diff options
Diffstat (limited to 'internal')
| -rw-r--r-- | internal/c/generate_tracepoints_c.raku | 20 | ||||
| -rw-r--r-- | internal/c/generated_tracepoints.c | 1185 | ||||
| -rw-r--r-- | internal/c/types.h | 13 | ||||
| -rw-r--r-- | internal/flamegraph/collapsed.go | 5 | ||||
| -rw-r--r-- | internal/tracepoints/generated_tracepoints.go | 18 | ||||
| -rw-r--r-- | internal/types/generated_types.go | 368 |
6 files changed, 1025 insertions, 584 deletions
diff --git a/internal/c/generate_tracepoints_c.raku b/internal/c/generate_tracepoints_c.raku index 251f52f..960e8f6 100644 --- a/internal/c/generate_tracepoints_c.raku +++ b/internal/c/generate_tracepoints_c.raku @@ -134,6 +134,20 @@ class NullTracepoint does TracepointTemplate { } } +class FcntlTracepoint does TracepointTemplate { + method generate-bpf-c-tracepoint(%vals --> Str) { + my Int \fd-field-number = %vals<format>.field-number('fd'); + my Int \cmd-field-number = %vals<format>.field-number('cmd'); + my Int \arg-field-number = %vals<format>.field-number('arg'); + my Str $extra = qq:to/BPF_C_CODE/; + ev->fd = {'ctx->args[' ~ fd-field-number ~ ']'}; + ev->cmd = {'ctx->args[' ~ cmd-field-number ~ ']'}; + ev->arg = {'ctx->args[' ~ arg-field-number ~ ']'}; + BPF_C_CODE + self.template: %vals.append( ( event-struct => 'fcntl_event', :$extra ).hash ); + } +} + class Format { has Field @!internal-fields; # Fields not accessible from raw tracepoints. has Field @!external-fields; # Fields accessible from raw tracepoints. @@ -162,6 +176,7 @@ class Format { multi method set-format-impl('filename', 'const char *') { $!format-impl = OpenTracepoint.new } multi method set-format-impl('pathname', 'const char *') { $!format-impl = PathnameTracepoint.new } multi method set-format-impl('ret', 'long') { $!format-impl = RetTracepoint.new } + multi method set-format-impl('cmd', 'unsigned int') { $!format-impl = FcntlTracepoint.new } multi method set-format-impl($, $) { } method generate-c-constant returns Str { "#define {$!name.uc} {$!id}" } @@ -169,7 +184,10 @@ class Format { method field-number(Str \field-name) { (@!external-fields.first(*.name eq field-name, :k) // 0) - 1 } method can-generate returns Bool { so $!format-impl.^can('generate-bpf-c-tracepoint') } - method enter-reject returns Bool { $!format-impl !~~ any(FdTracepoint, NameTracepoint, OpenTracepoint, PathnameTracepoint) } + + method enter-reject returns Bool { $!format-impl !~~ any( + FdTracepoint, NameTracepoint, OpenTracepoint, PathnameTracepoint, FcntlTracepoint + ) } } class SysTraceFormatActions { diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c index 2205a0d..75e7a6e 100644 --- a/internal/c/generated_tracepoints.c +++ b/internal/c/generated_tracepoints.c @@ -1,438 +1,449 @@ // Code generated - don't change manually! -// Ignoring sys_enter_epoll_pwait sys_exit_epoll_pwait as possibly not file I/O related -// Ignoring sys_enter_prctl sys_exit_prctl as possibly not file I/O related -// Ignoring sys_enter_timer_settime sys_exit_timer_settime as possibly not file I/O related -// Ignoring sys_enter_map_shadow_stack sys_exit_map_shadow_stack as possibly not file I/O related +// Ignoring sys_enter_setregid sys_exit_setregid as possibly not file I/O related +// Ignoring sys_enter_sched_rr_get_interval sys_exit_sched_rr_get_interval as possibly not file I/O related +// Ignoring sys_enter_getpid sys_exit_getpid as possibly not file I/O related +// Ignoring sys_enter_msgget sys_exit_msgget as possibly not file I/O related +// Ignoring sys_enter_sync sys_exit_sync as possibly not file I/O related +// Ignoring sys_enter_futex_wake sys_exit_futex_wake as possibly not file I/O related +// Ignoring sys_enter_futex sys_exit_futex as possibly not file I/O related +// Ignoring sys_enter_rt_sigpending sys_exit_rt_sigpending as possibly not file I/O related +// Ignoring sys_enter_restart_syscall sys_exit_restart_syscall as possibly not file I/O related +// Ignoring sys_enter_sched_get_priority_min sys_exit_sched_get_priority_min as possibly not file I/O related +// Ignoring sys_enter_timer_getoverrun sys_exit_timer_getoverrun as possibly not file I/O related +// Ignoring sys_enter_nanosleep sys_exit_nanosleep as possibly not file I/O related +// Ignoring sys_enter_setresuid sys_exit_setresuid as possibly not file I/O related +// Ignoring sys_enter_pipe sys_exit_pipe as possibly not file I/O related +// Ignoring sys_enter_readlink sys_exit_readlink as possibly not file I/O related +// Ignoring sys_enter_mlock sys_exit_mlock as possibly not file I/O related +// Ignoring sys_enter_getresgid sys_exit_getresgid as possibly not file I/O related +// Ignoring sys_enter_clock_adjtime sys_exit_clock_adjtime as possibly not file I/O related +// Ignoring sys_enter_epoll_create sys_exit_epoll_create as possibly not file I/O related +// Ignoring sys_enter_clock_settime sys_exit_clock_settime as possibly not file I/O related +// Ignoring sys_enter_move_pages sys_exit_move_pages as possibly not file I/O related +// Ignoring sys_enter_timerfd_create sys_exit_timerfd_create as possibly not file I/O related +// Ignoring sys_enter_pivot_root sys_exit_pivot_root as possibly not file I/O related +// Ignoring sys_enter_syncfs sys_exit_syncfs as possibly not file I/O related +// Ignoring sys_enter_statmount sys_exit_statmount as possibly not file I/O related // Ignoring sys_enter_landlock_add_rule sys_exit_landlock_add_rule as possibly not file I/O related -// Ignoring sys_enter_delete_module sys_exit_delete_module as possibly not file I/O related -// Ignoring sys_enter_msgsnd sys_exit_msgsnd as possibly not file I/O related +// Ignoring sys_enter_recvmmsg sys_exit_recvmmsg as possibly not file I/O related +// Ignoring sys_enter_setitimer sys_exit_setitimer as possibly not file I/O related +// Ignoring sys_enter_lsm_list_modules sys_exit_lsm_list_modules as possibly not file I/O related +// Ignoring sys_enter_mlock2 sys_exit_mlock2 as possibly not file I/O related +// Ignoring sys_enter_fallocate sys_exit_fallocate as possibly not file I/O related +// Ignoring sys_enter_mount sys_exit_mount as possibly not file I/O related +// Ignoring sys_enter_pidfd_getfd sys_exit_pidfd_getfd as possibly not file I/O related +// Ignoring sys_enter_vfork sys_exit_vfork as possibly not file I/O related +// Ignoring sys_enter_sendmmsg sys_exit_sendmmsg as possibly not file I/O related // Ignoring sys_enter_swapon sys_exit_swapon as possibly not file I/O related +// Ignoring sys_enter_modify_ldt sys_exit_modify_ldt as possibly not file I/O related +// Ignoring sys_enter_setreuid sys_exit_setreuid as possibly not file I/O related +// Ignoring sys_enter_shmctl sys_exit_shmctl as possibly not file I/O related +// Ignoring sys_enter_pidfd_open sys_exit_pidfd_open as possibly not file I/O related +// Ignoring sys_enter_io_cancel sys_exit_io_cancel as possibly not file I/O related +// Ignoring sys_enter_setuid sys_exit_setuid as possibly not file I/O related // Ignoring sys_enter_clock_nanosleep sys_exit_clock_nanosleep as possibly not file I/O related -// Ignoring sys_enter_signalfd4 sys_exit_signalfd4 as possibly not file I/O related -// Ignoring sys_enter_mmap sys_exit_mmap as possibly not file I/O related -// Ignoring sys_enter_copy_file_range sys_exit_copy_file_range as possibly not file I/O related -// Ignoring sys_enter_kexec_file_load sys_exit_kexec_file_load as possibly not file I/O related -// Ignoring sys_enter_rseq sys_exit_rseq as possibly not file I/O related -// Ignoring sys_enter_utimes sys_exit_utimes as possibly not file I/O related -// Ignoring sys_enter_splice sys_exit_splice as possibly not file I/O related -// Ignoring sys_enter_process_vm_readv sys_exit_process_vm_readv as possibly not file I/O related -// Ignoring sys_enter_mq_timedreceive sys_exit_mq_timedreceive as possibly not file I/O related -// Ignoring sys_enter_mprotect sys_exit_mprotect as possibly not file I/O related -// Ignoring sys_enter_gettimeofday sys_exit_gettimeofday as possibly not file I/O related -// Ignoring sys_enter_get_mempolicy sys_exit_get_mempolicy as possibly not file I/O related -// Ignoring sys_enter_membarrier sys_exit_membarrier as possibly not file I/O related -// Ignoring sys_enter_userfaultfd sys_exit_userfaultfd as possibly not file I/O related -// Ignoring sys_enter_sched_setaffinity sys_exit_sched_setaffinity as possibly not file I/O related -// Ignoring sys_enter_timer_delete sys_exit_timer_delete as possibly not file I/O related -// Ignoring sys_enter_move_mount sys_exit_move_mount as possibly not file I/O related -// Ignoring sys_enter_umount sys_exit_umount as possibly not file I/O related -// Ignoring sys_enter_arch_prctl sys_exit_arch_prctl as possibly not file I/O related +// Ignoring sys_enter_pause sys_exit_pause as possibly not file I/O