t6 add syscall family dashboard aggregation

23 files changed, 666 insertions, 19 deletions

diff --git a/internal/generate/typesgo.go b/internal/generate/typesgo.go
index 9f91981..d668ba3 100644
--- a/internal/generate/typesgo.go
+++ b/internal/generate/typesgo.go
@@ -149,6 +149,7 @@ func parseMember(line string) (CMember, bool) {
 func writeTypeDefsAndMaps(b *strings.Builder, constants []CConstant) {
 	b.WriteString("type EventType uint32\n")
 	b.WriteString("type TraceId uint32\n\n")
+	writeSyscallFamilyDefs(b)
 
 	var sysConstants []CConstant
 	for _, c := range constants {
@@ -166,12 +167,36 @@ func writeTypeDefsAndMaps(b *strings.Builder, constants []CConstant) {
 		s = strings.TrimPrefix(s, "SYS_EXIT_")
 		return strings.ToLower(s)
 	})
+	writeTraceIdFamilyMap(b, sysConstants)
 
 	writeTraceIdStringMethod(b)
 	writeTraceIdNameMethod(b)
+	writeTraceIdFamilyMethod(b)
 	b.WriteString("\n")
 }
 
+func writeSyscallFamilyDefs(b *strings.Builder) {
+	b.WriteString(`// SyscallFamily is the broad runtime grouping for a syscall tracepoint.
+type SyscallFamily string
+
+const (
+	FamilyNetwork  SyscallFamily = "Network"
+	FamilyMemory   SyscallFamily = "Memory"
+	FamilySignals  SyscallFamily = "Signals"
+	FamilySched    SyscallFamily = "Sched"
+	FamilyIPC      SyscallFamily = "IPC"
+	FamilyTime     SyscallFamily = "Time"
+	FamilyProcess  SyscallFamily = "Process"
+	FamilySecurity SyscallFamily = "Security"
+	FamilyFS       SyscallFamily = "FS"
+	FamilyPolling  SyscallFamily = "Polling"
+	FamilyAIO      SyscallFamily = "AIO"
+	FamilyMisc     SyscallFamily = "Misc"
+)
+
+`)
+}
+
 func writeTraceIdMap(b *strings.Builder, mapName string, constants []CConstant, transform func(string) string) {
 	fmt.Fprintf(b, "var %s = map[TraceId]string{\n\t", mapName)
 	entries := make([]string, 0, len(constants))
@@ -182,6 +207,48 @@ func writeTraceIdMap(b *strings.Builder, mapName string, constants []CConstant,
 	b.WriteString(",\n}\n\n")
 }
 
+func writeTraceIdFamilyMap(b *strings.Builder, constants []CConstant) {
+	b.WriteString("var traceId2Family = map[TraceId]SyscallFamily{\n\t")
+	entries := make([]string, 0, len(constants))
+	for _, c := range constants {
+		tracepoint := strings.ToLower(c.Name)
+		tracepoint = strings.TrimPrefix(tracepoint, "sys_")
+		family := ClassifySyscallFamily("sys_" + tracepoint)
+		entries = append(entries, fmt.Sprintf("%s: %s", c.Value, syscallFamilyConstName(family)))
+	}
+	b.WriteString(strings.Join(entries, ", "))
+	b.WriteString(",\n}\n\n")
+}
+
+func syscallFamilyConstName(family SyscallFamily) string {
+	switch family {
+	case FamilyNetwork:
+		return "FamilyNetwork"
+	case FamilyMemory:
+		return "FamilyMemory"
+	case FamilySignals:
+		return "FamilySignals"
+	case FamilySched:
+		return "FamilySched"
+	case FamilyIPC:
+		return "FamilyIPC"
+	case FamilyTime:
+		return "FamilyTime"
+	case FamilyProcess:
+		return "FamilyProcess"
+	case FamilySecurity:
+		return "FamilySecurity"
+	case FamilyFS:
+		return "FamilyFS"
+	case FamilyPolling:
+		return "FamilyPolling"
+	case FamilyAIO:
+		return "FamilyAIO"
+	default:
+		return "FamilyMisc"
+	}
+}
+
 func writeTraceIdStringMethod(b *strings.Builder) {
 	b.WriteString(`func (s TraceId) String() string {
 	str, ok := traceId2String[s]
@@ -206,6 +273,19 @@ func writeTraceIdNameMethod(b *strings.Builder) {
 `)
 }
 
+func writeTraceIdFamilyMethod(b *strings.Builder) {
+	b.WriteString(`// Family returns the broad syscall family for this tracepoint.
+func (s TraceId) Family() SyscallFamily {
+	family, ok := traceId2Family[s]
+	if !ok {
+		return FamilyMisc
+	}
+	return family
+}
+
+`)
+}
+
 func writeGoStruct(b *strings.Builder, s CStruct) {
 	goName := snakeToCamel(s.Name)
 	selfRef := strings.ToLower(goName[:1])
diff --git a/internal/generate/typesgo_test.go b/internal/generate/typesgo_test.go
index 76c0521..fcbabec 100644
--- a/internal/generate/typesgo_test.go
+++ b/internal/generate/typesgo_test.go
@@ -47,6 +47,8 @@ struct fd_event {
 
 const testDefines = `#define SYS_ENTER_OPENAT 784
 #define SYS_EXIT_OPENAT 783
+#define SYS_ENTER_EPOLL_WAIT 782
+#define SYS_EXIT_EPOLL_WAIT 781
 `
 
 func TestParseCTypesInput(t *testing.T) {
@@ -72,7 +74,7 @@ func TestParseCTypesInput(t *testing.T) {
 	}
 
 	// Check constants
-	expectedConsts := 8 // MAX_FILENAME_LENGTH, MAX_PROGNAME_LENGTH, 2 event types, 2 classified, 2 SYS_
+	expectedConsts := 10 // MAX_FILENAME_LENGTH, MAX_PROGNAME_LENGTH, 2 event types, 2 classified, 4 SYS_
 	if len(constants) != expectedConsts {
 		t.Errorf("constants = %d, want %d", len(constants), expectedConsts)
 	}
@@ -232,6 +234,9 @@ func TestGenerateTypesGoTraceIdMaps(t *testing.T) {
 	requireContains(t, output, "var traceId2Name = map[TraceId]string{")
 	requireContains(t, output, `784: "openat"`)
 	requireContains(t, output, `783: "openat"`)
+	requireContains(t, output, "var traceId2Family = map[TraceId]SyscallFamily{")
+	requireContains(t, output, `784: FamilyFS`)
+	requireContains(t, output, `782: FamilyPolling`)
 }
 
 func TestGenerateTypesGoTraceIdMethods(t *testing.T) {
@@ -244,6 +249,7 @@ func TestGenerateTypesGoTraceIdMethods(t *testing.T) {
 
 	requireContains(t, output, "func (s TraceId) String() string")
 	requireContains(t, output, "func (s TraceId) Name() string")
+	requireContains(t, output, "func (s TraceId) Family() SyscallFamily")
 	requireContains(t, output, `return fmt.Sprintf("unknown_trace_id_%d", s)`)
 }
 
diff --git a/internal/ior_mode_test.go b/internal/ior_mode_test.go
index a7c3bee..526b9af 100644
--- a/internal/ior_mode_test.go
+++ b/internal/ior_mode_test.go
@@ -730,6 +730,9 @@ func TestHeadlessParquetSinkRecordsRows(t *testing.T) {
 	if rows[0].Comm != "keep" || rows[1].Syscall != "openat" {
 		t.Fatalf("unexpected recorded rows: %+v %+v", rows[0], rows[1])
 	}
+	if rows[0].Family != "FS" || rows[1].Family != "FS" {
+		t.Fatalf("recorded family tags = %q,%q, want FS,FS", rows[0].Family, rows[1].Family)
+	}
 }
 
 func TestTuiTraceStarterFromRunTracePersistsRecorderAcrossRestarts(t *testing.T) {
diff --git a/internal/parquet/recorder_test.go b/internal/parquet/recorder_test.go
index 66c22a3..76d70a5 100644
--- a/internal/parquet/recorder_test.go
+++ b/internal/parquet/recorder_test.go
@@ -137,6 +137,7 @@ func testStreamRow(seq uint64, syscall string, isError bool) streamrow.Row {
 		Seq:        seq,
 		TimeNs:     seq * 10,
 		Syscall:    syscall,
+		Family:     "FS",
 		Comm:       "ior-test",
 		PID:        100 + uint32(seq),
 		TID:        200 + uint32(seq),
diff --git a/internal/parquet/schema.go b/internal/parquet/schema.go
index 62d448b..03937bf 100644
--- a/internal/parquet/schema.go
+++ b/internal/parquet/schema.go
@@ -21,6 +21,7 @@ type Record struct {
 	PID         uint32 `parquet:"pid"`
 	TID         uint32 `parquet:"tid"`
 	Syscall     string `parquet:"syscall"`
+	Family      string `parquet:"family"`
 	FD          int32  `parquet:"fd"`
 	Ret         int64  `parquet:"ret"`
 	Bytes       uint64 `parquet:"bytes"`
@@ -62,6 +63,7 @@ func RecordFromStream(row streamrow.Row, filterEpoch uint64) Record {
 		PID:         row.PID,
 		TID:         row.TID,
 		Syscall:     row.Syscall,
+		Family:      row.Family,
 		FD:          row.FD,
 		Ret:         row.RetVal,
 		Bytes:       row.Bytes,
diff --git a/internal/statsengine/engine.go b/internal/statsengine/engine.go
index b7d93fa..7d85e96 100644
--- a/internal/statsengine/engine.go
+++ b/internal/statsengine/engine.go
@@ -56,6 +56,7 @@ type Engine struct {
 	totalGap        uint64
 
 	syscalls         *syscallAccumulator
+	families         *familyAccumulator
 	files            *fileRanker
 	processes        *processAccumulator
 	latencyHist      *histogram
@@ -82,6 +83,7 @@ type snapshotInputs struct {
 	throughputSeries []float64
 
 	syscalls  []syscallSnapshotInput
+	families  []familySnapshotInput
 	files     []fileSnapshotInput
 	processes []processSnapshotInput
 
@@ -104,6 +106,7 @@ func newEngineWithClock(topN int, now func() time.Time) *Engine {
 		startedAt:        now(),
 		topN:             topN,
 		syscalls:         newSyscallAccumulator(),
+		families:         newFamilyAccumulator(),
 		files:            newFileRankerWithConfig(topN),
 		processes:        newProcessAccumulatorWithConfig(topN),
 		latencyHist:      newHistogram(),
@@ -132,6 +135,7 @@ func (e *Engine) Reset() {
 	e.totalLatency = 0
 	e.totalGap = 0
 	e.syscalls = newSyscallAccumulator()
+	e.families = newFamilyAccumulator()
 	e.files = newFileRankerWithConfig(e.topN)
 	e.processes = newProcessAccumulatorWithConfig(e.topN)
 	e.latencyHist = newHistogram()
@@ -158,6 +162,7 @@ func (e *Engine) Ingest(pair *event.Pair) {
 
 	e.updateErrorAndByteClasses(pair)
 	e.syscalls.Add(pair)
+	e.families.Add(pair)
 	e.files.Add(pair)
 	e.processes.Add(pair)
 	e.latencyHist.Increment(pair.Duration)
@@ -190,6 +195,7 @@ func (e *Engine) updateErrorAndByteClasses(pair *event.Pair) {
 // subSnapshots holds the concurrently built per-category snapshot slices.
 type subSnapshots struct {
 	syscalls    []SyscallSnapshot
+	families    []FamilySnapshot
 	files       []FileSnapshot
 	processes   []ProcessSnapshot
 	latencyHist HistogramSnapshot
@@ -216,6 +222,7 @@ func (e *Engine) captureSnapshotInputs() snapshotInputs {
 		gapSeries:        e.gapSeries.Values(),
 		throughputSeries: e.throughputSeries.Values(),
 		syscalls:         e.syscalls.snapshotInputs(),
+		families:         e.families.snapshotInputs(),
 		files:            e.files.snapshotInputs(),
 		processes:        e.processes.snapshotInputs(),
 		latencyHist:      e.latencyHist.snapshotInputs(),
@@ -223,7 +230,7 @@ func (e *Engine) captureSnapshotInputs() snapshotInputs {
 	}
 }
 
-// buildSubSnapshots runs all five per-category snapshot builders concurrently
+// buildSubSnapshots runs all per-category snapshot builders concurrently
 // using errgroup so that any error from a sub-builder is captured and returned
 // to the caller instead of being silently dropped.
 func buildSubSnapshots(in snapshotInputs, elapsed time.Duration) (subSnapshots, error) {
@@ -239,6 +246,11 @@ func buildSubSnapshots(in snapshotInputs, elapsed time.Duration) (subSnapshots,
 	})
 	eg.Go(func() error {
 		var err error
+		ss.families, err = buildFamilySnapshots(in.families, elapsed)
+		return err
+	})
+	eg.Go(func() error {
+		var err error
 		ss.files, err = buildFileSnapshots(in.files)
 		return err
 	})
@@ -303,9 +315,9 @@ func (e *Engine) Snapshot() (*Snapshot, error) {
 		return nil, err
 	}
 
-	snap := NewSnapshot(
+	snap := NewSnapshotWithFamilies(
 		in.latencySeries, in.gapSeries, in.throughputSeries,
-		ss.syscalls, ss.files, ss.processes,
+		ss.syscalls, ss.families, ss.files, ss.processes,
 		ss.latencyHist, ss.gapHist,
 	)
 	populateSnapshotFields(&snap, in, elapsed)
diff --git a/internal/statsengine/engine_test.go b/internal/statsengine/engine_test.go
index f714844..9543405 100644
--- a/internal/statsengine/engine_test.go
+++ b/internal/statsengine/engine_test.go
@@ -67,6 +67,13 @@ func TestEngineIngestAndSnapshotIntegration(t *testing.T) {
 	if len(snap.Syscalls()) != 3 {
 		t.Fatalf("expected 3 syscall rows, got %d", len(snap.Syscalls()))
 	}
+	families := familyRowsByName(snap.Families())
+	if len(families) != 1 {
+		t.Fatalf("expected 1 family row, got %d", len(families))
+	}
+	if fs := families["FS"]; fs.Count != 3 || fs.Errors != 1 || fs.Bytes != 170 {
+		t.Fatalf("FS family = %+v, want count=3 errors=1 bytes=170", fs)
+	}
 	if len(snap.Files()) != 2 {
 		t.Fatalf("expected top 2 files due to topN=2, got %d", len(snap.Files()))
 	}
@@ -78,6 +85,50 @@ func TestEngineIngestAndSnapshotIntegration(t *testing.T) {
 	}
 }
 
