add comment

2 files changed, 148 insertions, 146 deletions

diff --git a/internal/c/generated/tracepoints.c b/internal/c/generated/tracepoints.c
index 1cbb4e6..19bc00b 100644
--- a/internal/c/generated/tracepoints.c
+++ b/internal/c/generated/tracepoints.c
@@ -1,59 +1,59 @@
 // Code generated - don't change manually!
 
-#define SYS_ENTER_PREAD64 757
-#define SYS_EXIT_PREAD64 756
-#define SYS_ENTER_FCHDIR 723
-#define SYS_EXIT_FCHDIR 722
-#define SYS_ENTER_WRITE 759
-#define SYS_EXIT_WRITE 758
-#define SYS_ENTER_FDATASYNC 917
-#define SYS_EXIT_FDATASYNC 916
-#define SYS_ENTER_CLOSE 695
-#define SYS_EXIT_CLOSE 694
-#define SYS_ENTER_FTRUNCATE 735
-#define SYS_EXIT_FTRUNCATE 734
-#define SYS_ENTER_FSYNC 919
-#define SYS_EXIT_FSYNC 918
-#define SYS_ENTER_FCNTL 815
-#define SYS_EXIT_FCNTL 814
+#define SYS_ENTER_NEWFSTAT 771
+#define SYS_EXIT_NEWFSTAT 770
 #define SYS_ENTER_FCHOWN 705
 #define SYS_EXIT_FCHOWN 704
-#define SYS_ENTER_FLOCK 1013
-#define SYS_EXIT_FLOCK 1012
-#define SYS_ENTER_IO_URING_REGISTER 1367
-#define SYS_EXIT_IO_URING_REGISTER 1366
+#define SYS_ENTER_FCHMOD 719
+#define SYS_EXIT_FCHMOD 718
+#define SYS_ENTER_WRITE 759
+#define SYS_EXIT_WRITE 758
 #define SYS_ENTER_IO_URING_ENTER 1371
 #define SYS_EXIT_IO_URING_ENTER 1370
 #define SYS_ENTER_GETDENTS 821
 #define SYS_EXIT_GETDENTS 820
-#define SYS_ENTER_QUOTACTL_FD 1044
-#define SYS_EXIT_QUOTACTL_FD 1043
-#define SYS_ENTER_NEWFSTAT 771
-#define SYS_EXIT_NEWFSTAT 770
-#define SYS_ENTER_IOCTL 817
-#define SYS_EXIT_IOCTL 816
-#define SYS_ENTER_FSTATFS 937
-#define SYS_EXIT_FSTATFS 936
-#define SYS_ENTER_GETDENTS64 819
-#define SYS_EXIT_GETDENTS64 818
+#define SYS_ENTER_CLOSE 695
+#define SYS_EXIT_CLOSE 694
+#define SYS_ENTER_IO_URING_REGISTER 1367
+#define SYS_EXIT_IO_URING_REGISTER 1366
 #define SYS_ENTER_LSEEK 763
 #define SYS_EXIT_LSEEK 762
-#define SYS_ENTER_READ 761
-#define SYS_EXIT_READ 760
+#define SYS_ENTER_FCNTL 815
+#define SYS_EXIT_FCNTL 814
 #define SYS_ENTER_CLOSE_RANGE 693
 #define SYS_ENTER_COPY_FILE_RANGE 739
 #define SYS_ENTER_SYNC_FILE_RANGE 915
 #define SYS_EXIT_CLOSE_RANGE 692
 #define SYS_EXIT_COPY_FILE_RANGE 738
 #define SYS_EXIT_SYNC_FILE_RANGE 914
+#define SYS_ENTER_PREAD64 757
+#define SYS_EXIT_PREAD64 756
+#define SYS_ENTER_GETDENTS64 819
+#define SYS_EXIT_GETDENTS64 818
+#define SYS_ENTER_FCHDIR 723
+#define SYS_EXIT_FCHDIR 722
+#define SYS_ENTER_FDATASYNC 917
+#define SYS_EXIT_FDATASYNC 916
+#define SYS_ENTER_FSYNC 919
+#define SYS_EXIT_FSYNC 918
+#define SYS_ENTER_FTRUNCATE 735
+#define SYS_EXIT_FTRUNCATE 734
+#define SYS_ENTER_READ 761
+#define SYS_EXIT_READ 760
+#define SYS_ENTER_FSTATFS 937
+#define SYS_EXIT_FSTATFS 936
 #define SYS_ENTER_PWRITE64 755
 #define SYS_EXIT_PWRITE64 754
+#define SYS_ENTER_FLOCK 1013
+#define SYS_EXIT_FLOCK 1012
 #define SYS_ENTER_CACHESTAT 521
 #define SYS_EXIT_CACHESTAT 520
-#define SYS_ENTER_FCHMOD 719
-#define SYS_EXIT_FCHMOD 718
+#define SYS_ENTER_IOCTL 817
+#define SYS_EXIT_IOCTL 816
+#define SYS_ENTER_QUOTACTL_FD 1044
+#define SYS_EXIT_QUOTACTL_FD 1043
 