related +// Ignoring sys_enter_open_by_handle_at sys_exit_open_by_handle_at as possibly not file I/O related +// Ignoring sys_enter_setfsuid sys_exit_setfsuid as possibly not file I/O related // Ignoring sys_enter_dup sys_exit_dup as possibly not file I/O related -// Ignoring sys_enter_ustat sys_exit_ustat as possibly not file I/O related -// Ignoring sys_enter_lsm_get_self_attr sys_exit_lsm_get_self_attr as possibly not file I/O related -// Ignoring sys_enter_clock_getres sys_exit_clock_getres as possibly not file I/O related -// Ignoring sys_enter_syslog sys_exit_syslog as possibly not file I/O related -// Ignoring sys_enter_umask sys_exit_umask as possibly not file I/O related -// Ignoring sys_enter_io_submit sys_exit_io_submit as possibly not file I/O related -// Ignoring sys_enter_pidfd_getfd sys_exit_pidfd_getfd as possibly not file I/O related -// Ignoring sys_enter_getsockname sys_exit_getsockname as possibly not file I/O related -// Ignoring sys_enter_kexec_load sys_exit_kexec_load as possibly not file I/O related -// Ignoring sys_enter_setgid sys_exit_setgid as possibly not file I/O related -// Ignoring sys_enter_mq_getsetattr sys_exit_mq_getsetattr as possibly not file I/O related -// Ignoring sys_enter_preadv sys_exit_preadv as possibly not file I/O related -// Ignoring sys_enter_rt_sigreturn sys_exit_rt_sigreturn as possibly not file I/O related -// Ignoring sys_enter_mq_timedsend sys_exit_mq_timedsend as possibly not file I/O related -// Ignoring sys_enter_readlink sys_exit_readlink as possibly not file I/O related -// Ignoring sys_enter_pkey_mprotect sys_exit_pkey_mprotect as possibly not file I/O related -// Ignoring sys_enter_fanotify_init sys_exit_fanotify_init as possibly not file I/O related -// Ignoring sys_enter_mq_notify sys_exit_mq_notify as possibly not file I/O related -// Ignoring sys_enter_mlockall sys_exit_mlockall as possibly not file I/O related -// Ignoring sys_enter_recvmmsg sys_exit_recvmmsg as possibly not file I/O related -// Ignoring sys_enter_move_pages sys_exit_move_pages as possibly not file I/O related -// Ignoring sys_enter_sched_getaffinity sys_exit_sched_getaffinity as possibly not file I/O related -// Ignoring sys_enter_listen sys_exit_listen as possibly not file I/O related -// Ignoring sys_enter_syncfs sys_exit_syncfs as possibly not file I/O related -// Ignoring sys_enter_munlock sys_exit_munlock as possibly not file I/O related -// Ignoring sys_enter_reboot sys_exit_reboot as possibly not file I/O related -// Ignoring sys_enter_msgctl sys_exit_msgctl as possibly not file I/O related -// Ignoring sys_enter_clock_adjtime sys_exit_clock_adjtime as possibly not file I/O related -// Ignoring sys_enter_ioprio_set sys_exit_ioprio_set as possibly not file I/O related -// Ignoring sys_enter_times sys_exit_times as possibly not file I/O related -// Ignoring sys_enter_getitimer sys_exit_getitimer as possibly not file I/O related -// Ignoring sys_enter_fadvise64 sys_exit_fadvise64 as possibly not file I/O related -// Ignoring sys_enter_clock_gettime sys_exit_clock_gettime as possibly not file I/O related +// Ignoring sys_enter_memfd_create sys_exit_memfd_create as possibly not file I/O related +// Ignoring sys_enter_sethostname sys_exit_sethostname as possibly not file I/O related +// Ignoring sys_enter_geteuid sys_exit_geteuid as possibly not file I/O related +// Ignoring sys_enter_sync_file_range sys_exit_sync_file_range as possibly not file I/O related +// Ignoring sys_enter_pkey_alloc sys_exit_pkey_alloc as possibly not file I/O related +// Ignoring sys_enter_msync sys_exit_msync as possibly not file I/O related // Ignoring sys_enter_rt_sigprocmask sys_exit_rt_sigprocmask as possibly not file I/O related -// Ignoring sys_enter_setregid sys_exit_setregid as possibly not file I/O related -// Ignoring sys_enter_mremap sys_exit_mremap as possibly not file I/O related -// Ignoring sys_enter_epoll_ctl sys_exit_epoll_ctl as possibly not file I/O related -// Ignoring sys_enter_bpf sys_exit_bpf as possibly not file I/O related -// Ignoring sys_enter_wait4 sys_exit_wait4 as possibly not file I/O related -// Ignoring sys_enter_listmount sys_exit_listmount as possibly not file I/O related -// Ignoring sys_enter_setsockopt sys_exit_setsockopt as possibly not file I/O related -// Ignoring sys_enter_pselect6 sys_exit_pselect6 as possibly not file I/O related -// Ignoring sys_enter_sched_get_priority_min sys_exit_sched_get_priority_min as possibly not file I/O related // Ignoring sys_enter_madvise sys_exit_madvise as possibly not file I/O related -// Ignoring sys_enter_writev sys_exit_writev as possibly not file I/O related -// Ignoring sys_enter_seccomp sys_exit_seccomp as possibly not file I/O related -// Ignoring sys_enter_dup3 sys_exit_dup3 as possibly not file I/O related -// Ignoring sys_enter_fallocate sys_exit_fallocate as possibly not file I/O related -// Ignoring sys_enter_io_destroy sys_exit_io_destroy as possibly not file I/O related -// Ignoring sys_enter_poll sys_exit_poll as possibly not file I/O related -// Ignoring sys_enter_ppoll sys_exit_ppoll as possibly not file I/O related -// Ignoring sys_enter_shmget sys_exit_shmget as possibly not file I/O related -// Ignoring sys_enter_utime sys_exit_utime as possibly not file I/O related -// Ignoring sys_enter_connect sys_exit_connect as possibly not file I/O related -// Ignoring sys_enter_keyctl sys_exit_keyctl as possibly not file I/O related -// Ignoring sys_enter_setsid sys_exit_setsid as possibly not file I/O related -// Ignoring sys_enter_rt_sigaction sys_exit_rt_sigaction as possibly not file I/O related -// Ignoring sys_enter_futex_wait sys_exit_futex_wait as possibly not file I/O related -// Ignoring sys_enter_statmount sys_exit_statmount as possibly not file I/O related -// Ignoring sys_enter_socketpair sys_exit_socketpair as possibly not file I/O related -// Ignoring sys_enter_semctl sys_exit_semctl as possibly not file I/O related -// Ignoring sys_enter_process_mrelease sys_exit_process_mrelease as possibly not file I/O related -// Ignoring sys_enter_tkill sys_exit_tkill as possibly not file I/O related -// Ignoring sys_enter_mq_open sys_exit_mq_open as possibly not file I/O related -// Ignoring sys_enter_getgid sys_exit_getgid as possibly not file I/O related -// Ignoring sys_enter_landlock_create_ruleset sys_exit_landlock_create_ruleset as possibly not file I/O related -// Ignoring sys_enter_acct sys_exit_acct as possibly not file I/O related -// Ignoring sys_enter_fsetxattr sys_exit_fsetxattr as possibly not file I/O related -// Ignoring sys_enter_sysinfo sys_exit_sysinfo as possibly not file I/O related -// Ignoring sys_enter_io_cancel sys_exit_io_cancel as possibly not file I/O related -// Ignoring sys_enter_fsopen sys_exit_fsopen as possibly not file I/O related +// Ignoring sys_enter_setgid sys_exit_setgid as possibly not file I/O related // Ignoring sys_enter_msgrcv sys_exit_msgrcv as possibly not file I/O related -// Ignoring sys_enter_getresuid sys_exit_getresuid as possibly not file I/O related +// Ignoring sys_enter_timer_create sys_exit_timer_create as possibly not file I/O related +// Ignoring sys_enter_sched_getscheduler sys_exit_sched_getscheduler as possibly not file I/O related +// Ignoring sys_enter_exit_group sys_exit_exit_group as possibly not file I/O related // Ignoring sys_enter_getuid sys_exit_getuid as possibly not file I/O related -// Ignoring sys_enter_request_key sys_exit_request_key as possibly not file I/O related // Ignoring sys_enter_readv sys_exit_readv as possibly not file I/O related -// Ignoring sys_enter_time sys_exit_time as possibly not file I/O related -// Ignoring sys_enter_io_pgetevents sys_exit_io_pgetevents as possibly not file I/O related -// Ignoring sys_enter_lsm_set_self_attr sys_exit_lsm_set_self_attr as possibly not file I/O related -// Ignoring sys_enter_fsconfig sys_exit_fsconfig as possibly not file I/O related -// Ignoring sys_enter_sysfs sys_exit_sysfs as possibly not file I/O related +// Ignoring sys_enter_rt_sigsuspend sys_exit_rt_sigsuspend as possibly not file I/O related +// Ignoring sys_enter_dup3 sys_exit_dup3 as possibly not file I/O related +// Ignoring sys_enter_mq_unlink sys_exit_mq_unlink as possibly not file I/O related +// Ignoring sys_enter_fork sys_exit_fork as possibly not file I/O related // Ignoring sys_enter_io_uring_setup sys_exit_io_uring_setup as possibly not file I/O related -// Ignoring sys_enter_pkey_alloc sys_exit_pkey_alloc as possibly not file I/O related -// Ignoring sys_enter_set_tid_address sys_exit_set_tid_address as possibly not file I/O related -// Ignoring sys_enter_setfsuid sys_exit_setfsuid as possibly not file I/O related -// Ignoring sys_enter_shmat sys_exit_shmat as possibly not file I/O related -// Ignoring