summaryrefslogtreecommitdiff
path: root/internal/c/generated
diff options
context:
space:
mode:
Diffstat (limited to 'internal/c/generated')
-rw-r--r--internal/c/generated/tracepoints.c296
-rw-r--r--internal/c/generated/tracepoints.raku2
2 files changed, 149 insertions, 149 deletions
diff --git a/internal/c/generated/tracepoints.c b/internal/c/generated/tracepoints.c
index e1cb7d6..0e810e7 100644
--- a/internal/c/generated/tracepoints.c
+++ b/internal/c/generated/tracepoints.c
@@ -163,7 +163,7 @@ int handle_sys_enter_io_uring_enter(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_IO_URING_ENTER;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->fd = (__s32)ctx->args[0];
bpf_ringbuf_submit(ev, 0);
@@ -184,7 +184,7 @@ int handle_sys_exit_io_uring_enter(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_IO_URING_ENTER;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -205,7 +205,7 @@ int handle_sys_enter_io_uring_register(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_IO_URING_REGISTER;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->fd = (__s32)ctx->args[0];
bpf_ringbuf_submit(ev, 0);
@@ -226,7 +226,7 @@ int handle_sys_exit_io_uring_register(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_IO_URING_REGISTER;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -247,7 +247,7 @@ int handle_sys_enter_quotactl_fd(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_QUOTACTL_FD;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->fd = (__s32)ctx->args[0];
bpf_ringbuf_submit(ev, 0);
@@ -268,7 +268,7 @@ int handle_sys_exit_quotactl_fd(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_QUOTACTL_FD;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -289,7 +289,7 @@ int handle_sys_enter_flock(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_FLOCK;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->fd = (__s32)ctx->args[0];
bpf_ringbuf_submit(ev, 0);
@@ -310,7 +310,7 @@ int handle_sys_exit_flock(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_FLOCK;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -331,7 +331,7 @@ int handle_sys_enter_fanotify_mark(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_FANOTIFY_MARK;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[4]);
@@ -353,7 +353,7 @@ int handle_sys_exit_fanotify_mark(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_FANOTIFY_MARK;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -374,7 +374,7 @@ int handle_sys_enter_inotify_add_watch(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_INOTIFY_ADD_WATCH;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[1]);
@@ -396,7 +396,7 @@ int handle_sys_exit_inotify_add_watch(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_INOTIFY_ADD_WATCH;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -417,7 +417,7 @@ int handle_sys_enter_statfs(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_STATFS;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);
@@ -439,7 +439,7 @@ int handle_sys_exit_statfs(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_STATFS;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -460,7 +460,7 @@ int handle_sys_enter_fstatfs(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_FSTATFS;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->fd = (__s32)ctx->args[0];
bpf_ringbuf_submit(ev, 0);
@@ -481,7 +481,7 @@ int handle_sys_exit_fstatfs(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_FSTATFS;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -502,7 +502,7 @@ int handle_sys_enter_utimensat(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_UTIMENSAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->filename), 0, sizeof(ev->filename) + sizeof(ev->comm));
bpf_probe_read_user_str(ev->filename, sizeof(ev->filename), (void *)ctx->args[1]);
bpf_get_current_comm(&ev->comm, sizeof(ev->comm));
@@ -525,7 +525,7 @@ int handle_sys_exit_utimensat(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_UTIMENSAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -546,7 +546,7 @@ int handle_sys_enter_futimesat(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_FUTIMESAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->filename), 0, sizeof(ev->filename) + sizeof(ev->comm));
bpf_probe_read_user_str(ev->filename, sizeof(ev->filename), (void *)ctx->args[1]);
bpf_get_current_comm(&ev->comm, sizeof(ev->comm));
@@ -569,7 +569,7 @@ int handle_sys_exit_futimesat(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_FUTIMESAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -590,7 +590,7 @@ int handle_sys_enter_fsync(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_FSYNC;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->fd = (__s32)ctx->args[0];
bpf_ringbuf_submit(ev, 0);
@@ -611,7 +611,7 @@ int handle_sys_exit_fsync(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_FSYNC;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -632,7 +632,7 @@ int handle_sys_enter_fdatasync(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_FDATASYNC;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->fd = (__s32)ctx->args[0];
bpf_ringbuf_submit(ev, 0);
@@ -653,7 +653,7 @@ int handle_sys_exit_fdatasync(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_FDATASYNC;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -674,7 +674,7 @@ int handle_sys_enter_setxattr(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_SETXATTR;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);