-SEC("tracepoint/syscalls/sys_enter_pread64")
+SEC("tracepoint/syscalls/sys_enter_newfstat")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -63,7 +63,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_PREAD64;
+    ev->op_id = SYS_ENTER_NEWFSTAT;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -73,7 +73,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_pread64")
+SEC("tracepoint/syscalls/sys_exit_newfstat")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -83,7 +83,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_PREAD64;
+    ev->op_id = SYS_EXIT_NEWFSTAT;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -93,7 +93,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_fchdir")
+SEC("tracepoint/syscalls/sys_enter_fchown")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -103,7 +103,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_FCHDIR;
+    ev->op_id = SYS_ENTER_FCHOWN;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -113,7 +113,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_fchdir")
+SEC("tracepoint/syscalls/sys_exit_fchown")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -123,7 +123,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_FCHDIR;
+    ev->op_id = SYS_EXIT_FCHOWN;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -133,7 +133,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_write")
+SEC("tracepoint/syscalls/sys_enter_fchmod")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -143,7 +143,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_WRITE;
+    ev->op_id = SYS_ENTER_FCHMOD;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -153,7 +153,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_write")
+SEC("tracepoint/syscalls/sys_exit_fchmod")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -163,7 +163,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_WRITE;
+    ev->op_id = SYS_EXIT_FCHMOD;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -173,7 +173,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_fdatasync")
+SEC("tracepoint/syscalls/sys_enter_write")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -183,7 +183,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_FDATASYNC;
+    ev->op_id = SYS_ENTER_WRITE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -193,7 +193,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_fdatasync")
+SEC("tracepoint/syscalls/sys_exit_write")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -203,7 +203,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_FDATASYNC;
+    ev->op_id = SYS_EXIT_WRITE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -213,7 +213,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_close")
+SEC("tracepoint/syscalls/sys_enter_io_uring_enter")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -223,7 +223,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_CLOSE;
+    ev->op_id = SYS_ENTER_IO_URING_ENTER;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -233,7 +233,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_close")
+SEC("tracepoint/syscalls/sys_exit_io_uring_enter")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -243,7 +243,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_CLOSE;
+    ev->op_id = SYS_EXIT_IO_URING_ENTER;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -253,7 +253,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_ftruncate")
+SEC("tracepoint/syscalls/sys_enter_getdents")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -263,7 +263,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_FTRUNCATE;
+    ev->op_id = SYS_ENTER_GETDENTS;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -273,7 +273,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_ftruncate")
+SEC("tracepoint/syscalls/sys_exit_getdents")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -283,7 +283,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_FTRUNCATE;
+    ev->op_id = SYS_EXIT_GETDENTS;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -293,7 +293,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_fsync")
+SEC("tracepoint/syscalls/sys_enter_close")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -303,7 +303,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_FSYNC;
+    ev->op_id = SYS_ENTER_CLOSE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -313,7 +313,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_fsync")
+SEC("tracepoint/syscalls/sys_exit_close")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -323,7 +323,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_FSYNC;
+    ev->op_id = SYS_EXIT_CLOSE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -333,7 +333,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_fcntl")
+SEC("tracepoint/syscalls/sys_enter_io_uring_register")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -343,7 +343,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_FCNTL;
+    ev->op_id = SYS_ENTER_IO_URING_REGISTER;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -353,7 +353,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_fcntl")
+SEC("tracepoint/syscalls/sys_exit_io_uring_register")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -363,7 +363,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_FCNTL;
+    ev->op_id = SYS_EXIT_IO_URING_REGISTER;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -373,7 +373,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_fchown")
+SEC("tracepoint/syscalls/sys_enter_lseek")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -383,7 +383,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_FCHOWN;
+    ev->op_id = SYS_ENTER_LSEEK;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -393,7 +393,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_fchown")
+SEC("tracepoint/syscalls/sys_exit_lseek")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -403,7 +403,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_FCHOWN;
+    ev->op_id = SYS_EXIT_LSEEK;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -413,7 +413,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_flock")