sys_enter_timerfd_gettime sys_exit_timerfd_gettime as possibly not file I/O related -// Ignoring sys_enter_personality sys_exit_personality as possibly not file I/O related -// Ignoring sys_enter_msgget sys_exit_msgget as possibly not file I/O related // Ignoring sys_enter_inotify_rm_watch sys_exit_inotify_rm_watch as possibly not file I/O related -// Ignoring sys_enter_timerfd_create sys_exit_timerfd_create as possibly not file I/O related -// Ignoring sys_enter_accept4 sys_exit_accept4 as possibly not file I/O related -// Ignoring sys_enter_sched_getattr sys_exit_sched_getattr as possibly not file I/O related -// Ignoring sys_enter_exit_group sys_exit_exit_group as possibly not file I/O related -// Ignoring sys_enter_getppid sys_exit_getppid as possibly not file I/O related -// Ignoring sys_enter_epoll_pwait2 sys_exit_epoll_pwait2 as possibly not file I/O related +// Ignoring sys_enter_connect sys_exit_connect as possibly not file I/O related +// Ignoring sys_enter_sigaltstack sys_exit_sigaltstack as possibly not file I/O related +// Ignoring sys_enter_arch_prctl sys_exit_arch_prctl as possibly not file I/O related +// Ignoring sys_enter_sched_setattr sys_exit_sched_setattr as possibly not file I/O related +// Ignoring sys_enter_rt_tgsigqueueinfo sys_exit_rt_tgsigqueueinfo as possibly not file I/O related +// Ignoring sys_enter_bpf sys_exit_bpf as possibly not file I/O related +// Ignoring sys_enter_tkill sys_exit_tkill as possibly not file I/O related +// Ignoring sys_enter_sched_setscheduler sys_exit_sched_setscheduler as possibly not file I/O related +// Ignoring sys_enter_mq_notify sys_exit_mq_notify as possibly not file I/O related +// Ignoring sys_enter_fsetxattr sys_exit_fsetxattr as possibly not file I/O related +// Ignoring sys_enter_io_getevents sys_exit_io_getevents as possibly not file I/O related +// Ignoring sys_enter_dup2 sys_exit_dup2 as possibly not file I/O related +// Ignoring sys_enter_fspick sys_exit_fspick as possibly not file I/O related +// Ignoring sys_enter_recvfrom sys_exit_recvfrom as possibly not file I/O related +// Ignoring sys_enter_shmdt sys_exit_shmdt as possibly not file I/O related +// Ignoring sys_enter_syslog sys_exit_syslog as possibly not file I/O related +// Ignoring sys_enter_ioprio_get sys_exit_ioprio_get as possibly not file I/O related +// Ignoring sys_enter_wait4 sys_exit_wait4 as possibly not file I/O related +// Ignoring sys_enter_times sys_exit_times as possibly not file I/O related +// Ignoring sys_enter_fanotify_init sys_exit_fanotify_init as possibly not file I/O related +// Ignoring sys_enter_getitimer sys_exit_getitimer as possibly not file I/O related +// Ignoring sys_enter_capget sys_exit_capget as possibly not file I/O related +// Ignoring sys_enter_semtimedop sys_exit_semtimedop as possibly not file I/O related +// Ignoring sys_enter_vmsplice sys_exit_vmsplice as possibly not file I/O related +// Ignoring sys_enter_msgsnd sys_exit_msgsnd as possibly not file I/O related +// Ignoring sys_enter_sched_get_priority_max sys_exit_sched_get_priority_max as possibly not file I/O related // Ignoring sys_enter_timer_gettime sys_exit_timer_gettime as possibly not file I/O related -// Ignoring sys_enter_getrandom sys_exit_getrandom as possibly not file I/O related -// Ignoring sys_enter_eventfd2 sys_exit_eventfd2 as possibly not file I/O related -// Ignoring sys_enter_getcpu sys_exit_getcpu as possibly not file I/O related -// Ignoring sys_enter_shutdown sys_exit_shutdown as possibly not file I/O related +// Ignoring sys_enter_getegid sys_exit_getegid as possibly not file I/O related +// Ignoring sys_enter_setpgid sys_exit_setpgid as possibly not file I/O related +// Ignoring sys_enter_semget sys_exit_semget as possibly not file I/O related +// Ignoring sys_enter_acct sys_exit_acct as possibly not file I/O related +// Ignoring sys_enter_setgroups sys_exit_setgroups as possibly not file I/O related +// Ignoring sys_enter_fsopen sys_exit_fsopen as possibly not file I/O related +// Ignoring sys_enter_process_madvise sys_exit_process_madvise as possibly not file I/O related +// Ignoring sys_enter_map_shadow_stack sys_exit_map_shadow_stack as possibly not file I/O related +// Ignoring sys_enter_alarm sys_exit_alarm as possibly not file I/O related +// Ignoring sys_enter_getsockopt sys_exit_getsockopt as possibly not file I/O related +// Ignoring sys_enter_perf_event_open sys_exit_perf_event_open as possibly not file I/O related +// Ignoring sys_enter_timerfd_gettime sys_exit_timerfd_gettime as possibly not file I/O related +// Ignoring sys_enter_splice sys_exit_splice as possibly not file I/O related // Ignoring sys_enter_getpgrp sys_exit_getpgrp as possibly not file I/O related -// Ignoring sys_enter_dup2 sys_exit_dup2 as possibly not file I/O related -// Ignoring sys_enter_unshare sys_exit_unshare as possibly not file I/O related -// Ignoring sys_enter_getresgid sys_exit_getresgid as possibly not file I/O related -// Ignoring sys_enter_futex sys_exit_futex as possibly not file I/O related -// Ignoring sys_enter_pidfd_open sys_exit_pidfd_open as possibly not file I/O related -// Ignoring sys_enter_brk sys_exit_brk as possibly not file I/O related -// Ignoring sys_enter_semop sys_exit_semop as possibly not file I/O related -// Ignoring sys_enter_nanosleep sys_exit_nanosleep as possibly not file I/O related -// Ignoring sys_enter_name_to_handle_at sys_exit_name_to_handle_at as possibly not file I/O related -// Ignoring sys_enter_getpgid sys_exit_getpgid as possibly not file I/O related -// Ignoring sys_enter_process_vm_writev sys_exit_process_vm_writev as possibly not file I/O related -// Ignoring sys_enter_quotactl sys_exit_quotactl as possibly not file I/O related -// Ignoring sys_enter_mount sys_exit_mount as possibly not file I/O related -// Ignoring sys_enter_sync_file_range sys_exit_sync_file_range as possibly not file I/O related // Ignoring sys_enter_munmap sys_exit_munmap as possibly not file I/O related +// Ignoring sys_enter_personality sys_exit_personality as possibly not file I/O related +// Ignoring sys_enter_swapoff sys_exit_swapoff as possibly not file I/O related +// Ignoring sys_enter_kill sys_exit_kill as possibly not file I/O related +// Ignoring sys_enter_process_vm_writev sys_exit_process_vm_writev as possibly not file I/O related +// Ignoring sys_enter_sendmsg sys_exit_sendmsg as possibly not file I/O related +// Ignoring sys_enter_io_pgetevents sys_exit_io_pgetevents as possibly not file I/O related // Ignoring sys_enter_io_setup sys_exit_io_setup as possibly not file I/O related -// Ignoring sys_enter_newuname sys_exit_newuname as possibly not file I/O related -// Ignoring sys_enter_open_by_handle_at sys_exit_open_by_handle_at as possibly not file I/O related +// Ignoring sys_enter_shmat sys_exit_shmat as possibly not file I/O related +// Ignoring sys_enter_timerfd_settime sys_exit_timerfd_settime as possibly not file I/O related +// Ignoring sys_enter_signalfd sys_exit_signalfd as possibly not file I/O related +// Ignoring sys_enter_uretprobe sys_exit_uretprobe as possibly not file I/O related +// Ignoring sys_enter_munlock sys_exit_munlock as possibly not file I/O related +// Ignoring sys_enter_mq_getsetattr sys_exit_mq_getsetattr as possibly not file I/O related +// Ignoring sys_enter_accept4 sys_exit_accept4 as possibly not file I/O related +// Ignoring sys_enter_fgetxattr sys_exit_fgetxattr as possibly not file I/O related // Ignoring sys_enter_getrlimit sys_exit_getrlimit as possibly not file I/O related -// Ignoring sys_enter_getegid sys_exit_getegid as possibly not file I/O related -// Ignoring sys_enter_memfd_secret sys_exit_memfd_secret as possibly not file I/O related +// Ignoring sys_enter_setsid sys_exit_setsid as possibly not file I/O related +// Ignoring sys_enter_preadv2 sys_exit_preadv2 as possibly not file I/O related +// Ignoring sys_enter_pidfd_send_signal sys_exit_pidfd_send_signal as possibly not file I/O related +// Ignoring sys_enter_sched_getparam sys_exit_sched_getparam as possibly not file I/O related +// Ignoring sys_enter_setsockopt sys_exit_setsockopt as possibly not file I/O related +// Ignoring sys_enter_move_mount sys_exit_move_mount as possibly not file I/O related +// Ignoring sys_enter_epoll_ctl sys_exit_epoll_ctl as possibly not file I/O related +// Ignoring sys_enter_clone sys_exit_clone as possibly not file I/O related +// Ignoring sys_enter_get_mempolicy sys_exit_get_mempolicy as possibly not file I/O related +// Ignoring sys_enter_set_robust_list sys_exit_set_robust_list as possibly not file I/O related +// Ignoring sys_enter_getresuid sys_exit_getresuid as possibly not file I/O related +// Ignoring sys_enter_set_tid_address sys_exit_set_tid_address as possibly not file I/O related +// Ignoring sys_enter_umount