(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -999,7 +1000,7 @@ int handle_sys_enter_io_getevents(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_io_getevents is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_io_getevents")
-int handle_sys_exit_io_getevents(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_io_getevents(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1022,7 +1023,7 @@ int handle_sys_exit_io_getevents(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_io_pgetevents is a struct null_event
 SEC("tracepoint/syscalls/sys_enter_io_pgetevents")
-int handle_sys_enter_io_pgetevents(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_io_pgetevents(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1043,7 +1044,7 @@ int handle_sys_enter_io_pgetevents(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_io_pgetevents is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_io_pgetevents")
-int handle_sys_exit_io_pgetevents(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_io_pgetevents(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1066,7 +1067,7 @@ int handle_sys_exit_io_pgetevents(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_fanotify_mark is a struct path_event
 SEC("tracepoint/syscalls/sys_enter_fanotify_mark")
-int handle_sys_enter_fanotify_mark(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_fanotify_mark(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1089,7 +1090,7 @@ int handle_sys_enter_fanotify_mark(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_fanotify_mark is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_fanotify_mark")
-int handle_sys_exit_fanotify_mark(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_fanotify_mark(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1112,7 +1113,7 @@ int handle_sys_exit_fanotify_mark(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_file_getattr is a struct path_event
 SEC("tracepoint/syscalls/sys_enter_file_getattr")
-int handle_sys_enter_file_getattr(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_file_getattr(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1135,7 +1136,7 @@ int handle_sys_enter_file_getattr(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_file_getattr is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_file_getattr")
-int handle_sys_exit_file_getattr(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_file_getattr(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1158,7 +1159,7 @@ int handle_sys_exit_file_getattr(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_file_setattr is a struct path_event
 SEC("tracepoint/syscalls/sys_enter_file_setattr")
-int handle_sys_enter_file_setattr(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_file_setattr(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1181,7 +1182,7 @@ int handle_sys_enter_file_setattr(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_file_setattr is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_file_setattr")
-int handle_sys_exit_file_setattr(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_file_setattr(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1204,7 +1205,7 @@ int handle_sys_exit_file_setattr(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_fspick is a struct path_event
 SEC("tracepoint/syscalls/sys_enter_fspick")
-int handle_sys_enter_fspick(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_fspick(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1227,7 +1228,7 @@ int handle_sys_enter_fspick(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_fspick is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_fspick")
-int handle_sys_exit_fspick(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_fspick(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1250,7 +1251,7 @@ int handle_sys_exit_fspick(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_fsconfig is a struct fd_event
 SEC("tracepoint/syscalls/sys_enter_fsconfig")
-int handle_sys_enter_fsconfig(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_fsconfig(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1272,7 +1273,7 @@ int handle_sys_enter_fsconfig(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_fsconfig is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_fsconfig")
-int handle_sys_exit_fsconfig(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_fsconfig(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1295,7 +1296,7 @@ int handle_sys_exit_fsconfig(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_statfs is a struct path_event
 SEC("tracepoint/syscalls/sys_enter_statfs")
-int handle_sys_enter_statfs(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_statfs(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1318,7 +1319,7 @@ int handle_sys_enter_statfs(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_statfs is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_statfs")
-int handle_sys_exit_statfs(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_statfs(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1341,7 +1342,7 @@ int handle_sys_exit_statfs(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_fstatfs is a struct fd_event
 SEC("tracepoint/syscalls/sys_enter_fstatfs")
-int handle_sys_enter_fstatfs(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_fstatfs(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1363,7 +1364,7 @@ int handle_sys_enter_fstatfs(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_fstatfs is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_fstatfs")
-int handle_sys_exit_fstatfs(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_fstatfs(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1386,7 +1387,7 @@ int handle_sys_exit_fstatfs(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_getcwd is a struct null_event
 SEC("tracepoint/syscalls/sys_enter_getcwd")
-int handle_sys_enter_getcwd(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_getcwd(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1407,7 +1408,7 @@ int handle_sys_enter_getcwd(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_getcwd is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_getcwd")
-int handle_sys_exit_getcwd(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_getcwd(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1430,7 +1431,7 @@ int handle_sys_exit_getcwd(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_utimensat is a struct path_event
 SEC("tracepoint/syscalls/sys_enter_utimensat")
-int handle_sys_enter_utimensat(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_utimensat(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1453,7 +1454,7 @@ int handle_sys_enter_utimensat(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_utimensat is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_utimensat")
-int handle_sys_exit_utimensat(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_utimensat(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1476,7 +1477,7 @@ int handle_sys_exit_utimensat(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_futimesat is a struct path_event
 SEC("tracepoint/syscalls/sys_enter_futimesat")
-int handle_sys_enter_futimesat(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_futimesat(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1499,7 +1500,7 @@ int handle_sys_enter_futimesat(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_futimesat is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_futimesat")
-int handle_sys_exit_futimesat(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_futimesat(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1522,7 +1523,7 @@ int handle_sys_exit_futimesat(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_sync is a struct null_event
 SEC("tracepoint/syscalls/sys_enter_sync")
-int handle_sys_enter_sync(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_sync(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1543,7 +1544,7 @@ int handle_sys_enter_sync(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_sync is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_sync")
-int handle_sys_exit_sync(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_sync(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;