+func TestEngineAggregatesSyscallFamilies(t *testing.T) {
+	clock := &fakeClock{now: time.Unix(3000, 0)}
+	engine := newEngineWithClock(10, clock.Now)
+
+	engine.Ingest(newEnginePair(types.SYS_ENTER_EPOLL_WAIT, 0, types.UNCLASSIFIED, "poller", 1, "", 0, 100, 1))
+	engine.Ingest(newEnginePair(types.SYS_ENTER_POLL, -1, types.UNCLASSIFIED, "poller", 1, "", 0, 300, 2))
+	engine.Ingest(newEnginePair(types.SYS_ENTER_GETPID, 0, types.UNCLASSIFIED, "proc", 2, "", 0, 50, 3))
+	engine.Ingest(newEnginePair(types.SYS_ENTER_READ, 4, types.READ_CLASSIFIED, "reader", 3, "/tmp/a", 4, 25, 4))
+	clock.Advance(time.Second)
+
+	snap, err := engine.Snapshot()
+	if err != nil {
+		t.Fatalf("Snapshot() error = %v", err)
+	}
+
+	families := familyRowsByName(snap.Families())
+	polling := families["Polling"]
+	if polling.Count != 2 || polling.Errors != 1 || polling.LatencyMeanNs != 200 {
+		t.Fatalf("Polling family = %+v, want count=2 errors=1 mean=200ns", polling)
+	}
+	if families["Process"].Count != 1 {
+		t.Fatalf("Process family = %+v, want count=1", families["Process"])
+	}
+	if families["FS"].Count != 1 || families["FS"].Bytes != 4 {
+		t.Fatalf("FS family = %+v, want count=1 bytes=4", families["FS"])
+	}
+
+	nonIO := familyRowsByName(snap.NonIOFamilies())
+	if _, ok := nonIO["FS"]; ok {
+		t.Fatalf("NonIOFamilies should not include FS: %+v", nonIO["FS"])
+	}
+	if nonIO["Polling"].Count != 2 || nonIO["Process"].Count != 1 {
+		t.Fatalf("NonIOFamilies missing expected rows: %+v", nonIO)
+	}
+}
+
+func familyRowsByName(rows []FamilySnapshot) map[string]FamilySnapshot {
+	result := make(map[string]FamilySnapshot, len(rows))
+	for _, row := range rows {
+		result[row.Name] = row
+	}
+	return result
+}
+
 func TestEngineSnapshotWithNoEvents(t *testing.T) {
 	clock := &fakeClock{now: time.Unix(2000, 0)}
 	engine := newEngineWithClock(10, clock.Now)
diff --git a/internal/statsengine/family.go b/internal/statsengine/family.go
new file mode 100644
index 0000000..3206d57
--- /dev/null
+++ b/internal/statsengine/family.go
@@ -0,0 +1,121 @@
+package statsengine
+
+import (
+	"cmp"
+	"slices"
+	"time"
+
+	"ior/internal/event"
+	"ior/internal/types"
+)
+
+type familyAccumulator struct {
+	byFamily map[types.SyscallFamily]*familyStats
+}
+
+type familyStats struct {
+	family       types.SyscallFamily
+	count        uint64
+	errorCount   uint64
+	totalBytes   uint64
+	totalLatency uint64
+	minLatency   uint64
+	maxLatency   uint64
+}
+
+type familySnapshotInput struct {
+	family       types.SyscallFamily
+	count        uint64
+	errorCount   uint64
+	totalBytes   uint64
+	totalLatency uint64
+	minLatency   uint64
+	maxLatency   uint64
+}
+
+func newFamilyAccumulator() *familyAccumulator {
+	return &familyAccumulator{byFamily: make(map[types.SyscallFamily]*familyStats)}
+}
+
+func (a *familyAccumulator) Add(pair *event.Pair) {
+	if a == nil || pair == nil || pair.EnterEv == nil {
+		return
+	}
+
+	family := pair.EnterEv.GetTraceId().Family()
+	stats := a.byFamily[family]
+	if stats == nil {
+		stats = &familyStats{family: family}
+		a.byFamily[family] = stats
+	}
+
+	stats.count++
+	stats.totalBytes += pair.Bytes
+	stats.totalLatency += pair.Duration
+	stats.updateMinMax(pair.Duration)
+
+	if retEv, ok := pair.ExitEv.(*types.RetEvent); ok && retEv.Ret < 0 {
+		stats.errorCount++
+	}
+}
+
+func (a *familyAccumulator) snapshotInputs() []familySnapshotInput {
+	if a == nil {
+		return nil
+	}
+
+	inputs := make([]familySnapshotInput, 0, len(a.byFamily))
+	for _, stats := range a.byFamily {
+		inputs = append(inputs, familySnapshotInput{
+			family:       stats.family,
+			count:        stats.count,
+			errorCount:   stats.errorCount,
+			totalBytes:   stats.totalBytes,
+			totalLatency: stats.totalLatency,
+			minLatency:   stats.minLatency,
+			maxLatency:   stats.maxLatency,
+		})
+	}
+	return inputs
+}
+
+func buildFamilySnapshots(inputs []familySnapshotInput, elapsed time.Duration) ([]FamilySnapshot, error) {
+	rateDiv := elapsed.Seconds()
+	result := make([]FamilySnapshot, 0, len(inputs))
+	for _, in := range inputs {
+		result = append(result, in.toSnapshot(rateDiv))
+	}
+	slices.SortFunc(result, compareFamilyDefault)
+	return result, nil
+}
+
+func (s *familyStats) updateMinMax(duration uint64) {
+	if s.count == 1 || duration < s.minLatency {
+		s.minLatency = duration
+	}
+	if duration > s.maxLatency {
+		s.maxLatency = duration
+	}
+}
+
+func (s familySnapshotInput) toSnapshot(rateDiv float64) FamilySnapshot {
+	return FamilySnapshot{
+		Family:         s.family,
+		Name:           string(s.family),
+		Count:          s.count,
+		RatePerSec:     safeRate(s.count, rateDiv),
+		Errors:         s.errorCount,
+		Bytes:          s.totalBytes,
+		LatencyMinNs:   s.minLatency,
+		LatencyMaxNs:   s.maxLatency,
+		LatencyMeanNs:  float64(s.totalLatency) / float64(maxU64(s.count, 1)),
+		TotalLatencyNs: s.totalLatency,
+	}
+}
+
+func compareFamilyDefault(left, right FamilySnapshot) int {
+	if left.Count != right.Count {
+		return cmp.Compare(right.Count, left.Count)
+	}
+	return cmp.Compare(types.SyscallFamilyRank(left.Family), types.SyscallFamilyRank(right.Family))
+}
diff --git a/internal/statsengine/snapshot.go b/internal/statsengine/snapshot.go
index 7a95ab8..859cd2e 100644
--- a/internal/statsengine/snapshot.go
+++ b/internal/statsengine/snapshot.go
@@ -51,6 +51,7 @@ type Snapshot struct {
 	throughputSeriesB []float64
 
 	syscalls  []SyscallSnapshot
+	families  []FamilySnapshot
 	files     []FileSnapshot
 	processes []ProcessSnapshot
 
@@ -77,6 +78,22 @@ type SyscallSnapshot struct {
 	LatencyP99Ns   uint64
 }
 
+// FamilySnapshot is an aggregated syscall-family row.
+type FamilySnapshot struct {
+	Family types.SyscallFamily
+	Name   string
+
+	Count      uint64
+	RatePerSec float64
+	Errors     uint64
+	Bytes      uint64
+
+	LatencyMinNs   uint64
+	LatencyMaxNs   uint64
+	LatencyMeanNs  float64
+	TotalLatencyNs uint64
+}
+
 // FileSnapshot is an aggregated per-file ranking entry.
 type FileSnapshot struct {
 	Path string
@@ -129,11 +146,31 @@ func NewSnapshot(
 	latencyHistogram HistogramSnapshot,
 	gapHistogram HistogramSnapshot,
 ) Snapshot {
+	return NewSnapshotWithFamilies(
+		latencySeriesNs, gapSeriesNs, throughputSeriesB,
+		syscalls, nil, files, processes,
+		latencyHistogram, gapHistogram,
+	)
+}
+
+// NewSnapshotWithFamilies creates a snapshot including family aggregate rows.
+func NewSnapshotWithFamilies(
+	latencySeriesNs []float64,
+	gapSeriesNs []float64,
+	throughputSeriesB []float64,
+	syscalls []SyscallSnapshot,
+	families []FamilySnapshot,
+	files []FileSnapshot,
+	processes []ProcessSnapshot,
+	latencyHistogram HistogramSnapshot,
+	gapHistogram HistogramSnapshot,
+) Snapshot {
 	return Snapshot{
 		latencySeriesNs:   slices.Clone(latencySeriesNs),
 		gapSeriesNs:       slices.Clone(gapSeriesNs),
 		throughputSeriesB: slices.Clone(throughputSeriesB),
 		syscalls:          slices.Clone(syscalls),
+		families:          slices.Clone(families),
 		files:             slices.Clone(files),
 		processes:         slices.Clone(processes),
 		LatencyHistogram:  latencyHistogram.Clone(),
@@ -187,6 +224,39 @@ func (s Snapshot) SyscallsCount() int {
 	return len(s.syscalls)
 }
 
+// Families returns per-syscall-family snapshot rows.
+// Callers must treat returned data as read-only.
+func (s Snapshot) Families() []FamilySnapshot {
+	return s.families
+}
+
+// FamiliesCount returns number of syscall-family rows without cloning backing slices.
+func (s Snapshot) FamiliesCount() int {
+	return len(s.families)
+}
+
+// NonIOFamilies returns family rows outside the file-system/fd-focused family.
+func (s Snapshot) NonIOFamilies() []FamilySnapshot {
+	rows := make([]FamilySnapshot, 0, len(s.families))
+	for _, row := range s.families {
+		if types.IsNonIOSyscallFamily(row.Family) {
+			rows = append(rows, row)
+		}
+	}
+	return rows
+}
+
+// NonIOFamiliesCount returns number of non-FS syscall-family rows.
+func (s Snapshot) NonIOFamiliesCount() int {
+	count := 0
+	for _, row := range s.families {
+		if types.IsNonIOSyscallFamily(row.Family) {
+			count++
+		}
+	}
+	return count
+}
+
 // TopNSyscalls returns at most n per-syscall rows in ranking order.
 // Callers must treat returned data as read-only.
 func (s Snapshot) TopNSyscalls(n int) []SyscallSnapshot {
diff --git a/internal/statsengine/snapshot_test.go b/internal/statsengine/snapshot_test.go
index 277fa0d..9b54409 100644
--- a/internal/statsengine/snapshot_test.go
+++ b/internal/statsengine/snapshot_test.go
@@ -1,22 +1,28 @@
 package statsengine
 
-import "testing"
+import (
+	"testing"
+
+	"ior/internal/types"
+)
 
 func TestNewSnapshotDefensivelyCopiesSlices(t *testing.T) {
 	latency := []float64{1, 2, 3}
 	gap := []float64{4, 5, 6}
 	throughput := []float64{7, 8, 9}
 	syscalls := []SyscallSnapshot{{Name: "read", Count: 1}}
+	families := []FamilySnapshot{{Family: types.FamilyPolling, Name: "Polling", Count: 3}}
 	files := []FileSnapshot{{Path: "/tmp/a", Accesses: 2}}
 	processes := []ProcessSnapshot{{PID: 10, Comm: "cmd"}}
 	latencyBuckets := []HistogramBucketSnapshot{{Label: "[0,1)", Count: 3}}
 	gapBuckets := []HistogramBucketSnapshot{{Label: "[1,10)", Count: 4}}
 
-	s := NewSnapshot(
+	s := NewSnapshotWithFamilies(
 		latency,
 		gap,
 		throughput,
 		syscalls,
+		families,
 		files,
 		processes,
 		NewHistogramSnapshot(3, latencyBuckets),
@@ -27,6 +33,7 @@ func TestNewSnapshotDefensivelyCopiesSlices(t *testing.T) {
 	gap[0] = 99
 	throughput[0] = 99
 	syscalls[0].Name = "write"
+	families[0].Name = "FS"
 	files[0].Path = "/tmp/b"
 	processes[0].Comm = "mutated"
 	latencyBuckets[0].Count = 99
@@ -44,6 +51,9 @@ func TestNewSnapshotDefensivelyCopiesSlices(t *testing.T) {
 	if got := s.Syscalls()[0].Name; got != "read" {
 		t.Fatalf("syscalls mutated through input slice: got %q", got)
 	}
+	if got := s.Families()[0].Name; got != "Polling" {
+		t.Fatalf("families mutated through input slice: got %q", got)
+	}
 	if got := s.Files()[0].Path; got != "/tmp/a" {
 		t.Fatalf("files mutated through input slice: got %q", got)
 	}
@@ -59,11 +69,12 @@ func TestNewSnapshotDefensivelyCopiesSlices(t *testing.T) {
 }
 
 func TestSnapshotAccessorsReturnReadOnlyViews(t *testing.T) {
-	s := NewSnapshot(
+	s := NewSnapshotWithFamilies(
 		[]float64{1},
 		[]float64{2},
 		[]float64{3},
 		[]SyscallSnapshot{{Name: "read"}},
+		[]FamilySnapshot{{Family: types.FamilyPolling, Name: "Polling"}},
 		[]FileSnapshot{{Path: "/tmp/a"}},
 		[]ProcessSnapshot{{Comm: "cmd"}},
 		NewHistogramSnapshot(1, []HistogramBucketSnapshot{{Label: "a", Count: 1}}),
@@ -82,6 +93,12 @@ func TestSnapshotAccessorsReturnReadOnlyViews(t *testing.T) {
 		t.Fatalf("expected accessor to return backing slice view, got %q", got)
 	}
 