sys_exit_umount as possibly not file I/O related +// Ignoring sys_enter_shutdown sys_exit_shutdown as possibly not file I/O related +// Ignoring sys_enter_finit_module sys_exit_finit_module as possibly not file I/O related +// Ignoring sys_enter_prlimit64 sys_exit_prlimit64 as possibly not file I/O related +// Ignoring sys_enter_ioprio_set sys_exit_ioprio_set as possibly not file I/O related +// Ignoring sys_enter_preadv sys_exit_preadv as possibly not file I/O related +// Ignoring sys_enter_writev sys_exit_writev as possibly not file I/O related +// Ignoring sys_enter_gettid sys_exit_gettid as possibly not file I/O related +// Ignoring sys_enter_eventfd sys_exit_eventfd as possibly not file I/O related // Ignoring sys_enter_getpeername sys_exit_getpeername as possibly not file I/O related -// Ignoring sys_enter_clone3 sys_exit_clone3 as possibly not file I/O related -// Ignoring sys_enter_sendmsg sys_exit_sendmsg as possibly not file I/O related -// Ignoring sys_enter_kcmp sys_exit_kcmp as possibly not file I/O related -// Ignoring sys_enter_setreuid sys_exit_setreuid as possibly not file I/O related +// Ignoring sys_enter_mount_setattr sys_exit_mount_setattr as possibly not file I/O related +// Ignoring sys_enter_getcpu sys_exit_getcpu as possibly not file I/O related +// Ignoring sys_enter_rt_sigaction sys_exit_rt_sigaction as possibly not file I/O related +// Ignoring sys_enter_unshare sys_exit_unshare as possibly not file I/O related // Ignoring sys_enter_getcwd sys_exit_getcwd as possibly not file I/O related -// Ignoring sys_enter_setfsgid sys_exit_setfsgid as possibly not file I/O related -// Ignoring sys_enter_setuid sys_exit_setuid as possibly not file I/O related -// Ignoring sys_enter_setgroups sys_exit_setgroups as possibly not file I/O related -// Ignoring sys_enter_futex_waitv sys_exit_futex_waitv as possibly not file I/O related -// Ignoring sys_enter_set_mempolicy sys_exit_set_mempolicy as possibly not file I/O related -// Ignoring sys_enter_sched_getscheduler sys_exit_sched_getscheduler as possibly not file I/O related -// Ignoring sys_enter_modify_ldt sys_exit_modify_ldt as possibly not file I/O related -// Ignoring sys_enter_sched_get_priority_max sys_exit_sched_get_priority_max as possibly not file I/O related -// Ignoring sys_enter_memfd_create sys_exit_memfd_create as possibly not file I/O related -// Ignoring sys_enter_mq_unlink sys_exit_mq_unlink as possibly not file I/O related -// Ignoring sys_enter_setresuid sys_exit_setresuid as possibly not file I/O related -// Ignoring sys_enter_pwritev2 sys_exit_pwritev2 as possibly not file I/O related -// Ignoring sys_enter_fsmount sys_exit_fsmount as possibly not file I/O related -// Ignoring sys_enter_geteuid sys_exit_geteuid as possibly not file I/O related -// Ignoring sys_enter_perf_event_open sys_exit_perf_event_open as possibly not file I/O related -// Ignoring sys_enter_recvmsg sys_exit_recvmsg as possibly not file I/O related -// Ignoring sys_enter_accept sys_exit_accept as possibly not file I/O related -// Ignoring sys_enter_kill sys_exit_kill as possibly not file I/O related -// Ignoring sys_enter_clone sys_exit_clone as possibly not file I/O related -// Ignoring sys_enter_truncate sys_exit_truncate as possibly not file I/O related -// Ignoring sys_enter_semget sys_exit_semget as possibly not file I/O related -// Ignoring sys_enter_restart_syscall sys_exit_restart_syscall as possibly not file I/O related -// Ignoring sys_enter_shmdt sys_exit_shmdt as possibly not file I/O related -// Ignoring sys_enter_vhangup sys_exit_vhangup as possibly not file I/O related -// Ignoring sys_enter_sethostname sys_exit_sethostname as possibly not file I/O related +// Ignoring sys_enter_remap_file_pages sys_exit_remap_file_pages as possibly not file I/O related +// Ignoring sys_enter_sched_getattr sys_exit_sched_getattr as possibly not file I/O related // Ignoring sys_enter_setrlimit sys_exit_setrlimit as possibly not file I/O related -// Ignoring sys_enter_epoll_wait sys_exit_epoll_wait as possibly not file I/O related -// Ignoring sys_enter_sched_setparam sys_exit_sched_setparam as possibly not file I/O related -// Ignoring sys_enter_inotify_init1 sys_exit_inotify_init1 as possibly not file I/O related -// Ignoring sys_enter_preadv2 sys_exit_preadv2 as possibly not file I/O related -// Ignoring sys_enter_pivot_root sys_exit_pivot_root as possibly not file I/O related -// Ignoring sys_enter_sched_yield sys_exit_sched_yield as possibly not file I/O related +// Ignoring sys_enter_getpriority sys_exit_getpriority as possibly not file I/O related +// Ignoring sys_enter_mincore sys_exit_mincore as possibly not file I/O related +// Ignoring sys_enter_mremap sys_exit_mremap as possibly not file I/O related +// Ignoring sys_enter_mseal sys_exit_mseal as possibly not file I/O related +// Ignoring sys_enter_poll sys_exit_poll as possibly not file I/O related +// Ignoring sys_enter_io_submit sys_exit_io_submit as possibly not file I/O related +// Ignoring sys_enter_fremovexattr sys_exit_fremovexattr as possibly not file I/O related +// Ignoring sys_enter_rt_sigqueueinfo sys_exit_rt_sigqueueinfo as possibly not file I/O related +// Ignoring sys_enter_clock_gettime sys_exit_clock_gettime as possibly not file I/O related +// Ignoring sys_enter_pwritev sys_exit_pwritev as possibly not file I/O related +// Ignoring sys_enter_munlockall sys_exit_munlockall as possibly not file I/O related // Ignoring sys_enter_sendfile64 sys_exit_sendfile64 as possibly not file I/O related -// Ignoring sys_enter_inotify_init sys_exit_inotify_init as possibly not file I/O related -// Ignoring sys_enter_uretprobe sys_exit_uretprobe as possibly not file I/O related +// Ignoring sys_enter_io_destroy sys_exit_io_destroy as possibly not file I/O related +// Ignoring sys_enter_rt_sigtimedwait sys_exit_rt_sigtimedwait as possibly not file I/O related +// Ignoring sys_enter_sched_getaffinity sys_exit_sched_getaffinity as possibly not file I/O related +// Ignoring sys_enter_gettimeofday sys_exit_gettimeofday as possibly not file I/O related // Ignoring sys_enter_select sys_exit_select as possibly not file I/O related -// Ignoring sys_enter_setpriority sys_exit_setpriority as possibly not file I/O related -// Ignoring sys_enter_readahead sys_exit_readahead as possibly not file I/O related -// Ignoring sys_enter_sched_rr_get_interval sys_exit_sched_rr_get_interval as possibly not file I/O related -// Ignoring sys_enter_iopl sys_exit_iopl as possibly not file I/O related -// Ignoring sys_enter_mbind sys_exit_mbind as possibly not file I/O related -// Ignoring sys_enter_munlockall sys_exit_munlockall as possibly not file I/O related -// Ignoring sys_enter_tgkill sys_exit_tgkill as possibly not file I/O related -// Ignoring sys_enter_getsid sys_exit_getsid as possibly not file I/O related -// Ignoring sys_enter_timerfd_settime sys_exit_timerfd_settime as possibly not file I/O related -// Ignoring sys_enter_init_module sys_exit_init_module as possibly not file I/O related -// Ignoring sys_enter_futex_wake sys_exit_futex_wake as possibly not file I/O related -// Ignoring sys_enter_getgroups sys_exit_getgroups as possibly not file I/O related -// Ignoring sys_enter_rt_sigpending sys_exit_rt_sigpending as possibly not file I/O related -// Ignoring sys_enter_flistxattr sys_exit_flistxattr as possibly not file I/O related -// Ignoring sys_enter_rt_sigsuspend sys_exit_rt_sigsuspend as possibly not file I/O related -// Ignoring sys_enter_recvfrom sys_exit_recvfrom as possibly not file I/O related -// Ignoring sys_enter_fremovexattr sys_exit_fremovexattr as possibly not file I/O related -// Ignoring sys_enter_bind sys_exit_bind as possibly not file I/O related -// Ignoring sys_enter_pause sys_exit_pause as possibly not file I/O related -// Ignoring sys_enter_add_key sys_exit_add_key as possibly not file I/O related -// Ignoring sys_enter_pipe2 sys_exit_pipe2 as possibly not file I/O related -// Ignoring sys_enter_sched_setscheduler sys_exit_sched_setscheduler as possibly not file I/O related +// Ignoring sys_enter_setdomainname sys_exit_setdomainname as possibly not file I/O related // Ignoring sys_enter_setns sys_exit_setns as possibly not file I/O related -// Ignoring sys_enter_fspick sys_exit_fspick as possibly not file I/O related -// Ignoring sys_enter_lsm_list_modules sys_exit_lsm_list_modules as possibly not file I/O related -// Ignoring sys_enter_sched_setattr sys_exit_sched_setattr as possibly not file I/O related -// Ignoring sys_enter_fork sys_exit_fork as possibly not file I/O related +// Ignoring sys_enter_setresgid sys_exit_setresgid as possibly not file I/O related +// Ignoring sys_enter_process_mrelease sys_exit_process_mrelease as possibly not file I/O related +// Ignoring