@@ -696,7 +696,7 @@ int handle_sys_exit_setxattr(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_SETXATTR;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -717,7 +717,7 @@ int handle_sys_enter_lsetxattr(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_LSETXATTR;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);
@@ -739,7 +739,7 @@ int handle_sys_exit_lsetxattr(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_LSETXATTR;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -760,7 +760,7 @@ int handle_sys_enter_getxattr(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_GETXATTR;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);
@@ -782,7 +782,7 @@ int handle_sys_exit_getxattr(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_GETXATTR;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -803,7 +803,7 @@ int handle_sys_enter_lgetxattr(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_LGETXATTR;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);
@@ -825,7 +825,7 @@ int handle_sys_exit_lgetxattr(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_LGETXATTR;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -846,7 +846,7 @@ int handle_sys_enter_listxattr(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_LISTXATTR;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);
@@ -868,7 +868,7 @@ int handle_sys_exit_listxattr(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_LISTXATTR;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -889,7 +889,7 @@ int handle_sys_enter_llistxattr(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_LLISTXATTR;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);
@@ -911,7 +911,7 @@ int handle_sys_exit_llistxattr(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_LLISTXATTR;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -932,7 +932,7 @@ int handle_sys_enter_removexattr(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_REMOVEXATTR;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);
@@ -954,7 +954,7 @@ int handle_sys_exit_removexattr(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_REMOVEXATTR;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -975,7 +975,7 @@ int handle_sys_enter_lremovexattr(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_LREMOVEXATTR;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);
@@ -997,7 +997,7 @@ int handle_sys_exit_lremovexattr(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_LREMOVEXATTR;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1018,7 +1018,7 @@ int handle_sys_enter_open_tree(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_OPEN_TREE;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->filename), 0, sizeof(ev->filename) + sizeof(ev->comm));
bpf_probe_read_user_str(ev->filename, sizeof(ev->filename), (void *)ctx->args[1]);
bpf_get_current_comm(&ev->comm, sizeof(ev->comm));
@@ -1041,7 +1041,7 @@ int handle_sys_exit_open_tree(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_OPEN_TREE;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1062,7 +1062,7 @@ int handle_sys_enter_getdents(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_GETDENTS;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->fd = (__s32)ctx->args[0];
bpf_ringbuf_submit(ev, 0);
@@ -1083,7 +1083,7 @@ int handle_sys_exit_getdents(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_GETDENTS;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1104,7 +1104,7 @@ int handle_sys_enter_getdents64(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_GETDENTS64;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->fd = (__s32)ctx->args[0];
bpf_ringbuf_submit(ev, 0);
@@ -1125,7 +1125,7 @@ int handle_sys_exit_getdents64(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_GETDENTS64;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1146,7 +1146,7 @@ int handle_sys_enter_ioctl(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_IOCTL;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->fd = (__s32)ctx->args[0];
bpf_ringbuf_submit(ev, 0);
@@ -1167,7 +1167,7 @@ int handle_sys_exit_ioctl(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_IOCTL;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1188,7 +1188,7 @@ int handle_sys_enter_fcntl(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_FCNTL;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->fd = (__s32)ctx->args[0];
bpf_ringbuf_submit(ev, 0);
@@ -1209,7 +1209,7 @@ int handle_sys_exit_fcntl(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_FCNTL;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1230,7 +1230,7 @@ int handle_sys_enter_mknodat(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_MKNODAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->filename), 0, sizeof(ev->filename) + sizeof(ev->comm));
bpf_probe_read_user_str(ev->filename, sizeof(ev->filename), (void *)ctx->args[1]);
bpf_get_current_comm(&ev->comm, sizeof(ev->comm));
@@ -1253,7 +1253,7 @@ int handle_sys_exit_mknodat(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_MKNODAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1274,7 +1274,7 @@ int handle_sys_enter_mknod(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_MKNOD;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->filename), 0, sizeof(ev->filename) + sizeof(ev->comm));
bpf_probe_read_user_str(ev->filename, sizeof(ev->filename), (void *)ctx->args[0]);