+	families := s.Families()
+	families[0].Name = "Process"
+	if got := s.Families()[0].Name; got != "Process" {
+		t.Fatalf("expected family accessor to return backing slice view, got %q", got)
+	}
+
 	buckets := s.LatencyHistogram.Buckets()
 	buckets[0].Count = 99
 	if got := s.LatencyHistogram.Buckets()[0].Count; got != 99 {
@@ -97,6 +114,9 @@ func TestNilAccessorsRemainNil(t *testing.T) {
 	if got := s.Syscalls(); got != nil {
 		t.Fatalf("expected nil syscalls, got %#v", got)
 	}
+	if got := s.Families(); got != nil {
+		t.Fatalf("expected nil families, got %#v", got)
+	}
 
 	h := HistogramSnapshot{}
 	if got := h.Buckets(); got != nil {
@@ -104,6 +124,35 @@ func TestNilAccessorsRemainNil(t *testing.T) {
 	}
 }
 
+func TestSnapshotNonIOFamilies(t *testing.T) {
+	s := NewSnapshotWithFamilies(
+		nil,
+		nil,
+		nil,
+		nil,
+		[]FamilySnapshot{
+			{Family: types.FamilyFS, Name: "FS"},
+			{Family: types.FamilyPolling, Name: "Polling"},
+			{Family: types.FamilyProcess, Name: "Process"},
+		},
+		nil,
+		nil,
+		HistogramSnapshot{},
+		HistogramSnapshot{},
+	)
+
+	rows := s.NonIOFamilies()
+	if len(rows) != 2 {
+		t.Fatalf("NonIOFamilies len = %d, want 2", len(rows))
+	}
+	if rows[0].Family == types.FamilyFS || rows[1].Family == types.FamilyFS {
+		t.Fatalf("NonIOFamilies included FS: %+v", rows)
+	}
+	if got := s.NonIOFamiliesCount(); got != 2 {
+		t.Fatalf("NonIOFamiliesCount = %d, want 2", got)
+	}
+}
+
 func TestTopNAccessors(t *testing.T) {
 	s := NewSnapshot(
 		nil,
diff --git a/internal/streamrow/row.go b/internal/streamrow/row.go
index 026aa93..5bccb61 100644
--- a/internal/streamrow/row.go
+++ b/internal/streamrow/row.go
@@ -15,6 +15,7 @@ type Row struct {
 	Seq        uint64
 	TimeNs     uint64
 	Syscall    string
+	Family     string
 	Comm       string
 	PID        uint32
 	TID        uint32
@@ -101,6 +102,7 @@ func New(seq uint64, pair *event.Pair) Row {
 		Seq:        seq,
 		TimeNs:     pair.EnterEv.GetTime(),
 		Syscall:    pair.EnterEv.GetTraceId().Name(),
+		Family:     string(pair.EnterEv.GetTraceId().Family()),
 		Comm:       pair.Comm,
 		PID:        pair.EnterEv.GetPid(),
 		TID:        pair.EnterEv.GetTid(),
@@ -138,6 +140,7 @@ func NewWarning(seq uint64, message string) Row {
 		Seq:      seq,
 		TimeNs:   now,
 		Syscall:  "warning",
+		Family:   string(types.FamilyMisc),
 		Comm:     "ior",
 		FileName: message,
 		FD:       UnknownFD,
diff --git a/internal/streamrow/row_test.go b/internal/streamrow/row_test.go
index ea63bcc..304aa12 100644
--- a/internal/streamrow/row_test.go
+++ b/internal/streamrow/row_test.go
@@ -66,8 +66,8 @@ func TestNewPopulatesFieldsFromPair(t *testing.T) {
 	if got.Seq != 9 || got.TimeNs != 1234 {
 		t.Fatalf("Seq/TimeNs = %d/%d, want 9/1234", got.Seq, got.TimeNs)
 	}
-	if got.Syscall != "openat" || got.Comm != "cat" {
-		t.Fatalf("Syscall/Comm = %q/%q, want openat/cat", got.Syscall, got.Comm)
+	if got.Syscall != "openat" || got.Family != "FS" || got.Comm != "cat" {
+		t.Fatalf("Syscall/Family/Comm = %q/%q/%q, want openat/FS/cat", got.Syscall, got.Family, got.Comm)
 	}
 	if got.PID != 42 || got.TID != 84 {
 		t.Fatalf("PID/TID = %d/%d, want 42/84", got.PID, got.TID)
@@ -88,8 +88,8 @@ func TestNewWarningPopulatesSyntheticWarningFields(t *testing.T) {
 	if got.Seq != 7 || got.TimeNs == 0 {
 		t.Fatalf("Seq/TimeNs = %d/%d, want 7/non-zero", got.Seq, got.TimeNs)
 	}
-	if got.Syscall != "warning" || got.Comm != "ior" {
-		t.Fatalf("Syscall/Comm = %q/%q, want warning/ior", got.Syscall, got.Comm)
+	if got.Syscall != "warning" || got.Family != "Misc" || got.Comm != "ior" {
+		t.Fatalf("Syscall/Family/Comm = %q/%q/%q, want warning/Misc/ior", got.Syscall, got.Family, got.Comm)
 	}
 	if got.FileName != "Dropped malformed event" || got.FD != UnknownFD {
 		t.Fatalf("FileName/FD = %q/%d, want warning text/%d", got.FileName, got.FD, UnknownFD)
diff --git a/internal/tui/common/keys.go b/internal/tui/common/keys.go
index e50ee94..ffdc31a 100644
--- a/internal/tui/common/keys.go
+++ b/internal/tui/common/keys.go
@@ -19,6 +19,7 @@ type KeyMap struct {
 	Five        key.Binding
 	Six         key.Binding
 	Seven       key.Binding
+	Eight       key.Binding
 	Visualize   key.Binding
 	Metric      key.Binding
 	Sort        key.Binding
@@ -62,6 +63,7 @@ func DefaultKeyMap() KeyMap {
 		Five:        keyBinding("processes", "5"),
 		Six:         keyBinding("lat+gaps", "6"),
 		Seven:       keyBinding("stream", "7"),
+		Eight:       keyBinding("non-io", "8"),
 		Visualize:   keyBinding("viz", "v"),
 		Metric:      keyBinding("metric", "b"),
 		Sort:        keyBinding("sort table", "s"),
@@ -110,7 +112,7 @@ func (k KeyMap) globalStatusBindings() []key.Binding {
 	bindings := []key.Binding{
 		helpTextBinding("H", "toggle help"),
 		k.Tab, k.ShiftTab,
-		k.One, k.Two, k.Three, k.Four, k.Five, k.Six, k.Seven,
+		k.One, k.Two, k.Three, k.Four, k.Five, k.Six, k.Seven, k.Eight,
 		k.Visualize, k.Metric, k.Sort, k.ReverseSort,
 		k.Filter, k.FilterUndo,
 		k.SelectPID, k.SelectTID,
@@ -154,7 +156,7 @@ func (k KeyMap) DashboardFullHelp() [][]key.Binding {
 	controls = append(controls, k.Visualize, k.Metric, k.Sort, k.ReverseSort, k.Filter, k.FilterUndo)
 
 	return [][]key.Binding{
-		{k.One, k.Two, k.Three, k.Four, k.Five, k.Six, k.Seven},
+		{k.One, k.Two, k.Three, k.Four, k.Five, k.Six, k.Seven, k.Eight},
 		controls,
 		{
 			helpTextBinding("space", "stream pause"),
diff --git a/internal/tui/dashboard/model.go b/internal/tui/dashboard/model.go
index 1c6f66c..1f479c7 100644
--- a/internal/tui/dashboard/model.go
+++ b/internal/tui/dashboard/model.go
@@ -103,6 +103,8 @@ type Model struct {
 	syscallsCol              int
 	syscallsSort             tableSortState[syscallSortKey]
 	syscallsTreemapSelection int
+	nonIOOffset              int
+	nonIOCol                 int
 	filesOffset              int
 	filesCol                 int
 	filesSort                tableSortState[fileSortKey]
@@ -304,6 +306,7 @@ func (m Model) handleStatsTick(msg messages.StatsTickMsg) (tea.Model, tea.Cmd) {
 	m.reanchorFilesDirOffset(selectedDir)
 	m.reanchorProcessesOffset(selectedProcess)
 	m.syscallsTreemapSelection = clampOffset(m.syscallsTreemapSelection, m.maxSyscallsRows())
+	m.nonIOOffset = clampOffset(m.nonIOOffset, m.maxNonIORows())
 	m.clampTableColumns()
 	m.streamModel.Refresh()
 	if m.refreshBubbleData() {
@@ -870,6 +873,7 @@ func scrollOffset(keyStr string, offset *int, maxRows int) bool {
 
 func (m *Model) clampTableColumns() {
 	m.syscallsCol = common.ClampTableCol(m.syscallsCol, len(syscallColumns(m.width)))
+	m.nonIOCol = common.ClampTableCol(m.nonIOCol, len(nonIOColumns(m.width)))
 	m.filesCol = common.ClampTableCol(m.filesCol, len(fileColumns(m.width)))
 	m.filesDirCol = common.ClampTableCol(m.filesDirCol, len(fileDirColumns(m.width)))
 	m.processesCol = common.ClampTableCol(m.processesCol, len(processColumns()))
@@ -879,6 +883,10 @@ func (m Model) maxSyscallsRows() int {
 	return m.snapshotOrZero().SyscallsCount()
 }
 
+func (m Model) maxNonIORows() int {
+	return m.snapshotOrZero().NonIOFamiliesCount()
+}
+
 func (m Model) maxFilesRows() int {
 	return m.snapshotOrZero().FilesCount()
 }
@@ -1269,6 +1277,8 @@ func (m Model) renderActiveContentTable(width, activeHeight int) (string, bool)
 	switch {
 	case m.activeTab == TabSyscalls && m.latest != nil:
 		return renderSyscallsWithSort(m.latest, width, activeHeight, m.syscallsOffset, m.syscallsCol, m.syscallsSort), true
+	case m.activeTab == TabNonIO && m.latest != nil:
+		return renderNonIOWithOffset(m.latest, width, activeHeight, m.nonIOOffset, m.nonIOCol), true
 	case m.activeTab == TabFiles && m.latest != nil && m.filesVizMode == tabVizModeTable:
 		if m.filesDirGrouped {
 			return renderFilesDirGroupedWithSort(m.latest, width, activeHeight, m.filesDirOffset, m.filesDirCol, m.filesDirSort), true
diff --git a/internal/tui/dashboard/nonio.go b/internal/tui/dashboard/nonio.go
new file mode 100644
index 0000000..aef63f4
--- /dev/null
+++ b/internal/tui/dashboard/nonio.go
@@ -0,0 +1,99 @@
+package dashboard
+
+import (
+	"fmt"
+	"strconv"
+
+	"ior/internal/statsengine"
+	common "ior/internal/tui/common"
+)
+
+func renderNonIO(snap *statsengine.Snapshot, width, height int) string {
+	return renderNonIOWithOffset(snap, width, height, 0, 0)
+}
+
+func renderNonIOWithOffset(snap *statsengine.Snapshot, width, height, offset, selectedCol int) string {
+	if snap == nil {
+		return "Non-IO: waiting for stats..."
+	}
+
+	rowsData := snap.NonIOFamilies()
+	columns, rows := nonIOTableData(rowsData, width)
+	if len(rows) == 0 {
+		return "Non-IO: no data"
+	}
+	return renderSelectableTable(
+		columns,
+		rows,
+		height,
+		offset,
+		selectedCol,
+		"families excluding file/fd",
+	)
+}
+
+func nonIOTableData(families []statsengine.FamilySnapshot, width int) ([]common.TableColumn, [][]string) {
+	columns := nonIOColumns(width)
+	if width < 130 {
+		return columns, nonIORowsCompact(families)
+	}
+	return columns, nonIORowsFull(families)
+}
+
+func nonIOColumns(width int) []common.TableColumn {
+	if width < 130 {
+		return []common.TableColumn{
+			{Title: "Family", Width: 10},
+			{Title: "Count", Width: 7},
+			{Title: "Rate/s", Width: 7},
+			{Title: "Avg", Width: 8},
+			{Title: "Bytes", Width: 8},
+			{Title: "Errors", Width: 6},
+		}
+	}
+
+	return []common.TableColumn{
+		{Title: "Family", Width: 12},
+		{Title: "Count", Width: 8},
+		{Title: "Rate/s", Width: 8},
+		{Title: "Avg", Width: 9},
+		{Title: "Min", Width: 9},
+		{Title: "Max", Width: 9},
+		{Title: "Total", Width: 10},
+		{Title: "Bytes", Width: 10},
+		{Title: "Errors", Width: 8},
+	}
+}
+
+func nonIORowsFull(families []statsengine.FamilySnapshot) [][]string {
+	rows := make([][]string, 0, len(families))
+	for _, f := range families {
+		rows = append(rows, []string{
+			f.Name,
+			strconv.FormatUint(f.Count, 10),
+			fmt.Sprintf("%.1f", f.RatePerSec),
+			formatDurationNs(f.LatencyMeanNs),
+			formatDurationUintNs(f.LatencyMinNs),
+			formatDurationUintNs(f.LatencyMaxNs),
+			formatDurationUintNs(f.TotalLatencyNs),
+			formatBytes(float64(f.Bytes)),
+			strconv.FormatUint(f.Errors, 10),
+		})
+	}
+	return rows
+}
+
+func nonIORowsCompact(families []statsengine.FamilySnapshot) [][]string {
+	rows := make([][]string, 0, len(families))
+	for _, f := range families {
+		rows = append(rows, []string{
+			f.Name,
+			strconv.FormatUint(f.Count, 10),
+			fmt.Sprintf("%.1f", f.RatePerSec),
+			formatDurationNs(f.LatencyMeanNs),
+			formatBytes(float64(f.Bytes)),
+			strconv.FormatUint(f.Errors, 10),
+		})
+	}
+	return rows
+}
diff --git a/internal/tui/dashboard/nonio_test.go b/internal/tui/dashboard/nonio_test.go
new file mode 100644
index 0000000..5fabc76
--- /dev/null
+++ b/internal/tui/dashboard/nonio_test.go
@@ -0,0 +1,37 @@
+package dashboard
+
+import (
+	"strings"
+	"testing"
+
+	"ior/internal/statsengine"
+	"ior/internal/types"
+)
+
+func TestRenderNonIOIncludesExpectedFamilyRows(t *testing.T) {
+	snap := statsengine.NewSnapshotWithFamilies(
+		nil,
+		nil,
+		nil,
+		nil,
+		[]statsengine.FamilySnapshot{
+			{Family: types.FamilyFS, Name: "FS", Count: 99},
+			{Family: types.FamilyPolling, Name: "Polling", Count: 7, RatePerSec: 3.5, Errors: 1},
+			{Family: types.FamilyProcess, Name: "Process", Count: 2},
+		},
+		nil,
+		nil,
+		statsengine.HistogramSnapshot{},
+		statsengine.HistogramSnapshot{},
+	)
+
+	out := renderNonIO(&snap, 120, 20)
+	for _, token := range []string{"Family", "Count", "Rate/s", "Polling", "Process"} {
+		if !strings.Contains(out, token) {
+			t.Fatalf("expected token %q in non-io table:\n%s", token, out)
+		}
+	}
+	if strings.Contains(out, "FS") {
+		t.Fatalf("non-io table should exclude FS rows:\n%s", out)
+	}
+}
diff --git a/internal/tui/dashboard/tabregistry.go b/internal/tui/dashboard/tabregistry.go
index 76fa216..c9f6d06 100644
--- a/internal/tui/dashboard/tabregistry.go
+++ b/internal/tui/dashboard/tabregistry.go
@@ -90,6 +90,15 @@ var tabDescriptors = map[Tab]tabDescriptor{
 		HandleScroll:    tabScrollSyscalls,
 		ShortcutKey:     func(k common.KeyMap) key.Binding { return k.Three },
 	},
+	TabNonIO: {
+		Name:            "Non-IO",
+		ShortName:       "NIO",
+		Position:        75,
+		AllowedVizModes: []tabVizMode{tabVizModeTable},
+		Render:          tabRenderNonIO,
+		HandleScroll:    tabScrollNonIO,
+		ShortcutKey:     func(k common.KeyMap) key.Binding { return k.Eight },
+	},
 	TabFiles: {
 		Name:            "Files",
 		ShortName:       "Fil",
@@ -202,6 +211,12 @@ func tabRenderSyscalls(_ *Model, snap *statsengine.Snapshot, _ *eventstream.Mode
 	return renderSyscalls(snap, width, height)
 }
 