sys_enter_newuname sys_exit_newuname as possibly not file I/O related // Ignoring sys_enter_tee sys_exit_tee as possibly not file I/O related -// Ignoring sys_enter_eventfd sys_exit_eventfd as possibly not file I/O related -// Ignoring sys_enter_mlock sys_exit_mlock as possibly not file I/O related -// Ignoring sys_enter_prlimit64 sys_exit_prlimit64 as possibly not file I/O related -// Ignoring sys_enter_exit sys_exit_exit as possibly not file I/O related -// Ignoring sys_enter_shmctl sys_exit_shmctl as possibly not file I/O related -// Ignoring sys_enter_process_madvise sys_exit_process_madvise as possibly not file I/O related +// Ignoring sys_enter_eventfd2 sys_exit_eventfd2 as possibly not file I/O related +// Ignoring sys_enter_name_to_handle_at sys_exit_name_to_handle_at as possibly not file I/O related +// Ignoring sys_enter_migrate_pages sys_exit_migrate_pages as possibly not file I/O related +// Ignoring sys_enter_seccomp sys_exit_seccomp as possibly not file I/O related // Ignoring sys_enter_futex_requeue sys_exit_futex_requeue as possibly not file I/O related -// Ignoring sys_enter_remap_file_pages sys_exit_remap_file_pages as possibly not file I/O related -// Ignoring sys_enter_timer_getoverrun sys_exit_timer_getoverrun as possibly not file I/O related -// Ignoring sys_enter_pipe sys_exit_pipe as possibly not file I/O related -// Ignoring sys_enter_pwritev sys_exit_pwritev as possibly not file I/O related -// Ignoring sys_enter_sched_getparam sys_exit_sched_getparam as possibly not file I/O related -// Ignoring sys_enter_signalfd sys_exit_signalfd as possibly not file I/O related -// Ignoring sys_enter_getpriority sys_exit_getpriority as possibly not file I/O related -// Ignoring sys_enter_adjtimex sys_exit_adjtimex as possibly not file I/O related -// Ignoring sys_enter_io_getevents sys_exit_io_getevents as possibly not file I/O related -// Ignoring sys_enter_rt_sigtimedwait sys_exit_rt_sigtimedwait as possibly not file I/O related -// Ignoring sys_enter_pidfd_send_signal sys_exit_pidfd_send_signal as possibly not file I/O related -// Ignoring sys_enter_timer_create sys_exit_timer_create as possibly not file I/O related -// Ignoring sys_enter_settimeofday sys_exit_settimeofday as possibly not file I/O related -// Ignoring sys_enter_semtimedop sys_exit_semtimedop as possibly not file I/O related -// Ignoring sys_enter_mseal sys_exit_mseal as possibly not file I/O related -// Ignoring sys_enter_epoll_create1 sys_exit_epoll_create1 as possibly not file I/O related -// Ignoring sys_enter_sendmmsg sys_exit_sendmmsg as possibly not file I/O related -// Ignoring sys_enter_fgetxattr sys_exit_fgetxattr as possibly not file I/O related -// Ignoring sys_enter_setresgid sys_exit_setresgid as possibly not file I/O related -// Ignoring sys_enter_sigaltstack sys_exit_sigaltstack as possibly not file I/O related -// Ignoring sys_enter_mlock2 sys_exit_mlock2 as possibly not file I/O related -// Ignoring sys_enter_pkey_free sys_exit_pkey_free as possibly not file I/O related -// Ignoring sys_enter_finit_module sys_exit_finit_module as possibly not file I/O related -// Ignoring sys_enter_alarm sys_exit_alarm as possibly not file I/O related -// Ignoring sys_enter_mincore sys_exit_mincore as possibly not file I/O related -// Ignoring sys_enter_setdomainname sys_exit_setdomainname as possibly not file I/O related -// Ignoring sys_enter_set_robust_list sys_exit_set_robust_list as possibly not file I/O related -// Ignoring sys_enter_capset sys_exit_capset as possibly not file I/O related -// Ignoring sys_enter_rt_tgsigqueueinfo sys_exit_rt_tgsigqueueinfo as possibly not file I/O related -// Ignoring sys_enter_rt_sigqueueinfo sys_exit_rt_sigqueueinfo as possibly not file I/O related -// Ignoring sys_enter_msync sys_exit_msync as possibly not file I/O related -// Ignoring sys_enter_socket sys_exit_socket as possibly not file I/O related -// Ignoring sys_enter_get_robust_list sys_exit_get_robust_list as possibly not file I/O related -// Ignoring sys_enter_mount_setattr sys_exit_mount_setattr as possibly not file I/O related -// Ignoring sys_enter_swapoff sys_exit_swapoff as possibly not file I/O related +// Ignoring sys_enter_timer_delete sys_exit_timer_delete as possibly not file I/O related +// Ignoring sys_enter_lsm_get_self_attr sys_exit_lsm_get_self_attr as possibly not file I/O related +// Ignoring sys_enter_epoll_pwait2 sys_exit_epoll_pwait2 as possibly not file I/O related +// Ignoring sys_enter_inotify_init sys_exit_inotify_init as possibly not file I/O related // Ignoring sys_enter_ioperm sys_exit_ioperm as possibly not file I/O related -// Ignoring sys_enter_vfork sys_exit_vfork as possibly not file I/O related -// Ignoring sys_enter_landlock_restrict_self sys_exit_landlock_restrict_self as possibly not file I/O related -// Ignoring sys_enter_migrate_pages sys_exit_migrate_pages as possibly not file I/O related -// Ignoring sys_enter_epoll_create sys_exit_epoll_create as possibly not file I/O related -// Ignoring sys_enter_getpid sys_exit_getpid as possibly not file I/O related -// Ignoring sys_enter_ioprio_get sys_exit_ioprio_get as possibly not file I/O related +// Ignoring sys_enter_flistxattr sys_exit_flistxattr as possibly not file I/O related +// Ignoring sys_enter_futex_waitv sys_exit_futex_waitv as possibly not file I/O related +// Ignoring sys_enter_set_mempolicy sys_exit_set_mempolicy as possibly not file I/O related +// Ignoring sys_enter_sched_setparam sys_exit_sched_setparam as possibly not file I/O related +// Ignoring sys_enter_rseq sys_exit_rseq as possibly not file I/O related +// Ignoring sys_enter_request_key sys_exit_request_key as possibly not file I/O related +// Ignoring sys_enter_sched_setaffinity sys_exit_sched_setaffinity as possibly not file I/O related +// Ignoring sys_enter_ustat sys_exit_ustat as possibly not file I/O related +// Ignoring sys_enter_socket sys_exit_socket as possibly not file I/O related +// Ignoring sys_enter_membarrier sys_exit_membarrier as possibly not file I/O related +// Ignoring sys_enter_time sys_exit_time as possibly not file I/O related +// Ignoring sys_enter_socketpair sys_exit_socketpair as possibly not file I/O related +// Ignoring sys_enter_semctl sys_exit_semctl as possibly not file I/O related +// Ignoring sys_enter_bind sys_exit_bind as possibly not file I/O related +// Ignoring sys_enter_kexec_load sys_exit_kexec_load as possibly not file I/O related +// Ignoring sys_enter_init_module sys_exit_init_module as possibly not file I/O related // Ignoring sys_enter_set_mempolicy_home_node sys_exit_set_mempolicy_home_node as possibly not file I/O related -// Ignoring sys_enter_clock_settime sys_exit_clock_settime as possibly not file I/O related -// Ignoring sys_enter_ptrace sys_exit_ptrace as possibly not file I/O related -// Ignoring sys_enter_capget sys_exit_capget as possibly not file I/O related -// Ignoring sys_enter_sendto sys_exit_sendto as possibly not file I/O related -// Ignoring sys_enter_vmsplice sys_exit_vmsplice as possibly not file I/O related -// Ignoring sys_enter_gettid sys_exit_gettid as possibly not file I/O related +// Ignoring sys_enter_futex_wait sys_exit_futex_wait as possibly not file I/O related +// Ignoring sys_enter_lsm_set_self_attr sys_exit_lsm_set_self_attr as possibly not file I/O related +// Ignoring sys_enter_landlock_restrict_self sys_exit_landlock_restrict_self as possibly not file I/O related +// Ignoring sys_enter_iopl sys_exit_iopl as possibly not file I/O related +// Ignoring sys_enter_pipe2 sys_exit_pipe2 as possibly not file I/O related +// Ignoring sys_enter_truncate sys_exit_truncate as possibly not file I/O related +// Ignoring sys_enter_setfsgid sys_exit_setfsgid as possibly not file I/O related +// Ignoring sys_enter_kexec_file_load sys_exit_kexec_file_load as possibly not file I/O related +// Ignoring sys_enter_epoll_create1 sys_exit_epoll_create1 as possibly not file I/O related +// Ignoring sys_enter_getsid sys_exit_getsid as possibly not file I/O related +// Ignoring sys_enter_getppid sys_exit_getppid as possibly not file I/O related // Ignoring sys_enter_waitid sys_exit_waitid as possibly not file I/O related +// Ignoring sys_enter_pkey_free sys_exit_pkey_free as possibly not file I/O related +// Ignoring sys_enter_fadvise64 sys_exit_fadvise64 as possibly not file I/O related +// Ignoring sys_enter_utime sys_exit_utime as possibly not file I/O related +// Ignoring sys_enter_sysfs sys_exit_sysfs as possibly not file I/O related +// Ignoring sys_enter_ptrace sys_exit_ptrace as possibly not file I/O related +// Ignoring sys_enter_exit sys_exit_exit as possibly not file I/O related +// Ignoring sys_enter_getrandom sys_exit_getrandom as possibly not file I/O related +// Ignoring sys_enter_vhangup sys_exit_vhangup