+SEC("tracepoint/syscalls/sys_enter_fcntl")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -423,7 +423,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_FLOCK;
+    ev->op_id = SYS_ENTER_FCNTL;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -433,7 +433,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_flock")
+SEC("tracepoint/syscalls/sys_exit_fcntl")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -443,7 +443,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_FLOCK;
+    ev->op_id = SYS_EXIT_FCNTL;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -453,7 +453,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_io_uring_register")
+SEC("tracepoint/syscalls/sys_enter_close_range")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -463,7 +463,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_IO_URING_REGISTER;
+    ev->op_id = SYS_ENTER_CLOSE_RANGE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -473,27 +473,27 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_io_uring_register")
-int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
+SEC("tracepoint/syscalls/sys_enter_copy_file_range")
+int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_IO_URING_REGISTER;
+    ev->op_id = SYS_ENTER_COPY_FILE_RANGE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
-    
+    ev->fd = (int)ctx->args[0];
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_io_uring_enter")
+SEC("tracepoint/syscalls/sys_enter_sync_file_range")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -503,7 +503,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_IO_URING_ENTER;
+    ev->op_id = SYS_ENTER_SYNC_FILE_RANGE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -513,7 +513,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_io_uring_enter")
+SEC("tracepoint/syscalls/sys_exit_close_range")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -523,7 +523,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_IO_URING_ENTER;
+    ev->op_id = SYS_EXIT_CLOSE_RANGE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -533,27 +533,27 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_getdents")
-int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
+SEC("tracepoint/syscalls/sys_exit_copy_file_range")
+int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
+    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_GETDENTS;
+    ev->op_id = SYS_EXIT_COPY_FILE_RANGE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
-    ev->fd = (int)ctx->args[0];
+    
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_getdents")
+SEC("tracepoint/syscalls/sys_exit_sync_file_range")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -563,7 +563,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_GETDENTS;
+    ev->op_id = SYS_EXIT_SYNC_FILE_RANGE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -573,7 +573,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_quotactl_fd")
+SEC("tracepoint/syscalls/sys_enter_pread64")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -583,7 +583,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_QUOTACTL_FD;
+    ev->op_id = SYS_ENTER_PREAD64;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -593,7 +593,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_quotactl_fd")
+SEC("tracepoint/syscalls/sys_exit_pread64")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -603,7 +603,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_QUOTACTL_FD;
+    ev->op_id = SYS_EXIT_PREAD64;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -613,7 +613,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_newfstat")
+SEC("tracepoint/syscalls/sys_enter_getdents64")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -623,7 +623,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_NEWFSTAT;
+    ev->op_id = SYS_ENTER_GETDENTS64;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -633,7 +633,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_newfstat")
+SEC("tracepoint/syscalls/sys_exit_getdents64")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -643,7 +643,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_NEWFSTAT;
+    ev->op_id = SYS_EXIT_GETDENTS64;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -653,7 +653,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_ioctl")
+SEC("tracepoint/syscalls/sys_enter_fchdir")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -663,7 +663,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_IOCTL;
+    ev->op_id = SYS_ENTER_FCHDIR;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -673,7 +673,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_ioctl")
+SEC("tracepoint/syscalls/sys_exit_fchdir")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -683,7 +683,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_IOCTL;
+    ev->op_id = SYS_EXIT_FCHDIR;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -693,7 +693,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_fstatfs")
+SEC("tracepoint/syscalls/sys_enter_fdatasync")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -703,7 +703,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_FSTATFS;
+    ev->op_id = SYS_ENTER_FDATASYNC;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -713,7 +713,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_fstatfs")
+SEC("tracepoint/syscalls/sys_exit_fdatasync")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -723,7 +723,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_FSTATFS;
+    ev->op_id = SYS_EXIT_FDATASYNC;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -733,7 +733,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_getdents64")
+SEC("tracepoint/syscalls/sys_enter_fsync")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -743,7 +743,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_GETDENTS64;
+    ev->op_id = SYS_ENTER_FSYNC;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -753,7 +753,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_getdents64")