+// tabRenderNonIO adapts renderNonIO to the tabRenderFn signature.
+// Offset rendering is handled by renderActiveContentTable before this path.
+func tabRenderNonIO(_ *Model, snap *statsengine.Snapshot, _ *eventstream.Model, _ *flamegraphtui.Model, width, height int) string {
+	return renderNonIO(snap, width, height)
+}
+
 // tabRenderFiles adapts renderFiles to the tabRenderFn signature, choosing
 // between the dir-grouped and plain view based on model state.
 // Sort-state rendering is handled by renderActiveContentTable before this path.
@@ -241,6 +256,13 @@ func tabScrollSyscalls(m *Model, msg tea.KeyPressMsg) (bool, tea.Cmd) {
 		m.maxSyscallsRows(), len(syscallColumns(m.width)), tablePageStep(m.activeTableHeight())), nil
 }
 
+// tabScrollNonIO handles navigation keys for the non-IO family table.
+func tabScrollNonIO(m *Model, msg tea.KeyPressMsg) (bool, tea.Cmd) {
+	keyStr := msg.String()
+	return common.HandleTableNavigationKey(keyStr, &m.nonIOOffset, &m.nonIOCol,
+		m.maxNonIORows(), len(nonIOColumns(m.width)), tablePageStep(m.activeTableHeight())), nil
+}
+
 // tabScrollFiles handles navigation keys for the files tab, selecting between
 // the dir-grouped and plain navigation paths based on model state.
 func tabScrollFiles(m *Model, msg tea.KeyPressMsg) (bool, tea.Cmd) {
diff --git a/internal/tui/dashboard/tabs.go b/internal/tui/dashboard/tabs.go
index 8fc5132..2772a0a 100644
--- a/internal/tui/dashboard/tabs.go
+++ b/internal/tui/dashboard/tabs.go
@@ -18,6 +18,8 @@ const (
 	TabOverview Tab = iota
 	// TabSyscalls is the syscall table tab.
 	TabSyscalls
+	// TabNonIO is the syscall-family summary tab for non-FS families.
+	TabNonIO
 	// TabFiles is the file ranking tab.
 	TabFiles
 	// TabProcesses is the process breakdown tab.
diff --git a/internal/tui/dashboard/tabs_test.go b/internal/tui/dashboard/tabs_test.go
index cbf1810..4e9dce6 100644
--- a/internal/tui/dashboard/tabs_test.go
+++ b/internal/tui/dashboard/tabs_test.go
@@ -11,8 +11,14 @@ func TestTabNavigationWraps(t *testing.T) {
 	if got := nextTab(TabLatency); got != TabStream {
 		t.Fatalf("expected next after latency+gaps to be stream, got %v", got)
 	}
-	if got := nextTab(TabStream); got != TabFlame {
-		t.Fatalf("expected next after stream to be flame, got %v", got)
+	if got := nextTab(TabStream); got != TabNonIO {
+		t.Fatalf("expected next after stream to be non-io, got %v", got)
+	}
+	if got := prevTab(TabFlame); got != TabNonIO {
+		t.Fatalf("expected prev before flame to be non-io, got %v", got)
+	}
+	if got := nextTab(TabNonIO); got != TabFlame {
+		t.Fatalf("expected next after non-io to be flame, got %v", got)
 	}
 	if got := nextTab(TabFlame); got != TabOverview {
 		t.Fatalf("expected wrap to overview from flame, got %v", got)
@@ -23,8 +29,8 @@ func TestTabNavigationWraps(t *testing.T) {
 }
 
 func TestRenderTabBarContainsLabels(t *testing.T) {
-	out := renderTabBar(TabOverview, 100)
-	for _, label := range []string{"Overview", "Syscalls", "Files", "Processes", "Latency+Gaps", "Stream", "Flame"} {
+	out := renderTabBar(TabOverview, 140)
+	for _, label := range []string{"Overview", "Syscalls", "Files", "Processes", "Latency+Gaps", "Stream", "Non-IO", "Flame"} {
 		if !strings.Contains(out, label) {
 			t.Fatalf("expected tab label %q in tab bar", label)
 		}
diff --git a/internal/tui/eventstream/export.go b/internal/tui/eventstream/export.go
index 46e3a23..accec8a 100644
--- a/internal/tui/eventstream/export.go
+++ b/internal/tui/eventstream/export.go
@@ -182,7 +182,7 @@ func exportRowsToCSV(rows []StreamEvent, exportDir, filename string) (string, er
 // writeStreamCSV writes the CSV header and all event rows to w, calling fail
 // on the first write error to close the underlying file before returning.
 func writeStreamCSV(w *csv.Writer, rows []StreamEvent, fail func(error) (string, error)) error {
-	header := []string{"seq", "time_ns", "gap_ns", "latency_ns", "comm", "pid", "tid", "syscall", "fd", "ret", "bytes", "file", "error"}
+	header := []string{"seq", "time_ns", "gap_ns", "latency_ns", "comm", "pid", "tid", "syscall", "family", "fd", "ret", "bytes", "file", "error"}
 	if err := w.Write(header); err != nil {
 		_, err = fail(err)
 		return err
@@ -198,6 +198,7 @@ func writeStreamCSV(w *csv.Writer, rows []StreamEvent, fail func(error) (string,
 			fmt.Sprintf("%d", ev.PID),
 			fmt.Sprintf("%d", ev.TID),
 			ev.Syscall,
+			ev.Family,
 			fmt.Sprintf("%d", ev.FD),
 			fmt.Sprintf("%d", ev.RetVal),
 			fmt.Sprintf("%d", ev.Bytes),
diff --git a/internal/tui/help.go b/internal/tui/help.go
index 5a343cb..04362b8 100644
--- a/internal/tui/help.go
+++ b/internal/tui/help.go
@@ -69,7 +69,7 @@ func (m Model) helpSections() []helpSection {
 		{
 			title: "Dashboard Tabs",
 			lines: []string{
-				"tab/shift+tab tabs  1..7 jump tab  r reset baseline  R parquet rec",
+				"tab/shift+tab tabs  1..8 jump tab  r reset baseline  R parquet rec",
 				"I cycle auto-reset (off → 10s → 30s → 1m → 2m → 5m); status shows remaining/total",
 				"sys/files/proc/stream tables: arrows or hjkl move  pgup/pgdown page  g/G top/bottom",
 				"sys/files/proc tables: s sort  S reverse sort",
diff --git a/internal/types/family.go b/internal/types/family.go
new file mode 100644
index 0000000..6aee5c0
--- /dev/null
+++ b/internal/types/family.go
@@ -0,0 +1,39 @@
+package types
+
+// AllSyscallFamilies returns the dashboard display order for broad syscall families.
+func AllSyscallFamilies() []SyscallFamily {
+	return []SyscallFamily{
+		FamilyNetwork,
+		FamilyMemory,
+		FamilySignals,
+		FamilySched,
+		FamilyIPC,
+		FamilyTime,
+		FamilyProcess,
+		FamilySecurity,
+		FamilyFS,
+		FamilyPolling,
+		FamilyAIO,
+		FamilyMisc,
+	}
+}
+
+// IsFileSyscallFamily reports whether family belongs to file-system/syscall-fd views.
+func IsFileSyscallFamily(family SyscallFamily) bool {
+	return family == FamilyFS
+}
+
+// IsNonIOSyscallFamily reports whether family should appear in the Non-IO tab.
+func IsNonIOSyscallFamily(family SyscallFamily) bool {
+	return family != "" && !IsFileSyscallFamily(family)
+}
+
+// SyscallFamilyRank returns the stable display rank for a family.
+func SyscallFamilyRank(family SyscallFamily) int {
+	for idx, candidate := range AllSyscallFamilies() {
+		if candidate == family {
+			return idx
+		}
+	}
+	return len(AllSyscallFamilies())
+}
diff --git a/internal/types/generated_types.go b/internal/types/generated_types.go
index 543898b..7eeac21 100644
--- a/internal/types/generated_types.go
+++ b/internal/types/generated_types.go
@@ -11,6 +11,24 @@ import (
 type EventType uint32
 type TraceId uint32
 