bpf_get_current_comm(&ev->comm, sizeof(ev->comm));
@@ -1297,7 +1297,7 @@ int handle_sys_exit_mknod(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_MKNOD;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1318,7 +1318,7 @@ int handle_sys_enter_mkdirat(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_MKDIRAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[1]);
@@ -1340,7 +1340,7 @@ int handle_sys_exit_mkdirat(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_MKDIRAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1361,7 +1361,7 @@ int handle_sys_enter_mkdir(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_MKDIR;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);
@@ -1383,7 +1383,7 @@ int handle_sys_exit_mkdir(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_MKDIR;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1404,7 +1404,7 @@ int handle_sys_enter_rmdir(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_RMDIR;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);
@@ -1426,7 +1426,7 @@ int handle_sys_exit_rmdir(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_RMDIR;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1447,7 +1447,7 @@ int handle_sys_enter_unlinkat(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_UNLINKAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[1]);
@@ -1469,7 +1469,7 @@ int handle_sys_exit_unlinkat(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_UNLINKAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1490,7 +1490,7 @@ int handle_sys_enter_unlink(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_UNLINK;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);
@@ -1512,7 +1512,7 @@ int handle_sys_exit_unlink(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_UNLINK;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1533,7 +1533,7 @@ int handle_sys_enter_symlinkat(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_SYMLINKAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->oldname), 0, sizeof(ev->oldname) + sizeof(ev->newname));
bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (void*)ctx->args[0]);
bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (void*)ctx->args[2]);
@@ -1556,7 +1556,7 @@ int handle_sys_exit_symlinkat(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_SYMLINKAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1577,7 +1577,7 @@ int handle_sys_enter_symlink(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_SYMLINK;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->oldname), 0, sizeof(ev->oldname) + sizeof(ev->newname));
bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (void*)ctx->args[0]);
bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (void*)ctx->args[1]);
@@ -1600,7 +1600,7 @@ int handle_sys_exit_symlink(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_SYMLINK;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1621,7 +1621,7 @@ int handle_sys_enter_linkat(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_LINKAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->oldname), 0, sizeof(ev->oldname) + sizeof(ev->newname));
bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (void*)ctx->args[1]);
bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (void*)ctx->args[3]);
@@ -1644,7 +1644,7 @@ int handle_sys_exit_linkat(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_LINKAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1665,7 +1665,7 @@ int handle_sys_enter_link(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_LINK;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->oldname), 0, sizeof(ev->oldname) + sizeof(ev->newname));
bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (void*)ctx->args[0]);
bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (void*)ctx->args[1]);
@@ -1688,7 +1688,7 @@ int handle_sys_exit_link(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_LINK;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1709,7 +1709,7 @@ int handle_sys_enter_renameat2(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_RENAMEAT2;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->oldname), 0, sizeof(ev->oldname) + sizeof(ev->newname));
bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (void*)ctx->args[1]);
bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (void*)ctx->args[3]);
@@ -1732,7 +1732,7 @@ int handle_sys_exit_renameat2(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_RENAMEAT2;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1753,7 +1753,7 @@ int handle_sys_enter_renameat(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_RENAMEAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->oldname), 0, sizeof(ev->oldname) + sizeof(ev->newname));
bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (void*)ctx->args[1]);
bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (void*)ctx->args[3]);
@@ -1776,7 +1776,7 @@ int handle_sys_exit_renameat(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_RENAMEAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1797,7 +1797,7 @@ int handle_sys_enter_rename(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_RENAME;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->oldname), 0, sizeof(ev->oldname) + sizeof(ev->newname));
bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (void*)ctx->args[0]);
bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (void*)ctx->args[1]);