+SEC("tracepoint/syscalls/sys_exit_fsync")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -763,7 +763,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_GETDENTS64;
+    ev->op_id = SYS_EXIT_FSYNC;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -773,7 +773,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_lseek")
+SEC("tracepoint/syscalls/sys_enter_ftruncate")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -783,7 +783,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_LSEEK;
+    ev->op_id = SYS_ENTER_FTRUNCATE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -793,7 +793,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_lseek")
+SEC("tracepoint/syscalls/sys_exit_ftruncate")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -803,7 +803,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_LSEEK;
+    ev->op_id = SYS_EXIT_FTRUNCATE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -853,7 +853,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_close_range")
+SEC("tracepoint/syscalls/sys_enter_fstatfs")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -863,7 +863,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_CLOSE_RANGE;
+    ev->op_id = SYS_ENTER_FSTATFS;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -873,27 +873,27 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_copy_file_range")
-int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
+SEC("tracepoint/syscalls/sys_exit_fstatfs")
+int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
+    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_COPY_FILE_RANGE;
+    ev->op_id = SYS_EXIT_FSTATFS;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
-    ev->fd = (int)ctx->args[0];
+    
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_sync_file_range")
+SEC("tracepoint/syscalls/sys_enter_pwrite64")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -903,7 +903,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_SYNC_FILE_RANGE;
+    ev->op_id = SYS_ENTER_PWRITE64;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -913,7 +913,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_close_range")
+SEC("tracepoint/syscalls/sys_exit_pwrite64")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -923,7 +923,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_CLOSE_RANGE;
+    ev->op_id = SYS_EXIT_PWRITE64;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -933,27 +933,27 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_copy_file_range")
-int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
+SEC("tracepoint/syscalls/sys_enter_flock")
+int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_COPY_FILE_RANGE;
+    ev->op_id = SYS_ENTER_FLOCK;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
-    
+    ev->fd = (int)ctx->args[0];
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_sync_file_range")
+SEC("tracepoint/syscalls/sys_exit_flock")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -963,7 +963,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_SYNC_FILE_RANGE;
+    ev->op_id = SYS_EXIT_FLOCK;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -973,7 +973,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_pwrite64")
+SEC("tracepoint/syscalls/sys_enter_cachestat")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -983,7 +983,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_PWRITE64;
+    ev->op_id = SYS_ENTER_CACHESTAT;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -993,7 +993,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_pwrite64")
+SEC("tracepoint/syscalls/sys_exit_cachestat")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -1003,7 +1003,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_PWRITE64;
+    ev->op_id = SYS_EXIT_CACHESTAT;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1013,7 +1013,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_cachestat")
+SEC("tracepoint/syscalls/sys_enter_ioctl")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -1023,7 +1023,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_CACHESTAT;
+    ev->op_id = SYS_ENTER_IOCTL;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1033,7 +1033,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_cachestat")
+SEC("tracepoint/syscalls/sys_exit_ioctl")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -1043,7 +1043,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_CACHESTAT;
+    ev->op_id = SYS_EXIT_IOCTL;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1053,7 +1053,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_enter_fchmod")
+SEC("tracepoint/syscalls/sys_enter_quotactl_fd")
 int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -1063,7 +1063,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_ENTER_FCHMOD;
+    ev->op_id = SYS_ENTER_QUOTACTL_FD;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
@@ -1073,7 +1073,7 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
     return 0;
 }
 
-SEC("tracepoint/syscalls/sys_exit_fchmod")
+SEC("tracepoint/syscalls/sys_exit_quotactl_fd")
 int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
@@ -1083,7 +1083,7 @@ int handle_enter_write(struct trace_event_raw_sys_exit *ctx) {
     if (!ev)
         return 0;
 
-    ev->op_id = SYS_EXIT_FCHMOD;
+    ev->op_id = SYS_EXIT_QUOTACTL_FD;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns() / 1000;
diff --git a/internal/c/generated/tracepoints.raku b/internal/c/generated/tracepoints.raku
index d6fc89e..7f5bc78 100644
--- a/internal/c/generated/tracepoints.raku
+++ b/internal/c/generated/tracepoints.raku
@@ -105,7 +105,9 @@ class SysTraceFormatActions {
 
 my Format @formats = gather for SysTraceFormat
     .parse($*IN.slurp,:actions(SysTraceFormatActions.new)).made
+    # For each enter there is an exit tracepoint. E.g. sys_enter_open and sys_exit_open
     .classify(*.name.split('_').tail).values
+    # Check whether one of them (enter or exit) has an fd.
     .grep(*.grep(*.has-fd).elems > 0) -> @_ { .take for @_ }
 
 say qq:to/END/;