as possibly not file I/O related +// Ignoring sys_enter_rt_sigreturn sys_exit_rt_sigreturn as possibly not file I/O related +// Ignoring sys_enter_semop sys_exit_semop as possibly not file I/O related +// Ignoring sys_enter_delete_module sys_exit_delete_module as possibly not file I/O related +// Ignoring sys_enter_mq_timedreceive sys_exit_mq_timedreceive as possibly not file I/O related +// Ignoring sys_enter_fsmount sys_exit_fsmount as possibly not file I/O related +// Ignoring sys_enter_get_robust_list sys_exit_get_robust_list as possibly not file I/O related +// Ignoring sys_enter_mlockall sys_exit_mlockall as possibly not file I/O related +// Ignoring sys_enter_recvmsg sys_exit_recvmsg as possibly not file I/O related +// Ignoring sys_enter_getsockname sys_exit_getsockname as possibly not file I/O related +// Ignoring sys_enter_capset sys_exit_capset as possibly not file I/O related +// Ignoring sys_enter_getgroups sys_exit_getgroups as possibly not file I/O related +// Ignoring sys_enter_setpriority sys_exit_setpriority as possibly not file I/O related +// Ignoring sys_enter_settimeofday sys_exit_settimeofday as possibly not file I/O related // Ignoring sys_enter_getrusage sys_exit_getrusage as possibly not file I/O related -// Ignoring sys_enter_sync sys_exit_sync as possibly not file I/O related -// Ignoring sys_enter_setpgid sys_exit_setpgid as possibly not file I/O related -// Ignoring sys_enter_setitimer sys_exit_setitimer as possibly not file I/O related -// Ignoring sys_enter_getsockopt sys_exit_getsockopt as possibly not file I/O related +// Ignoring sys_enter_epoll_wait sys_exit_epoll_wait as possibly not file I/O related +// Ignoring sys_enter_keyctl sys_exit_keyctl as possibly not file I/O related +// Ignoring sys_enter_mprotect sys_exit_mprotect as possibly not file I/O related +// Ignoring sys_enter_readahead sys_exit_readahead as possibly not file I/O related +// Ignoring sys_enter_prctl sys_exit_prctl as possibly not file I/O related +// Ignoring sys_enter_add_key sys_exit_add_key as possibly not file I/O related +// Ignoring sys_enter_inotify_init1 sys_exit_inotify_init1 as possibly not file I/O related +// Ignoring sys_enter_mmap sys_exit_mmap as possibly not file I/O related +// Ignoring sys_enter_msgctl sys_exit_msgctl as possibly not file I/O related +// Ignoring sys_enter_sched_yield sys_exit_sched_yield as possibly not file I/O related +// Ignoring sys_enter_listmount sys_exit_listmount as possibly not file I/O related +// Ignoring sys_enter_landlock_create_ruleset sys_exit_landlock_create_ruleset as possibly not file I/O related +// Ignoring sys_enter_pkey_mprotect sys_exit_pkey_mprotect as possibly not file I/O related +// Ignoring sys_enter_copy_file_range sys_exit_copy_file_range as possibly not file I/O related +// Ignoring sys_enter_utimes sys_exit_utimes as possibly not file I/O related +// Ignoring sys_enter_clone3 sys_exit_clone3 as possibly not file I/O related +// Ignoring sys_enter_mq_open sys_exit_mq_open as possibly not file I/O related +// Ignoring sys_enter_listen sys_exit_listen as possibly not file I/O related +// Ignoring sys_enter_clock_getres sys_exit_clock_getres as possibly not file I/O related +// Ignoring sys_enter_timer_settime sys_exit_timer_settime as possibly not file I/O related +// Ignoring sys_enter_getgid sys_exit_getgid as possibly not file I/O related +// Ignoring sys_enter_brk sys_exit_brk as possibly not file I/O related +// Ignoring sys_enter_sendto sys_exit_sendto as possibly not file I/O related +// Ignoring sys_enter_ppoll sys_exit_ppoll as possibly not file I/O related +// Ignoring sys_enter_mbind sys_exit_mbind as possibly not file I/O related +// Ignoring sys_enter_signalfd4 sys_exit_signalfd4 as possibly not file I/O related +// Ignoring sys_enter_kcmp sys_exit_kcmp as possibly not file I/O related +// Ignoring sys_enter_epoll_pwait sys_exit_epoll_pwait as possibly not file I/O related +// Ignoring sys_enter_umask sys_exit_umask as possibly not file I/O related +// Ignoring sys_enter_sysinfo sys_exit_sysinfo as possibly not file I/O related +// Ignoring sys_enter_mq_timedsend sys_exit_mq_timedsend as possibly not file I/O related +// Ignoring sys_enter_userfaultfd sys_exit_userfaultfd as possibly not file I/O related +// Ignoring sys_enter_shmget sys_exit_shmget as possibly not file I/O related +// Ignoring sys_enter_pwritev2 sys_exit_pwritev2 as possibly not file I/O related +// Ignoring sys_enter_adjtimex sys_exit_adjtimex as possibly not file I/O related +// Ignoring sys_enter_tgkill sys_exit_tgkill as possibly not file I/O related +// Ignoring sys_enter_process_vm_readv sys_exit_process_vm_readv as possibly not file I/O related +// Ignoring sys_enter_accept sys_exit_accept as possibly not file I/O related +// Ignoring sys_enter_pselect6 sys_exit_pselect6 as possibly not file I/O related +// Ignoring sys_enter_getpgid sys_exit_getpgid as possibly not file I/O related +// Ignoring sys_enter_memfd_secret sys_exit_memfd_secret as possibly not file I/O related -#define SYS_ENTER_IO_URING_REGISTER 1485 -#define SYS_EXIT_IO_URING_REGISTER 1484 -#define SYS_ENTER_IO_URING_ENTER 1466 -#define SYS_EXIT_IO_URING_ENTER 1465 -#define SYS_ENTER_QUOTACTL_FD 1127 -#define SYS_EXIT_QUOTACTL_FD 1126 -#define SYS_ENTER_FLOCK 1096 -#define SYS_EXIT_FLOCK 1095 -#define SYS_ENTER_FANOTIFY_MARK 1038 -#define SYS_EXIT_FANOTIFY_MARK 1037 -#define SYS_ENTER_INOTIFY_ADD_WATCH 1032 -#define SYS_EXIT_INOTIFY_ADD_WATCH 1031 -#define SYS_ENTER_STATFS 1022 -#define SYS_EXIT_STATFS 1021 -#define SYS_ENTER_FSTATFS 1020 -#define SYS_EXIT_FSTATFS 1019 -#define SYS_ENTER_UTIMENSAT 1014 -#define SYS_EXIT_UTIMENSAT 1013 -#define SYS_ENTER_FUTIMESAT 1012 -#define SYS_EXIT_FUTIMESAT 1011 -#define SYS_ENTER_FSYNC 1002 -#define SYS_EXIT_FSYNC 1001 -#define SYS_ENTER_FDATASYNC 1000 -#define SYS_EXIT_FDATASYNC 999 -#define SYS_ENTER_SETXATTR 958 -#define SYS_EXIT_SETXATTR 957 -#define SYS_ENTER_LSETXATTR 956 -#define SYS_EXIT_LSETXATTR 955 -#define SYS_ENTER_GETXATTR 952 -#define SYS_EXIT_GETXATTR 951 -#define SYS_ENTER_LGETXATTR 950 -#define SYS_EXIT_LGETXATTR 949 -#define SYS_ENTER_LISTXATTR 946 -#define SYS_EXIT_LISTXATTR 945 -#define SYS_ENTER_LLISTXATTR 944 -#define SYS_EXIT_LLISTXATTR 943 -#define SYS_ENTER_REMOVEXATTR 940 -#define SYS_EXIT_REMOVEXATTR 939 -#define SYS_ENTER_LREMOVEXATTR 938 -#define SYS_EXIT_LREMOVEXATTR 937 -#define SYS_ENTER_OPEN_TREE 932 -#define SYS_EXIT_OPEN_TREE 931 -#define SYS_ENTER_GETDENTS 900 -#define SYS_EXIT_GETDENTS 899 -#define SYS_ENTER_GETDENTS64 898 -#define SYS_EXIT_GETDENTS64 897 -#define SYS_ENTER_IOCTL 896 -#define SYS_EXIT_IOCTL 895 -#define SYS_ENTER_FCNTL 894 -#define SYS_EXIT_FCNTL 893 -#define SYS_ENTER_MKNODAT 892 -#define SYS_EXIT_MKNODAT 891 -#define SYS_ENTER_MKNOD 890 -#define SYS_EXIT_MKNOD 889 -#define SYS_ENTER_MKDIRAT 888 -#define SYS_EXIT_MKDIRAT 887 -#define SYS_ENTER_MKDIR 886 -#define SYS_EXIT_MKDIR 885 -#define SYS_ENTER_RMDIR 884 -#define SYS_EXIT_RMDIR 883 -#define SYS_ENTER_UNLINKAT 882 -#define SYS_EXIT_UNLINKAT 881 -#define SYS_ENTER_UNLINK 880 -#define SYS_EXIT_UNLINK 879 -#define SYS_ENTER_SYMLINKAT 878 -#define SYS_EXIT_SYMLINKAT 877 -#define SYS_ENTER_SYMLINK 876 -#define SYS_EXIT_SYMLINK 875 -#define SYS_ENTER_LINKAT 874 -#define SYS_EXIT_LINKAT 873 -#define SYS_ENTER_LINK 872 -#define SYS_EXIT_LINK 871 -#define SYS_ENTER_RENAMEAT2 870 -#define SYS_EXIT_RENAMEAT2 869 -#define SYS_ENTER_RENAMEAT 868 -#define SYS_EXIT_RENAMEAT 867 -#define SYS_ENTER_RENAME 866 -#define SYS_EXIT_RENAME 865 -#define SYS_ENTER_EXECVE 860 -#define SYS_EXIT_EXECVE 859 -#define SYS_ENTER_EXECVEAT 858 -#define SYS_EXIT_EXECVEAT 857 -#define SYS_ENTER_NEWSTAT 856 -#define SYS_EXIT_NEWSTAT 855 -#define SYS_ENTER_NEWLSTAT 854 -#define SYS_EXIT_NEWLSTAT 853 -#define SYS_ENTER_NEWFSTATAT 852 -#define SYS_EXIT_NEWFSTATAT 851 -#define SYS_ENTER_NEWFSTAT 850 -#define SYS_EXIT_NEWFSTAT 849 -#define SYS_ENTER_READLINKAT 848 -#define SYS_EXIT_READLINKAT 847 -#define SYS_ENTER_STATX 844 -#define SYS_EXIT_STATX 843 -#define SYS_ENTER_LSEEK 842 -#define SYS_EXIT_LSEEK 841 -#define SYS_ENTER_READ 840 -#define SYS_EXIT_READ 839 -#define SYS_ENTER_WRITE 838 -#define SYS_EXIT_WRITE 837 -#define SYS_ENTER_PREAD64 836 -#define SYS_EXIT_PREAD64 835 -#define SYS_ENTER_PWRITE64 834 -#define SYS_EXIT_PWRITE64 833 -#define SYS_ENTER_FTRUNCATE 814 -#define SYS_EXIT_FTRUNCATE 813 -#define SYS_ENTER_FACCESSAT 810 -#define SYS_EXIT_FACCESSAT 809 -#define SYS_ENTER_FACCESSAT2 808 -#define SYS_EXIT_FACCESSAT2 807 -#define SYS_ENTER_ACCESS 806 -#define SYS_EXIT_ACCESS 805 -#define SYS_ENTER_CHDIR 804 -#define SYS_EXIT_CHDIR 803 -#define SYS_ENTER_FCHDIR 802 -#define SYS_EXIT_FCHDIR 801 -#define SYS_ENTER_CHROOT 800 -#define SYS_EXIT_CHROOT 799 -#define