+// SyscallFamily is the broad runtime grouping for a syscall tracepoint.
+type SyscallFamily string
+
+const (
+	FamilyNetwork  SyscallFamily = "Network"
+	FamilyMemory   SyscallFamily = "Memory"
+	FamilySignals  SyscallFamily = "Signals"
+	FamilySched    SyscallFamily = "Sched"
+	FamilyIPC      SyscallFamily = "IPC"
+	FamilyTime     SyscallFamily = "Time"
+	FamilyProcess  SyscallFamily = "Process"
+	FamilySecurity SyscallFamily = "Security"
+	FamilyFS       SyscallFamily = "FS"
+	FamilyPolling  SyscallFamily = "Polling"
+	FamilyAIO      SyscallFamily = "AIO"
+	FamilyMisc     SyscallFamily = "Misc"
+)
+
 var traceId2String = map[TraceId]string{
 	1847: "enter_socket", 1846: "exit_socket", 1845: "enter_socketpair", 1844: "exit_socketpair", 1843: "enter_bind", 1842: "exit_bind", 1841: "enter_listen", 1840: "exit_listen", 1839: "enter_accept4", 1838: "exit_accept4", 1837: "enter_accept", 1836: "exit_accept", 1835: "enter_connect", 1834: "exit_connect", 1833: "enter_getsockname", 1832: "exit_getsockname", 1831: "enter_getpeername", 1830: "exit_getpeername", 1829: "enter_sendto", 1828: "exit_sendto", 1827: "enter_recvfrom", 1826: "exit_recvfrom", 1825: "enter_setsockopt", 1824: "exit_setsockopt", 1823: "enter_getsockopt", 1822: "exit_getsockopt", 1821: "enter_shutdown", 1820: "exit_shutdown", 1819: "enter_sendmsg", 1818: "exit_sendmsg", 1817: "enter_sendmmsg", 1816: "exit_sendmmsg", 1815: "enter_recvmsg", 1814: "exit_recvmsg", 1813: "enter_recvmmsg", 1812: "exit_recvmmsg", 1575: "enter_getrandom", 1574: "exit_getrandom", 1528: "enter_io_uring_register", 1527: "exit_io_uring_register", 1509: "enter_io_uring_enter", 1508: "exit_io_uring_enter", 1507: "enter_io_uring_setup", 1506: "exit_io_uring_setup", 1491: "enter_ioprio_set", 1490: "exit_ioprio_set", 1489: "enter_ioprio_get", 1488: "exit_ioprio_get", 1463: "enter_landlock_create_ruleset", 1462: "exit_landlock_create_ruleset", 1461: "enter_landlock_add_rule", 1460: "exit_landlock_add_rule", 1459: "enter_landlock_restrict_self", 1458: "exit_landlock_restrict_self", 1456: "enter_lsm_set_self_attr", 1455: "exit_lsm_set_self_attr", 1454: "enter_lsm_get_self_attr", 1453: "exit_lsm_get_self_attr", 1452: "enter_lsm_list_modules", 1451: "exit_lsm_list_modules", 1449: "enter_add_key", 1448: "exit_add_key", 1447: "enter_request_key", 1446: "exit_request_key", 1445: "enter_keyctl", 1444: "exit_keyctl", 1443: "enter_mq_open", 1442: "exit_mq_open", 1441: "enter_mq_unlink", 1440: "exit_mq_unlink", 1439: "enter_mq_timedsend", 1438: "exit_mq_timedsend", 1437: "enter_mq_timedreceive", 1436: "exit_mq_timedreceive", 1435: "enter_mq_notify", 1434: "exit_mq_notify", 1433: "enter_mq_getsetattr", 1432: "exit_mq_getsetattr", 1431: "enter_shmget", 1430: "exit_shmget", 1429: "enter_shmctl", 1428: "exit_shmctl", 1427: "enter_shmat", 1426: "exit_shmat", 1425: "enter_shmdt", 1424: "exit_shmdt", 1423: "enter_semget", 1422: "exit_semget", 1421: "enter_semctl", 1420: "exit_semctl", 1419: "enter_semtimedop", 1418: "exit_semtimedop", 1417: "enter_semop", 1416: "exit_semop", 1415: "enter_msgget", 1414: "exit_msgget", 1413: "enter_msgctl", 1412: "exit_msgctl", 1411: "enter_msgsnd", 1410: "exit_msgsnd", 1409: "enter_msgrcv", 1408: "exit_msgrcv", 1164: "enter_quotactl", 1163: "exit_quotactl", 1162: "enter_quotactl_fd", 1161: "exit_quotactl_fd", 1146: "enter_name_to_handle_at", 1145: "exit_name_to_handle_at", 1144: "enter_open_by_handle_at", 1143: "exit_open_by_handle_at", 1130: "enter_flock", 1129: "exit_flock", 1111: "enter_io_setup", 1110: "exit_io_setup", 1109: "enter_io_destroy", 1108: "exit_io_destroy", 1107: "enter_io_submit", 1106: "exit_io_submit", 1105: "enter_io_cancel", 1104: "exit_io_cancel", 1103: "enter_io_getevents", 1102: "exit_io_getevents", 1101: "enter_io_pgetevents", 1100: "exit_io_pgetevents", 1099: "enter_userfaultfd", 1098: "exit_userfaultfd", 1097: "enter_eventfd2", 1096: "exit_eventfd2", 1095: "enter_eventfd", 1094: "exit_eventfd", 1093: "enter_timerfd_create", 1092: "exit_timerfd_create", 1091: "enter_timerfd_settime", 1090: "exit_timerfd_settime", 1089: "enter_timerfd_gettime", 1088: "exit_timerfd_gettime", 1087: "enter_signalfd4", 1086: "exit_signalfd4", 1085: "enter_signalfd", 1084: "exit_signalfd", 1083: "enter_epoll_create1", 1082: "exit_epoll_create1", 1081: "enter_epoll_create", 1080: "exit_epoll_create", 1079: "enter_epoll_ctl", 1078: "exit_epoll_ctl", 1077: "enter_epoll_wait", 1076: "exit_epoll_wait", 1075: "enter_epoll_pwait", 1074: "exit_epoll_pwait", 1073: "enter_epoll_pwait2", 1072: "exit_epoll_pwait2", 1071: "enter_fanotify_init", 1070: "exit_fanotify_init", 1069: "enter_fanotify_mark", 1068: "exit_fanotify_mark", 1067: "enter_inotify_init1", 1066: "exit_inotify_init1", 1065: "enter_inotify_init", 1064: "exit_inotify_init", 1063: "enter_inotify_add_watch", 1062: "exit_inotify_add_watch", 1061: "enter_inotify_rm_watch", 1060: "exit_inotify_rm_watch", 1059: "enter_file_getattr", 1058: "exit_file_getattr", 1057: "enter_file_setattr", 1056: "exit_file_setattr", 1055: "enter_fsopen", 1054: "exit_fsopen", 1053: "enter_fspick", 1052: "exit_fspick", 1051: "enter_fsconfig", 1050: "exit_fsconfig", 1049: "enter_statfs", 1048: "exit_statfs", 1047: "enter_fstatfs", 1046: "exit_fstatfs", 1045: "enter_ustat", 1044: "exit_ustat", 1043: "enter_getcwd", 1042: "exit_getcwd", 1041: "enter_utimensat", 1040: "exit_utimensat", 1039: "enter_futimesat", 1038: "exit_futimesat", 1037: "enter_utimes", 1036: "exit_utimes", 1035: "enter_utime", 1034: "exit_utime", 1033: "enter_sync", 1032: "exit_sync", 1031: "enter_syncfs", 1030: "exit_syncfs", 1029: "enter_fsync", 1028: "exit_fsync", 1027: "enter_fdatasync", 1026: "exit_fdatasync", 1025: "enter_sync_file_range", 1024: "exit_sync_file_range", 1023: "enter_vmsplice", 1022: "exit_vmsplice", 1021: "enter_splice", 1020: "exit_splice", 1019: "enter_tee", 1018: "exit_tee", 985: "enter_setxattrat", 984: "exit_setxattrat", 983: "enter_setxattr", 982: "exit_setxattr", 981: "enter_lsetxattr", 980: "exit_lsetxattr", 979: "enter_fsetxattr", 978: "exit_fsetxattr", 977: "enter_getxattrat", 976: "exit_getxattrat", 975: "enter_getxattr", 974: "exit_getxattr", 973: "enter_lgetxattr", 972: "exit_lgetxattr", 971: "enter_fgetxattr", 970: "exit_fgetxattr", 969: "enter_listxattrat", 968: "exit_listxattrat", 967: "enter_listxattr", 966: "exit_listxattr", 965: "enter_llistxattr", 964: "exit_llistxattr", 963: "enter_flistxattr", 962: "exit_flistxattr", 961: "enter_removexattrat", 960: "exit_removexattrat", 959: "enter_removexattr", 958: "exit_removexattr", 957: "enter_lremovexattr", 956: "exit_lremovexattr", 955: "enter_fremovexattr", 954: "exit_fremovexattr", 953: "enter_umount", 952: "exit_umount", 951: "enter_open_tree", 950: "exit_open_tree", 949: "enter_mount", 948: "exit_mount", 947: "enter_fsmount", 946: "exit_fsmount", 945: "enter_move_mount", 944: "exit_move_mount", 943: "enter_pivot_root", 942: "exit_pivot_root", 941: "enter_mount_setattr", 940: "exit_mount_setattr", 939: "enter_open_tree_attr", 938: "exit_open_tree_attr", 937: "enter_statmount", 936: "exit_statmount", 935: "enter_listmount", 934: "exit_listmount", 933: "enter_sysfs", 932: "exit_sysfs", 931: "enter_close_range", 930: "exit_close_range", 929: "enter_dup3", 928: "exit_dup3", 927: "enter_dup2", 926: "exit_dup2", 925: "enter_dup", 924: "exit_dup", 919: "enter_select", 918: "exit_select", 917: "enter_pselect6", 916: "exit_pselect6", 915: "enter_poll", 914: "exit_poll", 913: "enter_ppoll", 912: "exit_ppoll", 911: "enter_getdents", 910: "exit_getdents", 909: "enter_getdents64", 908: "exit_getdents64", 907: "enter_ioctl", 906: "exit_ioctl", 905: "enter_fcntl", 904: "exit_fcntl", 903: "enter_mknodat", 902: "exit_mknodat", 901: "enter_mknod", 900: "exit_mknod", 899: "enter_mkdirat", 898: "exit_mkdirat", 897: "enter_mkdir", 896: "exit_mkdir", 895: "enter_rmdir", 894: "exit_rmdir", 893: "enter_unlinkat", 892: "exit_unlinkat", 891: "enter_unlink", 890: "exit_unlink", 889: "enter_symlinkat", 888: "exit_symlinkat", 887: "enter_symlink", 886: "exit_symlink", 885: "enter_linkat", 884: "exit_linkat", 883: "enter_link", 882: "exit_link", 881: "enter_renameat2", 880: "exit_renameat2", 879: "enter_renameat", 878: "exit_renameat", 877: "enter_rename", 876: "exit_rename", 875: "enter_pipe2", 874: "exit_pipe2", 873: "enter_pipe", 872: "exit_pipe", 871: "enter_execve", 870: "exit_execve", 869: "enter_execveat", 868: "exit_execveat", 867: "enter_newstat", 866: "exit_newstat", 865: "enter_newlstat", 864: "exit_newlstat", 863: "enter_newfstatat", 862: "exit_newfstatat", 861: "enter_newfstat", 860: "exit_newfstat", 859: "enter_readlinkat", 858: "exit_readlinkat", 857: "enter_readlink", 856: "exit_readlink", 855: "enter_statx", 854: "exit_statx", 853: "enter_lseek", 852: "exit_lseek", 851: "enter_read", 850: "exit_read", 849: "enter_write", 848: "exit_write", 847: "enter_pread64", 846: "exit_pread64", 845: "enter_pwrite64", 844: "exit_pwrite64", 843: "enter_readv", 842: "exit_readv", 841: "enter_writev", 840: "exit_writev", 839: "enter_preadv", 838: "exit_preadv", 837: "enter_preadv2", 836: "exit_preadv2", 835: "enter_pwritev", 834: "exit_pwritev", 833: "enter_pwritev2", 832: "exit_pwritev2", 831: "enter_sendfile64", 830: "exit_sendfile64", 829: "enter_copy_file_range", 828: "exit_copy_file_range", 827: "enter_truncate", 826: "exit_truncate", 825: "enter_ftruncate", 824: "exit_ftruncate", 823: "enter_fallocate", 822: "exit_fallocate", 821: "enter_faccessat", 820: "exit_faccessat", 819: "enter_faccessat2", 818: "exit_faccessat2", 817: "enter_access", 816: "exit_access", 815: "enter_chdir", 814: "exit_chdir", 813: "enter_fchdir", 812: "exit_fchdir", 811: "enter_chroot", 810: "exit_chroot", 809: "enter_fchmod", 808: "exit_fchmod", 807: "enter_fchmodat2", 806: "exit_fchmodat2", 805: "enter_fchmodat", 804: "exit_fchmodat", 803: "enter_chmod", 802: "exit_chmod", 801: "enter_fchownat", 800: "exit_fchownat", 799: "enter_chown", 798: "exit_chown", 797: "enter_lchown", 796: "exit_lchown", 795: "enter_fchown", 794: "exit_fchown", 793: "enter_open", 792: "exit_open", 791: "enter_openat", 790: "exit_openat", 789: "enter_openat2", 788: "exit_openat2", 787: "enter_creat", 786: "exit_creat", 785: "enter_close", 784: "exit_close", 783: "enter_vhangup", 782: "exit_vhangup", 781: "enter_memfd_create", 780: "exit_memfd_create", 774: "enter_memfd_secret", 773: "exit_memfd_secret", 754: "enter_move_pages", 753: "exit_move_pages", 743: "enter_set_mempolicy_home_node", 742: "exit_set_mempolicy_home_node", 741: "enter_mbind", 740: "exit_mbind", 739: "enter_set_mempolicy", 738: "exit_set_mempolicy", 737: "enter_migrate_pages", 736: "exit_migrate_pages", 735: "enter_get_mempolicy", 734: "exit_get_mempolicy", 733: "enter_swapoff", 732: "exit_swapoff", 731: "enter_swapon", 730: "exit_swapon", 729: "enter_madvise", 728: "exit_madvise", 727: "enter_process_madvise", 726: "exit_process_madvise", 725: "enter_mseal", 724: "exit_mseal", 723: "enter_process_vm_readv", 722: "exit_process_vm_readv", 721: "enter_process_vm_writev", 720: "exit_process_vm_writev", 712: "enter_msync", 711: "exit_msync", 710: "enter_mremap", 709: "exit_mremap", 708: "enter_mprotect", 707: "exit_mprotect", 706: "enter_pkey_mprotect", 705: "exit_pkey_mprotect", 704: "enter_pkey_alloc", 703: "exit_pkey_alloc", 702: "enter_pkey_free", 701: "exit_pkey_free", 698: "enter_brk", 697: "exit_brk", 696: "enter_munmap", 695: "exit_munmap", 694: "enter_remap_file_pages", 693: "exit_remap_file_pages", 692: "enter_mlock", 691: "exit_mlock", 690: "enter_mlock2", 689: "exit_mlock2", 688: "enter_munlock", 687: "exit_munlock", 686: "enter_mlockall", 685: "exit_mlockall", 684: "enter_munlockall", 683: "exit_munlockall", 682: "enter_mincore", 681: "exit_mincore", 616: "enter_readahead", 615: "exit_readahead", 614: "enter_fadvise64", 613: "exit_fadvise64", 604: "enter_process_mrelease", 603: "exit_process_mrelease", 595: "enter_cachestat", 594: "exit_cachestat", 591: "enter_rseq", 590: "exit_rseq", 587: "enter_perf_event_open", 586: "exit_perf_event_open", 585: "enter_bpf", 584: "exit_bpf", 526: "enter_seccomp", 525: "exit_seccomp", 508: "enter_kexec_file_load", 507: "exit_kexec_file_load", 506: "enter_kexec_load", 505: "exit_kexec_load", 504: "enter_acct", 503: "exit_acct", 499: "enter_set_robust_list", 498: "exit_set_robust_list", 497: "enter_get_robust_list", 496: "exit_get_robust_list", 495: "enter_futex", 494: "exit_futex", 493: "enter_futex_waitv", 492: "exit_futex_waitv", 491: "enter_futex_wake", 490: "exit_futex_wake", 489: "enter_futex_wait", 488: "exit_futex_wait", 487: "enter_futex_requeue", 486: "exit_futex_requeue", 471: "enter_getitimer", 470: "exit_getitimer", 469: "enter_alarm", 468: "exit_alarm", 467: "enter_setitimer", 466: "exit_setitimer", 465: "enter_timer_create", 464: "exit_timer_create", 463: "enter_timer_gettime", 462: "exit_timer_gettime", 461: "enter_timer_getoverrun", 460: "exit_timer_getoverrun", 459: "enter_timer_settime", 458: "exit_timer_settime", 457: "enter_timer_delete", 456: "exit_timer_delete", 455: "enter_clock_settime", 454: "exit_clock_settime", 453: "enter_clock_gettime", 452: "exit_clock_gettime", 451: "enter_clock_adjtime", 450: "exit_clock_adjtime", 449: "enter_clock_getres", 448: "exit_clock_getres", 447: "enter_clock_nanosleep", 446: "exit_clock_nanosleep", 441: "enter_nanosleep", 440: "exit_nanosleep", 425: "enter_time", 424: "exit_time", 423: "enter_gettimeofday", 422: "exit_gettimeofday", 421: "enter_settimeofday", 420: "exit_settimeofday", 419: "enter_adjtimex", 418: "exit_adjtimex", 417: "enter_kcmp", 416: "exit_kcmp", 410: "enter_delete_module", 409: "exit_delete_module", 408: "enter_init_module", 407: "exit_init_module", 406: "enter_finit_module", 405: "exit_finit_module", 350: "enter_syslog", 349: "exit_syslog", 346: "enter_membarrier", 345: "exit_membarrier", 341: "enter_sched_setscheduler", 340: "exit_sched_setscheduler", 339: "enter_sched_setparam", 338: "exit_sched_setparam", 337: "enter_sched_setattr", 336: "exit_sched_setattr", 335: "enter_sched_getscheduler", 334: "exit_sched_getscheduler", 333: "enter_sched_getparam", 332: "exit_sched_getparam", 331: "enter_sched_getattr", 330: "exit_sched_getattr", 329: "enter_sched_setaffinity", 328: "exit_sched_setaffinity", 327: "enter_sched_getaffinity", 326: "exit_sched_getaffinity", 325: "enter_sched_yield", 324: "exit_sched_yield", 323: "enter_sched_get_priority_max", 322: "exit_sched_get_priority_max", 321: "enter_sched_get_priority_min", 320: "exit_sched_get_priority_min", 319: "enter_sched_rr_get_interval", 318: "exit_sched_rr_get_interval", 286: "enter_getgroups", 285: "exit_getgroups", 284: "enter_setgroups", 283: "exit_setgroups", 282: "enter_reboot", 281: "exit_reboot", 277: "enter_listns", 276: "exit_listns", 275: "enter_setns", 274: "exit_setns", 273: "enter_pidfd_open", 272: "exit_pidfd_open", 271: "enter_pidfd_getfd", 270: "exit_pidfd_getfd", 265: "enter_setpriority", 264: "exit_setpriority", 263: "enter_getpriority", 262: "exit_getpriority", 261: "enter_setregid", 260: "exit_setregid", 259: "enter_setgid", 258: "exit_setgid", 257: "enter_setreuid", 256: "exit_setreuid", 255: "enter_setuid", 254: "exit_setuid", 253: "enter_setresuid", 252: "exit_setresuid", 251: "enter_getresuid", 250: "exit_getresuid", 249: "enter_setresgid", 248: "exit_setresgid", 247: "enter_getresgid", 246: "exit_getresgid", 245: "enter_setfsuid", 244: "exit_setfsuid", 243: "enter_setfsgid", 242: "exit_setfsgid", 241: "enter_getpid", 240: "exit_getpid", 239: "enter_gettid", 238: "exit_gettid", 237: "enter_getppid", 236: "exit_getppid", 235: "enter_getuid", 234: "exit_getuid", 233: "enter_geteuid", 232: "exit_geteuid", 231: "enter_getgid", 230: "exit_getgid", 229: "enter_getegid", 228: "exit_getegid", 227: "enter_times", 226: "exit_times", 225: "enter_setpgid", 224: "exit_setpgid", 223: "enter_getpgid", 222: "exit_getpgid", 221: "enter_getpgrp", 220: "exit_getpgrp", 219: "enter_getsid", 218: "exit_getsid", 217: "enter_setsid", 216: "exit_setsid", 215: "enter_newuname", 214: "exit_newuname", 213: "enter_sethostname", 212: "exit_sethostname", 211: "enter_setdomainname", 210: "exit_setdomainname", 209: "enter_getrlimit", 208: "exit_getrlimit", 207: "enter_prlimit64", 206: "exit_prlimit64", 205: "enter_setrlimit", 204: "exit_setrlimit", 203: "enter_getrusage", 202: "exit_getrusage", 201: "enter_umask", 200: "exit_umask", 199: "enter_prctl", 198: "exit_prctl", 197: "enter_getcpu", 196: "exit_getcpu", 195: "enter_sysinfo", 194: "exit_sysinfo", 191: "enter_restart_syscall", 190: "exit_restart_syscall", 189: "enter_rt_sigprocmask", 188: "exit_rt_sigprocmask", 187: "enter_rt_sigpending", 186: "exit_rt_sigpending", 185: "enter_rt_sigtimedwait", 184: "exit_rt_sigtimedwait", 183: "enter_kill", 182: "exit_kill", 181: "enter_pidfd_send_signal", 180: "exit_pidfd_send_signal", 179: "enter_tgkill", 178: "exit_tgkill", 177: "enter_tkill", 176: "exit_tkill", 175: "enter_rt_sigqueueinfo", 174: "exit_rt_sigqueueinfo", 173: "enter_rt_tgsigqueueinfo", 172: "exit_rt_tgsigqueueinfo", 171: "enter_sigaltstack", 170: "exit_sigaltstack", 169: "enter_rt_sigaction", 168: "exit_rt_sigaction", 167: "enter_pause", 166: "exit_pause", 165: "enter_rt_sigsuspend", 164: "exit_rt_sigsuspend", 163: "enter_ptrace", 162: "exit_ptrace", 161: "enter_capget", 160: "exit_capget", 159: "enter_capset", 158: "exit_capset", 150: "enter_exit", 149: "exit_exit", 148: "enter_exit_group", 147: "exit_exit_group", 146: "enter_waitid", 145: "exit_waitid", 144: "enter_wait4", 143: "exit_wait4", 139: "enter_personality", 138: "exit_personality", 134: "enter_set_tid_address", 133: "exit_set_tid_address", 132: "enter_fork", 131: "exit_fork", 130: "enter_vfork", 129: "exit_vfork", 128: "enter_clone", 127: "exit_clone", 126: "enter_clone3", 125: "exit_clone3", 124: "enter_unshare", 123: "exit_unshare", 119: "enter_map_shadow_stack", 118: "exit_map_shadow_stack", 117: "enter_uretprobe", 116: "exit_uretprobe", 115: "enter_uprobe", 114: "exit_uprobe", 102: "enter_arch_prctl", 101: "exit_arch_prctl", 100: "enter_mmap", 99: "exit_mmap", 98: "enter_modify_ldt", 97: "exit_modify_ldt", 95: "enter_ioperm", 94: "exit_ioperm", 93: "enter_iopl", 92: "exit_iopl", 57: "enter_rt_sigreturn", 56: "exit_rt_sigreturn",
 }
@@ -19,6 +37,10 @@ var traceId2Name = map[TraceId]string{
 	1847: "socket", 1846: "socket", 1845: "socketpair", 1844: "socketpair", 1843: "bind", 1842: "bind", 1841: "listen", 1840: "listen", 1839: "accept4", 1838: "accept4", 1837: "accept", 1836: "accept", 1835: "connect", 1834: "connect", 1833: "getsockname", 1832: "getsockname", 1831: "getpeername", 1830: "getpeername", 1829: "sendto", 1828: "sendto", 1827: "recvfrom", 1826: "recvfrom", 1825: "setsockopt", 1824: "setsockopt", 1823: "getsockopt", 1822: "getsockopt", 1821: "shutdown", 1820: "shutdown", 1819: "sendmsg", 1818: "sendmsg", 1817: "sendmmsg", 1816: "sendmmsg", 1815: "recvmsg", 1814: "recvmsg", 1813: "recvmmsg", 1812: "recvmmsg", 1575: "getrandom", 1574: "getrandom", 1528: "io_uring_register", 1527: "io_uring_register", 1509: "io_uring_enter", 1508: "io_uring_enter", 1507: "io_uring_setup", 1506: "io_uring_setup", 1491: "ioprio_set", 1490: "ioprio_set", 1489: "ioprio_get", 1488: "ioprio_get", 1463: "landlock_create_ruleset", 1462: "landlock_create_ruleset", 1461: "landlock_add_rule", 1460: "landlock_add_rule", 1459: "landlock_restrict_self", 1458: "landlock_restrict_self", 1456: "lsm_set_self_attr", 1455: "lsm_set_self_attr", 1454: "lsm_get_self_attr", 1453: "lsm_get_self_attr", 1452: "lsm_list_modules", 1451: "lsm_list_modules", 1449: "add_key", 1448: "add_key", 1447: "request_key", 1446: "request_key", 1445: "keyctl", 1444: "keyctl", 1443: "mq_open", 1442: "mq_open", 1441: "mq_unlink", 1440: "mq_unlink", 1439: "mq_timedsend", 1438: "mq_timedsend", 1437: "mq_timedreceive", 1436: "mq_timedreceive", 1435: "mq_notify", 1434: "mq_notify", 1433: "mq_getsetattr", 1432: "mq_getsetattr", 1431: "shmget", 1430: "shmget", 1429: "shmctl", 1428: "shmctl", 1427: "shmat", 1426: "shmat", 1425: "shmdt", 1424: "shmdt", 1423: "semget", 1422: "semget", 1421: "semctl", 1420: "semctl", 1419: "semtimedop", 1418: "semtimedop", 1417: "semop", 1416: "semop", 1415: "msgget", 1414: "msgget", 1413: "msgctl", 1412: "msgctl", 1411: "msgsnd", 1410: "msgsnd", 1409: "msgrcv", 1408: "msgrcv", 1164: "quotactl", 1163: "quotactl", 1162: "quotactl_fd", 1161: "quotactl_fd", 1146: "name_to_handle_at", 1145: "name_to_handle_at", 1144: "open_by_handle_at", 1143: "open_by_handle_at", 1130: "flock", 1129: "flock", 1111: "io_setup", 1110: "io_setup", 1109: "io_destroy", 1108: "io_destroy", 1107: "io_submit", 1106: "io_submit", 1105: "io_cancel", 1104: "io_cancel", 1103: "io_getevents", 1102: "io_getevents", 1101: "io_pgetevents", 1100: "io_pgetevents", 1099: "userfaultfd", 1098: "userfaultfd", 1097: "eventfd2", 1096: "eventfd2", 1095: "eventfd", 1094: "eventfd", 1093: "timerfd_create", 1092: "timerfd_create", 1091: "timerfd_settime", 1090: "timerfd_settime", 1089: "timerfd_gettime", 1088: "timerfd_gettime", 1087: "signalfd4", 1086: "signalfd4", 1085: "signalfd", 1084: "signalfd", 1083: "epoll_create1", 1082: "epoll_create1", 1081: "epoll_create", 1080: "epoll_create", 1079: "epoll_ctl", 1078: "epoll_ctl", 