@@ -1820,7 +1820,7 @@ int handle_sys_exit_rename(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_RENAME;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1841,7 +1841,7 @@ int handle_sys_enter_execve(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_EXECVE;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->filename), 0, sizeof(ev->filename) + sizeof(ev->comm));
bpf_probe_read_user_str(ev->filename, sizeof(ev->filename), (void *)ctx->args[0]);
bpf_get_current_comm(&ev->comm, sizeof(ev->comm));
@@ -1864,7 +1864,7 @@ int handle_sys_exit_execve(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_EXECVE;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1885,7 +1885,7 @@ int handle_sys_enter_execveat(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_EXECVEAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->filename), 0, sizeof(ev->filename) + sizeof(ev->comm));
bpf_probe_read_user_str(ev->filename, sizeof(ev->filename), (void *)ctx->args[1]);
bpf_get_current_comm(&ev->comm, sizeof(ev->comm));
@@ -1908,7 +1908,7 @@ int handle_sys_exit_execveat(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_EXECVEAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1929,7 +1929,7 @@ int handle_sys_enter_newstat(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_NEWSTAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->filename), 0, sizeof(ev->filename) + sizeof(ev->comm));
bpf_probe_read_user_str(ev->filename, sizeof(ev->filename), (void *)ctx->args[0]);
bpf_get_current_comm(&ev->comm, sizeof(ev->comm));
@@ -1952,7 +1952,7 @@ int handle_sys_exit_newstat(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_NEWSTAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -1973,7 +1973,7 @@ int handle_sys_enter_newlstat(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_NEWLSTAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->filename), 0, sizeof(ev->filename) + sizeof(ev->comm));
bpf_probe_read_user_str(ev->filename, sizeof(ev->filename), (void *)ctx->args[0]);
bpf_get_current_comm(&ev->comm, sizeof(ev->comm));
@@ -1996,7 +1996,7 @@ int handle_sys_exit_newlstat(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_NEWLSTAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -2017,7 +2017,7 @@ int handle_sys_enter_newfstatat(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_NEWFSTATAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->filename), 0, sizeof(ev->filename) + sizeof(ev->comm));
bpf_probe_read_user_str(ev->filename, sizeof(ev->filename), (void *)ctx->args[1]);
bpf_get_current_comm(&ev->comm, sizeof(ev->comm));
@@ -2040,7 +2040,7 @@ int handle_sys_exit_newfstatat(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_NEWFSTATAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -2061,7 +2061,7 @@ int handle_sys_enter_newfstat(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_NEWFSTAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->fd = (__s32)ctx->args[0];
bpf_ringbuf_submit(ev, 0);
@@ -2082,7 +2082,7 @@ int handle_sys_exit_newfstat(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_NEWFSTAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -2103,7 +2103,7 @@ int handle_sys_enter_readlinkat(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_READLINKAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[1]);
@@ -2125,7 +2125,7 @@ int handle_sys_exit_readlinkat(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_READLINKAT;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -2146,7 +2146,7 @@ int handle_sys_enter_statx(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_STATX;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
__builtin_memset(&(ev->filename), 0, sizeof(ev->filename) + sizeof(ev->comm));
bpf_probe_read_user_str(ev->filename, sizeof(ev->filename), (void *)ctx->args[1]);
bpf_get_current_comm(&ev->comm, sizeof(ev->comm));
@@ -2169,7 +2169,7 @@ int handle_sys_exit_statx(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_STATX;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -2190,7 +2190,7 @@ int handle_sys_enter_lseek(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_LSEEK;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->fd = (__s32)ctx->args[0];
bpf_ringbuf_submit(ev, 0);
@@ -2211,7 +2211,7 @@ int handle_sys_exit_lseek(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_LSEEK;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -2232,7 +2232,7 @@ int handle_sys_enter_read(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_READ;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->fd = (__s32)ctx->args[0];
bpf_ringbuf_submit(ev, 0);
@@ -2253,7 +2253,7 @@ int handle_sys_exit_read(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_READ;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -2274,7 +2274,7 @@ int handle_sys_enter_write(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_WRITE;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->fd = (__s32)ctx->args[0];
bpf_ringbuf_submit(ev, 0);
@@ -2295,7 +2295,7 @@ int handle_sys_exit_write(struct trace_event_raw_sys_exit *ctx) {
ev->trace_id = SYS_EXIT_WRITE;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->ret = ctx->ret;
bpf_ringbuf_submit(ev, 0);
@@ -2316,7 +2316,7 @@ int handle_sys_enter_pread64(struct trace_event_raw_sys_enter *ctx) {
ev->trace_id = SYS_ENTER_PREAD64;
ev->pid = pid;
ev->tid = tid;
- ev->time = bpf_ktime_get_ns() / 1000;
+ ev->time = bpf_ktime_get_boot_ns();
ev->fd = (__s32)ctx->args[0];