SYS_ENTER_FCHMOD 798 -#define SYS_EXIT_FCHMOD 797 -#define SYS_ENTER_FCHMODAT2 796 -#define SYS_EXIT_FCHMODAT2 795 -#define SYS_ENTER_FCHMODAT 794 -#define SYS_EXIT_FCHMODAT 793 -#define SYS_ENTER_CHMOD 792 -#define SYS_EXIT_CHMOD 791 -#define SYS_ENTER_FCHOWNAT 790 -#define SYS_EXIT_FCHOWNAT 789 -#define SYS_ENTER_CHOWN 788 -#define SYS_EXIT_CHOWN 787 -#define SYS_ENTER_LCHOWN 786 -#define SYS_EXIT_LCHOWN 785 -#define SYS_ENTER_FCHOWN 784 -#define SYS_EXIT_FCHOWN 783 -#define SYS_ENTER_OPEN 782 -#define SYS_EXIT_OPEN 781 -#define SYS_ENTER_OPENAT 780 -#define SYS_EXIT_OPENAT 779 -#define SYS_ENTER_OPENAT2 778 -#define SYS_EXIT_OPENAT2 777 -#define SYS_ENTER_CREAT 776 -#define SYS_EXIT_CREAT 775 -#define SYS_ENTER_CLOSE 774 -#define SYS_EXIT_CLOSE 773 -#define SYS_ENTER_CLOSE_RANGE 772 -#define SYS_EXIT_CLOSE_RANGE 771 -#define SYS_ENTER_CACHESTAT 592 -#define SYS_EXIT_CACHESTAT 591 +#define SYS_ENTER_IO_URING_REGISTER 1513 +#define SYS_EXIT_IO_URING_REGISTER 1512 +#define SYS_ENTER_IO_URING_ENTER 1494 +#define SYS_EXIT_IO_URING_ENTER 1493 +#define SYS_ENTER_QUOTACTL 1153 +#define SYS_EXIT_QUOTACTL 1152 +#define SYS_ENTER_QUOTACTL_FD 1151 +#define SYS_EXIT_QUOTACTL_FD 1150 +#define SYS_ENTER_FLOCK 1120 +#define SYS_EXIT_FLOCK 1119 +#define SYS_ENTER_FANOTIFY_MARK 1062 +#define SYS_EXIT_FANOTIFY_MARK 1061 +#define SYS_ENTER_INOTIFY_ADD_WATCH 1056 +#define SYS_EXIT_INOTIFY_ADD_WATCH 1055 +#define SYS_ENTER_FSCONFIG 1048 +#define SYS_EXIT_FSCONFIG 1047 +#define SYS_ENTER_STATFS 1046 +#define SYS_EXIT_STATFS 1045 +#define SYS_ENTER_FSTATFS 1044 +#define SYS_EXIT_FSTATFS 1043 +#define SYS_ENTER_UTIMENSAT 1038 +#define SYS_EXIT_UTIMENSAT 1037 +#define SYS_ENTER_FUTIMESAT 1036 +#define SYS_EXIT_FUTIMESAT 1035 +#define SYS_ENTER_FSYNC 1026 +#define SYS_EXIT_FSYNC 1025 +#define SYS_ENTER_FDATASYNC 1024 +#define SYS_EXIT_FDATASYNC 1023 +#define SYS_ENTER_SETXATTRAT 982 +#define SYS_EXIT_SETXATTRAT 981 +#define SYS_ENTER_SETXATTR 980 +#define SYS_EXIT_SETXATTR 979 +#define SYS_ENTER_LSETXATTR 978 +#define SYS_EXIT_LSETXATTR 977 +#define SYS_ENTER_GETXATTRAT 974 +#define SYS_EXIT_GETXATTRAT 973 +#define SYS_ENTER_GETXATTR 972 +#define SYS_EXIT_GETXATTR 971 +#define SYS_ENTER_LGETXATTR 970 +#define SYS_EXIT_LGETXATTR 969 +#define SYS_ENTER_LISTXATTRAT 966 +#define SYS_EXIT_LISTXATTRAT 965 +#define SYS_ENTER_LISTXATTR 964 +#define SYS_EXIT_LISTXATTR 963 +#define SYS_ENTER_LLISTXATTR 962 +#define SYS_EXIT_LLISTXATTR 961 +#define SYS_ENTER_REMOVEXATTRAT 958 +#define SYS_EXIT_REMOVEXATTRAT 957 +#define SYS_ENTER_REMOVEXATTR 956 +#define SYS_EXIT_REMOVEXATTR 955 +#define SYS_ENTER_LREMOVEXATTR 954 +#define SYS_EXIT_LREMOVEXATTR 953 +#define SYS_ENTER_OPEN_TREE 948 +#define SYS_EXIT_OPEN_TREE 947 +#define SYS_ENTER_CLOSE_RANGE 930 +#define SYS_EXIT_CLOSE_RANGE 929 +#define SYS_ENTER_GETDENTS 910 +#define SYS_EXIT_GETDENTS 909 +#define SYS_ENTER_GETDENTS64 908 +#define SYS_EXIT_GETDENTS64 907 +#define SYS_ENTER_IOCTL 906 +#define SYS_EXIT_IOCTL 905 +#define SYS_ENTER_FCNTL 904 +#define SYS_EXIT_FCNTL 903 +#define SYS_ENTER_MKNODAT 902 +#define SYS_EXIT_MKNODAT 901 +#define SYS_ENTER_MKNOD 900 +#define SYS_EXIT_MKNOD 899 +#define SYS_ENTER_MKDIRAT 898 +#define SYS_EXIT_MKDIRAT 897 +#define SYS_ENTER_MKDIR 896 +#define SYS_EXIT_MKDIR 895 +#define SYS_ENTER_RMDIR 894 +#define SYS_EXIT_RMDIR 893 +#define SYS_ENTER_UNLINKAT 892 +#define SYS_EXIT_UNLINKAT 891 +#define SYS_ENTER_UNLINK 890 +#define SYS_EXIT_UNLINK 889 +#define SYS_ENTER_SYMLINKAT 888 +#define SYS_EXIT_SYMLINKAT 887 +#define SYS_ENTER_SYMLINK 886 +#define SYS_EXIT_SYMLINK 885 +#define SYS_ENTER_LINKAT 884 +#define SYS_EXIT_LINKAT 883 +#define SYS_ENTER_LINK 882 +#define SYS_EXIT_LINK 881 +#define SYS_ENTER_RENAMEAT2 880 +#define SYS_EXIT_RENAMEAT2 879 +#define SYS_ENTER_RENAMEAT 878 +#define SYS_EXIT_RENAMEAT 877 +#define SYS_ENTER_RENAME 876 +#define SYS_EXIT_RENAME 875 +#define SYS_ENTER_EXECVE 870 +#define SYS_EXIT_EXECVE 869 +#define SYS_ENTER_EXECVEAT 868 +#define SYS_EXIT_EXECVEAT 867 +#define SYS_ENTER_NEWSTAT 866 +#define SYS_EXIT_NEWSTAT 865 +#define SYS_ENTER_NEWLSTAT 864 +#define SYS_EXIT_NEWLSTAT 863 +#define SYS_ENTER_NEWFSTATAT 862 +#define SYS_EXIT_NEWFSTATAT 861 +#define SYS_ENTER_NEWFSTAT 860 +#define SYS_EXIT_NEWFSTAT 859 +#define SYS_ENTER_READLINKAT 858 +#define SYS_EXIT_READLINKAT 857 +#define SYS_ENTER_STATX 854 +#define SYS_EXIT_STATX 853 +#define SYS_ENTER_LSEEK 852 +#define SYS_EXIT_LSEEK 851 +#define SYS_ENTER_READ 850 +#define SYS_EXIT_READ 849 +#define SYS_ENTER_WRITE 848 +#define SYS_EXIT_WRITE 847 +#define SYS_ENTER_PREAD64 846 +#define SYS_EXIT_PREAD64 845 +#define SYS_ENTER_PWRITE64 844 +#define SYS_EXIT_PWRITE64 843 +#define SYS_ENTER_FTRUNCATE 824 +#define SYS_EXIT_FTRUNCATE 823 +#define SYS_ENTER_FACCESSAT 820 +#define SYS_EXIT_FACCESSAT 819 +#define SYS_ENTER_FACCESSAT2 818 +#define SYS_EXIT_FACCESSAT2 817 +#define SYS_ENTER_ACCESS 816 +#define SYS_EXIT_ACCESS 815 +#define SYS_ENTER_CHDIR 814 +#define SYS_EXIT_CHDIR 813 +#define SYS_ENTER_FCHDIR 812 +#define SYS_EXIT_FCHDIR 811 +#define SYS_ENTER_CHROOT 810 +#define SYS_EXIT_CHROOT 809 +#define SYS_ENTER_FCHMOD 808 +#define SYS_EXIT_FCHMOD 807 +#define SYS_ENTER_FCHMODAT2 806 +#define SYS_EXIT_FCHMODAT2 805 +#define SYS_ENTER_FCHMODAT 804 +#define SYS_EXIT_FCHMODAT 803 +#define SYS_ENTER_CHMOD 802 +#define SYS_EXIT_CHMOD 801 +#define SYS_ENTER_FCHOWNAT 800 +#define SYS_EXIT_FCHOWNAT 799 +#define SYS_ENTER_CHOWN 798 +#define SYS_EXIT_CHOWN 797 +#define SYS_ENTER_LCHOWN 796 +#define SYS_EXIT_LCHOWN 795 +#define SYS_ENTER_FCHOWN 794 +#define SYS_EXIT_FCHOWN 793 +#define SYS_ENTER_OPEN 792 +#define SYS_EXIT_OPEN 791 +#define SYS_ENTER_OPENAT 790 +#define SYS_EXIT_OPENAT 789 +#define SYS_ENTER_OPENAT2 788 +#define SYS_EXIT_OPENAT2 787 +#define SYS_ENTER_CREAT 786 +#define SYS_EXIT_CREAT 785 +#define SYS_ENTER_CLOSE 784 +#define SYS_EXIT_CLOSE 783 +#define SYS_ENTER_CACHESTAT 599 +#define SYS_EXIT_CACHESTAT 598 +#define SYS_ENTER_REBOOT 281 +#define SYS_EXIT_REBOOT 280 SEC("tracepoint/syscalls/sys_enter_io_uring_register") int handle_sys_enter_io_uring_register(struct trace_event_raw_sys_enter *ctx) { @@ -518,22 +529,68 @@ int handle_sys_exit_io_uring_enter(struct trace_event_raw_sys_exit *ctx) { return 0; } +SEC("tracepoint/syscalls/sys_enter_quotactl") +int handle_sys_enter_quotactl(struct trace_event_raw_sys_enter *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct fcntl_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fcntl_event), 0); + if (!ev) + return 0; + + ev->event_type = ENTER_FCNTL_EVENT; + ev->trace_id = SYS_ENTER_QUOTACTL; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_boot_ns(); + ev->fd = ctx->args[-1]; + ev->cmd = ctx->args[0]; + ev->arg = ctx->args[-1]; + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_exit_quotactl") +int handle_sys_exit_quotactl(struct trace_event_raw_sys_exit *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); + if (!ev) + return 0; + + ev->event_type = EXIT_RET_EVENT; + ev->trace_id = SYS_EXIT_QUOTACTL; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_boot_ns(); + ev->ret = ctx->ret; + + bpf_ringbuf_submit(ev, 0); + return 0; +} + SEC("tracepoint/syscalls/sys_enter_quotactl_fd") int handle_sys_enter_quotactl_fd(struct trace_event_raw_sys_enter *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; - struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0); + struct fcntl_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fcntl_event), 0); if (!ev) return 0; - ev->event_type = ENTER_FD_EVENT; + ev->event_type = ENTER_FCNTL_EVENT; ev->trace_id = SYS_ENTER_QUOTACTL_FD; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_boot_ns(); - ev->fd = (__s32)ctx->args[0]; + ev->fd = ctx->args[0]; + ev->cmd = ctx->args[1]; + ev->arg = ctx->args[-1]; bpf_ringbuf_submit(ev, 0); return 0; @@ -566,16 +623,18 @@ int handle_sys_enter_flock(struct trace_event_raw_sys_enter *ctx) { if (filter(&pid, &tid)) return 0; - struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0); + struct fcntl_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fcntl_event), 0); if (!ev) return 0; - ev->event_type = ENTER_FD_EVENT; + ev->event_type = ENTER_FCNTL_EVENT; ev->trace_id = SYS_ENTER_FLOCK; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_boot_ns(); - ev->fd = (__s32)ctx->args[0]; + ev->fd = ctx->args[0]; + ev->cmd = ctx->args[1]; + ev->arg = ctx->args[-1]; bpf_ringbuf_submit(ev, 0); return 0; @@ -688,6 +747,50 @@ int handle_sys_exit_inotify_add_watch(struct trace_event_raw_sys_exit *ctx) { return 0; } +SEC("tracepoint/syscalls/sys_enter_fsconfig") +int handle_sys_enter_fsconfig(struct trace_event_raw_sys_enter *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct fcntl_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fcntl_event), 