1077: "epoll_wait", 1076: "epoll_wait", 1075: "epoll_pwait", 1074: "epoll_pwait", 1073: "epoll_pwait2", 1072: "epoll_pwait2", 1071: "fanotify_init", 1070: "fanotify_init", 1069: "fanotify_mark", 1068: "fanotify_mark", 1067: "inotify_init1", 1066: "inotify_init1", 1065: "inotify_init", 1064: "inotify_init", 1063: "inotify_add_watch", 1062: "inotify_add_watch", 1061: "inotify_rm_watch", 1060: "inotify_rm_watch", 1059: "file_getattr", 1058: "file_getattr", 1057: "file_setattr", 1056: "file_setattr", 1055: "fsopen", 1054: "fsopen", 1053: "fspick", 1052: "fspick", 1051: "fsconfig", 1050: "fsconfig", 1049: "statfs", 1048: "statfs", 1047: "fstatfs", 1046: "fstatfs", 1045: "ustat", 1044: "ustat", 1043: "getcwd", 1042: "getcwd", 1041: "utimensat", 1040: "utimensat", 1039: "futimesat", 1038: "futimesat", 1037: "utimes", 1036: "utimes", 1035: "utime", 1034: "utime", 1033: "sync", 1032: "sync", 1031: "syncfs", 1030: "syncfs", 1029: "fsync", 1028: "fsync", 1027: "fdatasync", 1026: "fdatasync", 1025: "sync_file_range", 1024: "sync_file_range", 1023: "vmsplice", 1022: "vmsplice", 1021: "splice", 1020: "splice", 1019: "tee", 1018: "tee", 985: "setxattrat", 984: "setxattrat", 983: "setxattr", 982: "setxattr", 981: "lsetxattr", 980: "lsetxattr", 979: "fsetxattr", 978: "fsetxattr", 977: "getxattrat", 976: "getxattrat", 975: "getxattr", 974: "getxattr", 973: "lgetxattr", 972: "lgetxattr", 971: "fgetxattr", 970: "fgetxattr", 969: "listxattrat", 968: "listxattrat", 967: "listxattr", 966: "listxattr", 965: "llistxattr", 964: "llistxattr", 963: "flistxattr", 962: "flistxattr", 961: "removexattrat", 960: "removexattrat", 959: "removexattr", 958: "removexattr", 957: "lremovexattr", 956: "lremovexattr", 955: "fremovexattr", 954: "fremovexattr", 953: "umount", 952: "umount", 951: "open_tree", 950: "open_tree", 949: "mount", 948: "mount", 947: "fsmount", 946: "fsmount", 945: "move_mount", 944: "move_mount", 943: "pivot_root", 942: "pivot_root", 941: "mount_setattr", 940: "mount_setattr", 939: "open_tree_attr", 938: "open_tree_attr", 937: "statmount", 936: "statmount", 935: "listmount", 934: "listmount", 933: "sysfs", 932: "sysfs", 931: "close_range", 930: "close_range", 929: "dup3", 928: "dup3", 927: "dup2", 926: "dup2", 925: "dup", 924: "dup", 919: "select", 918: "select", 917: "pselect6", 916: "pselect6", 915: "poll", 914: "poll", 913: "ppoll", 912: "ppoll", 911: "getdents", 910: "getdents", 909: "getdents64", 908: "getdents64", 907: "ioctl", 906: "ioctl", 905: "fcntl", 904: "fcntl", 903: "mknodat", 902: "mknodat", 901: "mknod", 900: "mknod", 899: "mkdirat", 898: "mkdirat", 897: "mkdir", 896: "mkdir", 895: "rmdir", 894: "rmdir", 893: "unlinkat", 892: "unlinkat", 891: "unlink", 890: "unlink", 889: "symlinkat", 888: "symlinkat", 887: "symlink", 886: "symlink", 885: "linkat", 884: "linkat", 883: "link", 882: "link", 881: "renameat2", 880: "renameat2", 879: "renameat", 878: "renameat", 877: "rename", 876: "rename", 875: "pipe2", 874: "pipe2", 873: "pipe", 872: "pipe", 871: "execve", 870: "execve", 869: "execveat", 868: "execveat", 867: "newstat", 866: "newstat", 865: "newlstat", 864: "newlstat", 863: "newfstatat", 862: "newfstatat", 861: "newfstat", 860: "newfstat", 859: "readlinkat", 858: "readlinkat", 857: "readlink", 856: "readlink", 855: "statx", 854: "statx", 853: "lseek", 852: "lseek", 851: "read", 850: "read", 849: "write", 848: "write", 847: "pread64", 846: "pread64", 845: "pwrite64", 844: "pwrite64", 843: "readv", 842: "readv", 841: "writev", 840: "writev", 839: "preadv", 838: "preadv", 837: "preadv2", 836: "preadv2", 835: "pwritev", 834: "pwritev", 833: "pwritev2", 832: "pwritev2", 831: "sendfile64", 830: "sendfile64", 829: "copy_file_range", 828: "copy_file_range", 827: "truncate", 826: "truncate", 825: "ftruncate", 824: "ftruncate", 823: "fallocate", 822: "fallocate", 821: "faccessat", 820: "faccessat", 819: "faccessat2", 818: "faccessat2", 817: "access", 816: "access", 815: "chdir", 814: "chdir", 813: "fchdir", 812: "fchdir", 811: "chroot", 810: "chroot", 809: "fchmod", 808: "fchmod", 807: "fchmodat2", 806: "fchmodat2", 805: "fchmodat", 804: "fchmodat", 803: "chmod", 802: "chmod", 801: "fchownat", 800: "fchownat", 799: "chown", 798: "chown", 797: "lchown", 796: "lchown", 795: "fchown", 794: "fchown", 793: "open", 792: "open", 791: "openat", 790: "openat", 789: "openat2", 788: "openat2", 787: "creat", 786: "creat", 785: "close", 784: "close", 783: "vhangup", 782: "vhangup", 781: "memfd_create", 780: "memfd_create", 774: "memfd_secret", 773: "memfd_secret", 754: "move_pages", 753: "move_pages", 743: "set_mempolicy_home_node", 742: "set_mempolicy_home_node", 741: "mbind", 740: "mbind", 739: "set_mempolicy", 738: "set_mempolicy", 737: "migrate_pages", 736: "migrate_pages", 735: "get_mempolicy", 734: "get_mempolicy", 733: "swapoff", 732: "swapoff", 731: "swapon", 730: "swapon", 729: "madvise", 728: "madvise", 727: "process_madvise", 726: "process_madvise", 725: "mseal", 724: "mseal", 723: "process_vm_readv", 722: "process_vm_readv", 721: "process_vm_writev", 720: "process_vm_writev", 712: "msync", 711: "msync", 710: "mremap", 709: "mremap", 708: "mprotect", 707: "mprotect", 706: "pkey_mprotect", 705: "pkey_mprotect", 704: "pkey_alloc", 703: "pkey_alloc", 702: "pkey_free", 701: "pkey_free", 698: "brk", 697: "brk", 696: "munmap", 695: "munmap", 694: "remap_file_pages", 693: "remap_file_pages", 692: "mlock", 691: "mlock", 690: "mlock2", 689: "mlock2", 688: "munlock", 687: "munlock", 686: "mlockall", 685: "mlockall", 684: "munlockall", 683: "munlockall", 682: "mincore", 681: "mincore", 616: "readahead", 615: "readahead", 614: "fadvise64", 613: "fadvise64", 604: "process_mrelease", 603: "process_mrelease", 595: "cachestat", 594: "cachestat", 591: "rseq", 590: "rseq", 587: "perf_event_open", 586: "perf_event_open", 585: "bpf", 584: "bpf", 526: "seccomp", 525: "seccomp", 508: "kexec_file_load", 507: "kexec_file_load", 506: "kexec_load", 505: "kexec_load", 504: "acct", 503: "acct", 499: "set_robust_list", 498: "set_robust_list", 497: "get_robust_list", 496: "get_robust_list", 495: "futex", 494: "futex", 493: "futex_waitv", 492: "futex_waitv", 491: "futex_wake", 490: "futex_wake", 489: "futex_wait", 488: "futex_wait", 487: "futex_requeue", 486: "futex_requeue", 471: "getitimer", 470: "getitimer", 469: "alarm", 468: "alarm", 467: "setitimer", 466: "setitimer", 465: "timer_create", 464: "timer_create", 463: "timer_gettime", 462: "timer_gettime", 461: "timer_getoverrun", 460: "timer_getoverrun", 459: "timer_settime", 458: "timer_settime", 457: "timer_delete", 456: "timer_delete", 455: "clock_settime", 454: "clock_settime", 453: "clock_gettime", 452: "clock_gettime", 451: "clock_adjtime", 450: "clock_adjtime", 449: "clock_getres", 448: "clock_getres", 447: "clock_nanosleep", 446: "clock_nanosleep", 441: "nanosleep", 440: "nanosleep", 425: "time", 424: "time", 423: "gettimeofday", 422: "gettimeofday", 421: "settimeofday", 420: "settimeofday", 419: "adjtimex", 418: "adjtimex", 417: "kcmp", 416: "kcmp", 410: "delete_module", 409: "delete_module", 408: "init_module", 407: "init_module", 406: "finit_module", 405: "finit_module", 350: "syslog", 349: "syslog", 346: "membarrier", 345: "membarrier", 341: "sched_setscheduler", 340: "sched_setscheduler", 339: "sched_setparam", 338: "sched_setparam", 337: "sched_setattr", 336: "sched_setattr", 335: "sched_getscheduler", 334: "sched_getscheduler", 333: "sched_getparam", 332: "sched_getparam", 331: "sched_getattr", 330: "sched_getattr", 329: "sched_setaffinity", 328: "sched_setaffinity", 327: "sched_getaffinity", 326: "sched_getaffinity", 325: "sched_yield", 324: "sched_yield", 323: "sched_get_priority_max", 322: "sched_get_priority_max", 321: "sched_get_priority_min", 320: "sched_get_priority_min", 319: "sched_rr_get_interval", 318: "sched_rr_get_interval", 286: "getgroups", 285: "getgroups", 284: "setgroups", 283: "setgroups", 282: "reboot", 281: "reboot", 277: "listns", 276: "listns", 275: "setns", 274: "setns", 273: "pidfd_open", 272: "pidfd_open", 271: "pidfd_getfd", 270: "pidfd_getfd", 265: "setpriority", 264: "setpriority", 263: "getpriority", 262: "getpriority", 261: "setregid", 260: "setregid", 259: "setgid", 258: "setgid", 257: "setreuid", 256: "setreuid", 255: "setuid", 254: "setuid", 253: "setresuid", 252: "setresuid", 251: "getresuid", 250: "getresuid", 249: "setresgid", 248: "setresgid", 247: "getresgid", 246: "getresgid", 245: "setfsuid", 244: "setfsuid", 243: "setfsgid", 242: "setfsgid", 241: "getpid", 240: "getpid", 239: "gettid", 238: "gettid", 237: "getppid", 236: "getppid", 235: "getuid", 234: "getuid", 233: "geteuid", 232: "geteuid", 231: "getgid", 230: "getgid", 229: "getegid", 228: "getegid", 227: "times", 226: "times", 225: "setpgid", 224: "setpgid", 223: "getpgid", 222: "getpgid", 221: "getpgrp", 220: "getpgrp", 219: "getsid", 218: "getsid", 217: "setsid", 216: "setsid", 215: "newuname", 214: "newuname", 213: "sethostname", 212: "sethostname", 211: "setdomainname", 210: "setdomainname", 209: "getrlimit", 208: "getrlimit", 207: "prlimit64", 206: "prlimit64", 205: "setrlimit", 204: "setrlimit", 203: "getrusage", 202: "getrusage", 201: "umask", 200: "umask", 199: "prctl", 198: "prctl", 197: "getcpu", 196: "getcpu", 195: "sysinfo", 194: "sysinfo", 191: "restart_syscall", 190: "restart_syscall", 189: "rt_sigprocmask", 188: "rt_sigprocmask", 187: "rt_sigpending", 186: "rt_sigpending", 185: "rt_sigtimedwait", 184: "rt_sigtimedwait", 183: "kill", 182: "kill", 181: "pidfd_send_signal", 180: "pidfd_send_signal", 179: "tgkill", 178: "tgkill", 177: "tkill", 176: "tkill", 175: "rt_sigqueueinfo", 174: "rt_sigqueueinfo", 173: "rt_tgsigqueueinfo", 172: "rt_tgsigqueueinfo", 171: "sigaltstack", 170: "sigaltstack", 169: "rt_sigaction", 168: "rt_sigaction", 167: "pause", 166: "pause", 165: "rt_sigsuspend", 164: "rt_sigsuspend", 163: "ptrace", 162: "ptrace", 161: "capget", 160: "capget", 159: "capset", 158: "capset", 150: "exit", 149: "exit", 148: "exit_group", 147: "exit_group", 146: "waitid", 145: "waitid", 144: "wait4", 143: "wait4", 139: "personality", 138: "personality", 134: "set_tid_address", 133: "set_tid_address", 132: "fork", 131: "fork", 130: "vfork", 129: "vfork", 128: "clone", 127: "clone", 126: "clone3", 125: "clone3", 124: "unshare", 123: "unshare", 119: "map_shadow_stack", 118: "map_shadow_stack", 117: "uretprobe", 116: "uretprobe", 115: "uprobe", 114: "uprobe", 102: "arch_prctl", 101: "arch_prctl", 100: "mmap", 99: "mmap", 98: "modify_ldt", 97: "modify_ldt", 95: "ioperm", 94: "ioperm", 93: "iopl", 92: "iopl", 57: "rt_sigreturn", 56: "rt_sigreturn",
 }
 
+var traceId2Family = map[TraceId]SyscallFamily{
+	1847: FamilyNetwork, 1846: FamilyNetwork, 1845: FamilyNetwork, 1844: FamilyNetwork, 1843: FamilyNetwork, 1842: FamilyNetwork, 1841: FamilyNetwork, 1840: FamilyNetwork, 1839: FamilyNetwork, 1838: FamilyNetwork, 1837: FamilyNetwork, 1836: FamilyNetwork, 1835: FamilyNetwork, 1834: FamilyNetwork, 1833: FamilyNetwork, 1832: FamilyNetwork, 1831: FamilyNetwork, 1830: FamilyNetwork, 1829: FamilyNetwork, 1828: FamilyNetwork, 1827: FamilyNetwork, 1826: FamilyNetwork, 1825: FamilyNetwork, 1824: FamilyNetwork, 1823: FamilyNetwork, 1822: FamilyNetwork, 1821: FamilyNetwork, 1820: FamilyNetwork, 1819: FamilyNetwork, 1818: FamilyNetwork, 1817: FamilyNetwork, 1816: FamilyNetwork, 1815: FamilyNetwork, 1814: FamilyNetwork, 1813: FamilyNetwork, 1812: FamilyNetwork, 1575: FamilySecurity, 1574: FamilySecurity, 1528: FamilyAIO, 1527: FamilyAIO, 1509: FamilyAIO, 1508: FamilyAIO, 1507: FamilyAIO, 1506: FamilyAIO, 1491: FamilyMisc, 1490: FamilyMisc, 1489: FamilyMisc, 1488: FamilyMisc, 1463: FamilySecurity, 1462: FamilySecurity, 1461: FamilySecurity, 1460: FamilySecurity, 1459: FamilySecurity, 1458: FamilySecurity, 1456: FamilyMisc, 1455: FamilyMisc, 1454: FamilyMisc, 1453: FamilyMisc, 1452: FamilyMisc, 1451: FamilyMisc, 1449: FamilySecurity, 1448: FamilySecurity, 1447: FamilySecurity, 1446: FamilySecurity, 1445: FamilySecurity, 1444: FamilySecurity, 1443: FamilyIPC, 1442: FamilyIPC, 1441: FamilyIPC, 1440: FamilyIPC, 1439: FamilyIPC, 1438: FamilyIPC, 1437: FamilyIPC, 1436: FamilyIPC, 1435: FamilyIPC, 1434: FamilyIPC, 1433: FamilyIPC, 1432: FamilyIPC, 1431: FamilyIPC, 1430: FamilyIPC, 1429: FamilyIPC, 1428: FamilyIPC, 1427: FamilyIPC, 1426: FamilyIPC, 1425: FamilyIPC, 1424: FamilyIPC, 1423: FamilyIPC, 1422: FamilyIPC, 1421: FamilyIPC, 1420: FamilyIPC, 1419: FamilyIPC, 1418: FamilyIPC, 1417: FamilyIPC, 1416: FamilyIPC, 1415: FamilyIPC, 1414: FamilyIPC, 1413: FamilyIPC, 1412: FamilyIPC, 1411: FamilyIPC, 1410: FamilyIPC, 1409: FamilyIPC, 1408: FamilyIPC, 1164: FamilyFS, 1163: FamilyFS, 1162: FamilyFS, 1161: FamilyFS, 1146: FamilyFS, 1145: FamilyFS, 1144: FamilyFS, 1143: FamilyFS, 1130: FamilyFS, 1129: FamilyFS, 1111: FamilyAIO, 1110: FamilyAIO, 1109: FamilyAIO, 1108: FamilyAIO, 1107: FamilyAIO, 1106: FamilyAIO, 1105: FamilyAIO, 1104: FamilyAIO, 1103: FamilyAIO, 1102: FamilyAIO, 1101: FamilyAIO, 1100: FamilyAIO, 1099: FamilyIPC, 1098: FamilyIPC, 1097: FamilyIPC, 1096: FamilyIPC, 1095: FamilyIPC, 1094: FamilyIPC, 1093: FamilyIPC, 1092: FamilyIPC, 1091: FamilyIPC, 1090: FamilyIPC, 1089: FamilyIPC, 1088: FamilyIPC, 1087: FamilyIPC, 1086: FamilyIPC, 1085: FamilyIPC, 1084: FamilyIPC, 1083: FamilyPolling, 1082: FamilyPolling, 1081: FamilyPolling, 1080: FamilyPolling, 1079: FamilyPolling, 1078: FamilyPolling, 1077: FamilyPolling, 1076: FamilyPolling, 1075: FamilyPolling, 1074: FamilyPolling, 1073: FamilyPolling, 1072: FamilyPolling, 1071: FamilyMisc, 1070: FamilyMisc, 1069: FamilyMisc, 1068: FamilyMisc, 1067: FamilyIPC, 1066: FamilyIPC, 1065: FamilyIPC, 1064: FamilyIPC, 1063: FamilyIPC, 1062: FamilyIPC, 1061: FamilyIPC, 1060: FamilyIPC, 1059: FamilyMisc, 1058: FamilyMisc, 1057: FamilyMisc, 1056: FamilyMisc, 1055: FamilyFS, 1054: FamilyFS, 1053: FamilyFS, 1052: FamilyFS, 1051: FamilyFS, 1050: FamilyFS, 1049: FamilyFS, 1048: FamilyFS, 1047: FamilyFS, 1046: FamilyFS, 1045: FamilyFS, 1044: FamilyFS, 1043: FamilyFS, 1042: FamilyFS, 1041: FamilyFS, 1040: FamilyFS, 1039: FamilyFS, 1038: FamilyFS, 1037: FamilyMisc, 1036: FamilyMisc, 1035: FamilyMisc, 1034: FamilyMisc, 1033: FamilyFS, 1032: FamilyFS, 1031: FamilyFS, 1030: FamilyFS, 1029: FamilyFS, 1028: FamilyFS, 1027: FamilyFS, 1026: FamilyFS, 1025: FamilyFS, 1024: FamilyFS, 1023: FamilyMisc, 1022: FamilyMisc, 1021: FamilyNetwork, 1020: FamilyNetwork, 1019: FamilyNetwork, 1018: FamilyNetwork, 985: FamilyFS, 984: FamilyFS, 983: FamilyFS, 982: FamilyFS, 981: FamilyFS, 980: FamilyFS, 979: FamilyFS, 978: FamilyFS, 977: FamilyFS, 976: FamilyFS, 975: FamilyFS, 974: FamilyFS, 973: FamilyFS, 972: FamilyFS, 971: FamilyFS, 970: FamilyFS, 969: FamilyFS, 968: FamilyFS, 967: FamilyFS, 966: FamilyFS, 965: FamilyFS, 964: FamilyFS, 963: FamilyFS, 962: FamilyFS, 961: FamilyFS, 960: FamilyFS, 959: FamilyFS, 958: FamilyFS, 957: FamilyFS, 956: FamilyFS, 955: FamilyFS, 954: FamilyFS, 953: FamilyMisc, 952: FamilyMisc, 951: FamilyFS, 950: FamilyFS, 949: FamilyFS, 948: FamilyFS, 947: FamilyFS, 946: FamilyFS, 945: FamilyFS, 944: FamilyFS, 943: FamilyProcess, 942: FamilyProcess, 941: FamilyFS, 940: FamilyFS, 939: FamilyFS, 938: FamilyFS, 937: FamilyFS, 936: FamilyFS, 935: FamilyMisc, 934: FamilyMisc, 933: FamilyMisc, 932: FamilyMisc, 931: FamilyFS, 930: FamilyFS, 929: FamilyFS, 928: FamilyFS, 927: FamilyFS, 926: FamilyFS, 925: FamilyFS, 924: FamilyFS, 919: FamilyPolling, 918: FamilyPolling, 917: FamilyPolling, 916: FamilyPolling, 915: FamilyPolling, 914: FamilyPolling, 913: FamilyPolling, 912: FamilyPolling, 911: FamilyFS, 910: FamilyFS, 909: FamilyFS, 908: FamilyFS, 907: FamilyFS, 906: FamilyFS, 905: FamilyFS, 904: FamilyFS, 903: FamilyFS, 902: FamilyFS, 901: FamilyFS, 900: FamilyFS, 899: FamilyFS, 898: FamilyFS, 897: FamilyFS, 896: FamilyFS, 895: FamilyFS, 894: FamilyFS, 893: FamilyFS, 892: FamilyFS, 891: FamilyFS, 890: FamilyFS, 889: FamilyFS, 888: FamilyFS, 887: FamilyFS, 886: FamilyFS, 885: FamilyFS, 884: FamilyFS, 883: FamilyFS, 882: FamilyFS, 881: FamilyFS, 880: FamilyFS, 879: FamilyFS, 878: FamilyFS, 877: FamilyFS, 876: FamilyFS, 875: FamilyIPC, 874: FamilyIPC, 873: FamilyIPC, 872: FamilyIPC, 871: FamilyProcess, 870: FamilyProcess, 869: FamilyProcess, 868: FamilyProcess, 867: FamilyFS, 866: FamilyFS, 865: FamilyFS, 864: FamilyFS, 863: FamilyFS, 862: FamilyFS, 861: FamilyFS, 860: FamilyFS, 859: FamilyFS, 858: FamilyFS, 857: FamilyFS, 856: FamilyFS, 855: FamilyFS, 854: FamilyFS, 853: FamilyFS, 852: FamilyFS, 851: FamilyFS, 850: FamilyFS, 849: FamilyFS, 848: FamilyFS, 847: FamilyFS, 846: FamilyFS, 845: FamilyFS, 844: FamilyFS, 843: FamilyFS, 842: FamilyFS, 841: FamilyFS, 840: FamilyFS, 839: FamilyFS, 838: FamilyFS, 837: FamilyFS, 836: FamilyFS, 835: FamilyFS, 834: FamilyFS, 833: FamilyFS, 832: FamilyFS, 831: FamilyNetwork, 830: FamilyNetwork, 829: FamilyFS, 828: FamilyFS, 827: FamilyFS, 826: FamilyFS, 825: FamilyFS, 824: FamilyFS, 823: FamilyFS, 822: FamilyFS, 821: FamilyFS, 820: FamilyFS, 819: FamilyFS, 818: FamilyFS, 817: FamilyFS, 816: FamilyFS, 815: FamilyFS, 814: FamilyFS, 813: FamilyFS, 812: FamilyFS, 811: FamilyFS, 810: FamilyFS, 809: FamilyFS, 808: FamilyFS, 807: FamilyFS, 806: FamilyFS, 805: FamilyFS, 804: FamilyFS, 803: FamilyFS, 802: FamilyFS, 801: FamilyFS, 800: FamilyFS, 799: FamilyFS, 798: FamilyFS, 797: FamilyFS, 796: FamilyFS, 795: FamilyFS, 794: FamilyFS, 793: FamilyFS, 792: FamilyFS, 791: FamilyFS, 790: FamilyFS, 789: FamilyFS, 788: FamilyFS, 787: FamilyFS, 786: FamilyFS, 785: FamilyFS, 784: FamilyFS, 783: FamilyProcess, 782: FamilyProcess, 781: FamilyIPC, 780: FamilyIPC, 774: FamilyIPC, 773: FamilyIPC, 754: FamilyMemory, 753: FamilyMemory, 743: FamilyMemory, 742: FamilyMemory, 741: FamilyMemory, 740: FamilyMemory, 739: FamilyMemory, 738: FamilyMemory, 737: FamilyMemory, 736: FamilyMemory, 735: FamilySecurity, 734: FamilySecurity, 733: FamilyMisc, 732: FamilyMisc, 731: FamilyMisc, 730: FamilyMisc, 729: FamilyMemory, 728: FamilyMemory, 727: FamilyMemory, 726: FamilyMemory, 725: FamilyMemory, 724: FamilyMemory, 723: FamilyMemory, 722: FamilyMemory, 721: FamilyMemory, 720: FamilyMemory, 712: FamilyFS, 711: FamilyFS, 710: FamilyMemory, 709: FamilyMemory, 708: FamilyMemory, 707: FamilyMemory, 706: FamilyMemory, 705: FamilyMemory, 704: FamilyMemory, 703: FamilyMemory, 702: FamilyMemory, 701: FamilyMemory, 698: FamilyMemory, 697: FamilyMemory, 696: FamilyMemory, 695: FamilyMemory, 694: FamilyMemory, 693: FamilyMemory, 692: FamilyMemory, 691: FamilyMemory, 690: FamilyMemory, 689: FamilyMemory, 688: FamilyMemory, 687: FamilyMemory, 686: FamilyMemory, 685: FamilyMemory, 684: FamilyMemory, 683: FamilyMemory, 682: FamilyMemory, 681: FamilyMemory, 616: FamilyFS, 615: FamilyFS, 614: FamilyFS, 613: FamilyFS, 604: FamilyMemory, 603: FamilyMemory, 595: FamilyFS, 594: FamilyFS, 591: FamilyMisc, 590: FamilyMisc, 587: FamilySecurity, 586: FamilySecurity, 585: FamilySecurity, 584: FamilySecurity, 526: FamilySecurity, 525: FamilySecurity, 508: FamilySecurity, 507: FamilySecurity, 506: FamilyMisc, 505: FamilyMisc, 504: FamilyMisc, 503: FamilyMisc, 499: FamilyMisc, 498: FamilyMisc, 497: FamilyMisc, 496: FamilyMisc, 495: FamilyMisc, 494: FamilyMisc, 493: FamilyMisc, 492: FamilyMisc, 491: FamilyMisc, 490: FamilyMisc, 489: FamilyMisc, 488: FamilyMisc, 487: FamilyMisc, 486: FamilyMisc, 471: FamilyTime, 470: FamilyTime, 469: FamilyMisc, 468: FamilyMisc, 467: FamilyTime, 466: FamilyTime, 465: FamilyTime, 464: FamilyTime, 463: FamilyTime, 462: FamilyTime, 461: FamilyTime, 460: FamilyTime, 459: FamilyTime, 458: FamilyTime, 457: FamilyTime, 456: FamilyTime, 455: FamilyTime, 454: FamilyTime, 453: FamilyTime, 452: FamilyTime, 451: FamilyTime, 450: FamilyTime, 449: FamilyTime, 448: FamilyTime, 447: FamilyTime, 446: FamilyTime, 441: FamilyTime, 440: FamilyTime, 425: FamilyTime, 424: FamilyTime, 423: FamilyTime, 422: FamilyTime, 421: FamilyTime, 420: FamilyTime, 419: FamilyMisc, 418: FamilyMisc, 417: FamilyProcess, 416: FamilyProcess, 410: FamilySecurity, 409: FamilySecurity, 408: FamilySecurity, 407: FamilySecurity, 406: FamilySecurity, 405: FamilySecurity, 350: FamilyMisc, 349: FamilyMisc, 346: FamilyMemory, 345: FamilyMemory, 341: FamilySched, 340: FamilySched, 339: FamilySched, 338: FamilySched, 337: FamilySched, 336: FamilySched, 335: FamilySched, 334: FamilySched, 333: FamilySched, 332: FamilySched, 331: FamilySched, 330: FamilySched, 329: FamilySched, 328: FamilySched, 327: FamilySched, 326: FamilySched, 325: FamilySched, 324: FamilySched, 323: FamilySched, 322: FamilySched, 321: FamilySched, 320: FamilySched, 319: FamilySched, 318: FamilySched, 286: FamilyProcess, 285: FamilyProcess, 284: FamilyProcess, 283: FamilyProcess, 282: FamilyProcess, 281: FamilyProcess, 277: FamilyMisc, 276: FamilyMisc, 275: FamilyProcess, 274: FamilyProcess, 273: FamilyIPC, 272: FamilyIPC, 271: FamilyIPC, 270: FamilyIPC, 265: FamilyProcess, 264: FamilyProcess, 263: FamilyProcess, 262: FamilyProcess, 261: FamilyProcess, 260: FamilyProcess, 259: FamilyProcess, 258: FamilyProcess, 257: FamilyProcess, 256: FamilyProcess, 255: FamilyProcess, 254: FamilyProcess, 253: FamilyProcess, 252: FamilyProcess, 251: FamilyProcess, 250: FamilyProcess, 249: FamilyProcess, 248: FamilyProcess, 247: FamilyProcess, 246: FamilyProcess, 245: FamilyProcess, 244: FamilyProcess, 243: FamilyProcess, 242: FamilyProcess, 241: FamilyProcess, 240: FamilyProcess, 239: FamilyProcess, 238: FamilyProcess, 237: FamilyProcess, 236: FamilyProcess, 235: FamilyProcess, 234: FamilyProcess, 233: FamilyProcess, 232: FamilyProcess, 231: FamilyProcess, 230: FamilyProcess, 229: FamilyProcess, 228: FamilyProcess, 227: FamilyTime, 226: FamilyTime, 225: FamilyProcess, 224: FamilyProcess, 223: FamilyProcess, 222: FamilyProcess, 221: FamilyProcess, 220: FamilyProcess, 219: FamilyProcess, 218: FamilyProcess, 217: FamilyProcess, 216: FamilyProcess, 215: FamilyMisc, 214: FamilyMisc, 213: FamilyMisc, 212: FamilyMisc, 211: FamilyMisc, 210: FamilyMisc, 209: FamilyProcess, 208: FamilyProcess, 207: FamilyProcess, 206: FamilyProcess, 205: FamilyProcess, 204: FamilyProcess, 203: FamilyProcess, 202: FamilyProcess, 201: FamilyProcess, 200: FamilyProcess, 199: FamilyProcess, 198: FamilyProcess, 197: FamilyMisc, 196: FamilyMisc, 195: FamilyMisc, 194: FamilyMisc, 191: FamilyProcess, 190: FamilyProcess, 189: FamilySignals, 188: FamilySignals, 187: FamilySignals, 186: FamilySignals, 185: FamilySignals, 184: FamilySignals, 183: FamilySignals, 182: FamilySignals, 181: FamilyIPC, 180: FamilyIPC, 179: FamilySignals, 178: FamilySignals, 177: FamilySignals, 176: FamilySignals, 175: FamilySignals, 174: FamilySignals, 173: FamilySignals, 172: FamilySignals, 171: FamilySignals, 170: FamilySignals, 169: FamilySignals, 168: FamilySignals, 167: FamilySignals, 166: FamilySignals, 165: FamilySignals, 164: FamilySignals, 163: FamilySecurity, 162: FamilySecurity, 161: FamilySecurity, 160: FamilySecurity, 159: FamilySecurity, 158: FamilySecurity, 150: FamilyProcess, 149: FamilyProcess, 148: FamilyProcess, 147: FamilyProcess, 146: FamilyProcess, 145: FamilyProcess, 144: FamilyProcess, 143: FamilyProcess, 139: FamilyProcess, 138: FamilyProcess, 134: FamilyProcess, 133: FamilyProcess, 132: FamilyProcess, 131: FamilyProcess, 130: FamilyProcess, 129: FamilyProcess, 128: FamilyProcess, 127: FamilyProcess, 126: FamilyProcess, 125: FamilyProcess, 124: FamilyProcess, 123: FamilyProcess, 119: FamilyMemory, 118: FamilyMemory, 117: FamilyMisc, 116: FamilyMisc, 115: FamilyMisc, 114: FamilyMisc, 102: FamilyProcess, 101: FamilyProcess, 100: FamilyMemory, 99: FamilyMemory, 98: FamilyMisc, 97: FamilyMisc, 95: FamilyMisc, 94: FamilyMisc, 93: FamilyMisc, 92: FamilyMisc, 57: FamilySignals, 56: FamilySignals,
+}
+
 func (s TraceId) String() string {
 	str, ok := traceId2String[s]
 	if !ok {
@@ -35,6 +57,15 @@ func (s TraceId) Name() string {
 	return str
 }
 
+// Family returns the broad syscall family for this tracepoint.
+func (s TraceId) Family() SyscallFamily {
+	family, ok := traceId2Family[s]
+	if !ok {
+		return FamilyMisc
+	}
+	return family
+}
+
 const MAX_FILENAME_LENGTH = 256
 const MAX_PROGNAME_LENGTH = 16
 const ENTER_OPEN_EVENT = 1