0); + if (!ev) + return 0; + + ev->event_type = ENTER_FCNTL_EVENT; + ev->trace_id = SYS_ENTER_FSCONFIG; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_boot_ns(); + ev->fd = ctx->args[0]; + ev->cmd = ctx->args[1]; + ev->arg = ctx->args[-1]; + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_exit_fsconfig") +int handle_sys_exit_fsconfig(struct trace_event_raw_sys_exit *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); + if (!ev) + return 0; + + ev->event_type = EXIT_RET_EVENT; + ev->trace_id = SYS_EXIT_FSCONFIG; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_boot_ns(); + ev->ret = ctx->ret; + + bpf_ringbuf_submit(ev, 0); + return 0; +} + SEC("tracepoint/syscalls/sys_enter_statfs") int handle_sys_enter_statfs(struct trace_event_raw_sys_enter *ctx) { __u32 pid, tid; @@ -947,6 +1050,49 @@ int handle_sys_exit_fdatasync(struct trace_event_raw_sys_exit *ctx) { return 0; } +SEC("tracepoint/syscalls/sys_enter_setxattrat") +int handle_sys_enter_setxattrat(struct trace_event_raw_sys_enter *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0); + if (!ev) + return 0; + + ev->event_type = ENTER_PATH_EVENT; + ev->trace_id = SYS_ENTER_SETXATTRAT; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_boot_ns(); + __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname)); + bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[1]); + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_exit_setxattrat") +int handle_sys_exit_setxattrat(struct trace_event_raw_sys_exit *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); + if (!ev) + return 0; + + ev->event_type = EXIT_RET_EVENT; + ev->trace_id = SYS_EXIT_SETXATTRAT; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_boot_ns(); + ev->ret = ctx->ret; + + bpf_ringbuf_submit(ev, 0); + return 0; +} + SEC("tracepoint/syscalls/sys_enter_setxattr") int handle_sys_enter_setxattr(struct trace_event_raw_sys_enter *ctx) { __u32 pid, tid; @@ -1033,6 +1179,49 @@ int handle_sys_exit_lsetxattr(struct trace_event_raw_sys_exit *ctx) { return 0; } +SEC("tracepoint/syscalls/sys_enter_getxattrat") +int handle_sys_enter_getxattrat(struct trace_event_raw_sys_enter *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0); + if (!ev) + return 0; + + ev->event_type = ENTER_PATH_EVENT; + ev->trace_id = SYS_ENTER_GETXATTRAT; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_boot_ns(); + __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname)); + bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[1]); + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_exit_getxattrat") +int handle_sys_exit_getxattrat(struct trace_event_raw_sys_exit *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); + if (!ev) + return 0; + + ev->event_type = EXIT_RET_EVENT; + ev->trace_id = SYS_EXIT_GETXATTRAT; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_boot_ns(); + ev->ret = ctx->ret; + + bpf_ringbuf_submit(ev, 0); + return 0; +} + SEC("tracepoint/syscalls/sys_enter_getxattr") int handle_sys_enter_getxattr(struct trace_event_raw_sys_enter *ctx) { __u32 pid, tid; @@ -1119,6 +1308,49 @@ int handle_sys_exit_lgetxattr(struct trace_event_raw_sys_exit *ctx) { return 0; } +SEC("tracepoint/syscalls/sys_enter_listxattrat") +int handle_sys_enter_listxattrat(struct trace_event_raw_sys_enter *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0); + if (!ev) + return 0; + + ev->event_type = ENTER_PATH_EVENT; + ev->trace_id = SYS_ENTER_LISTXATTRAT; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_boot_ns(); + __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname)); + bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[1]); + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_exit_listxattrat") +int handle_sys_exit_listxattrat(struct trace_event_raw_sys_exit *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); + if (!ev) + return 0; + + ev->event_type = EXIT_RET_EVENT; + ev->trace_id = SYS_EXIT_LISTXATTRAT; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_boot_ns(); + ev->ret = ctx->ret; + + bpf_ringbuf_submit(ev, 0); + return 0; +} + SEC("tracepoint/syscalls/sys_enter_listxattr") int handle_sys_enter_listxattr(struct trace_event_raw_sys_enter *ctx) { __u32 pid, tid; @@ -1205,6 +1437,49 @@ int handle_sys_exit_llistxattr(struct trace_event_raw_sys_exit *ctx) { return 0; } +SEC("tracepoint/syscalls/sys_enter_removexattrat") +int handle_sys_enter_removexattrat(struct trace_event_raw_sys_enter *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0); + if (!ev) + return 0; + + ev->event_type = ENTER_PATH_EVENT; + ev->trace_id = SYS_ENTER_REMOVEXATTRAT; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_boot_ns(); + __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname)); + bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[1]); + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_exit_removexattrat") +int handle_sys_exit_removexattrat(struct trace_event_raw_sys_exit *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); + if (!ev) + return 0; + + ev->event_type = EXIT_RET_EVENT; + ev->trace_id = SYS_EXIT_REMOVEXATTRAT; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_boot_ns(); + ev->ret = ctx->ret; + + bpf_ringbuf_submit(ev, 0); + return 0; +} + SEC("tracepoint/syscalls/sys_enter_removexattr") int handle_sys_enter_removexattr(struct trace_event_raw_sys_enter *ctx) { __u32 pid, tid; @@ -1336,6 +1611,48 @@ int handle_sys_exit_open_tree(struct trace_event_raw_sys_exit *ctx) { return 0; } +SEC("tracepoint/syscalls/sys_enter_close_range") +int handle_sys_enter_close_range(struct trace_event_raw_sys_enter *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0); + if (!ev) + return 0; + + ev->event_type = ENTER_FD_EVENT; + ev->trace_id = SYS_ENTER_CLOSE_RANGE; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_boot_ns(); + ev->fd = (__s32)ctx->args[0]; + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_exit_close_range") +int handle_sys_exit_close_range(struct trace_event_raw_sys_exit *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); + if (!ev) + return 0; + + ev->event_type = EXIT_RET_EVENT; + ev->trace_id = SYS_EXIT_CLOSE_RANGE; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_boot_ns(); + ev->ret = ctx->ret; + + bpf_ringbuf_submit(ev, 0); + return 0; +} + SEC("tracepoint/syscalls/sys_enter_getdents") int handle_sys_enter_getdents(struct trace_event_raw_sys_enter *ctx) { __u32 pid, tid; @@ -1426,16 +1743,18 @@ int handle_sys_enter_ioctl(struct trace_event_raw_sys_enter *ctx) { if (filter(&pid, &tid)) return 0; - struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0); + struct fcntl_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fcntl_event), 0); if (!ev) return 0; - ev->event_type = ENTER_FD_EVENT; + ev->event_type = ENTER_FCNTL_EVENT; ev->trace_id = SYS_ENTER_IOCTL; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_boot_ns(); - ev->fd = (__s32)ctx->args[0]; + ev->fd = ctx->args[0]; + ev->cmd = ctx->args[1]; + ev->arg = ctx->args[2]; bpf_ringbuf_submit(ev, 0); return 0; @@ -1468,16 +1787,18 @@ int handle_sys_enter_fcntl(struct trace_event_raw_sys_enter *ctx) { if (filter(&pid, &tid)) return 0; - struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0); + struct fcntl_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fcntl_event), 0); if (!ev) return 0; - ev->event_type = ENTER_FD_EVENT; + ev->event_type = ENTER_FCNTL_EVENT; ev->trace_id = SYS_ENTER_FCNTL; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_boot_ns(); - ev->fd = (__s32)ctx->args[0]; + ev->fd = ctx->args[0]; + ev->cmd = ctx->args[1]; + ev->arg = ctx->args[2]; bpf_ringbuf_submit(ev, 0); return 0; @@ -3565,8 +3886,8 @@ int handle_sys_exit_close(struct trace_event_raw_sys_exit *ctx) { return 0; } -SEC("tracepoint/syscalls/sys_enter_close_range") -int handle_sys_enter_close_range(struct trace_event_raw_sys_enter *ctx) { +SEC("tracepoint/syscalls/sys_enter_cachestat") +int handle_sys_enter_cachestat(struct trace_event_raw_sys_enter *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -3576,7 +3897,7 @@ int handle_sys_enter_close_range(struct trace_event_raw_sys_enter *ctx) { return 0; ev->event_type = ENTER_FD_EVENT; - ev->trace_id = SYS_ENTER_CLOSE_RANGE; + ev->trace_id = SYS_ENTER_CACHESTAT; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_boot_ns(); @@ -3586,8 +3907,8 @@ int handle_sys_enter_close_range(struct trace_event_raw_sys_enter *ctx) { return 0; } -SEC("tracepoint/syscalls/sys_exit_close_range") -int handle_sys_exit_close_range(struct trace_event_raw_sys_exit *ctx) { +SEC("tracepoint/syscalls/sys_exit_cachestat") +int handle_sys_exit_cachestat(struct trace_event_raw_sys_exit *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -3597,7 +3918,7 @@ int handle_sys_exit_close_range(struct trace_event_raw_sys_exit *ctx) { return 0; ev->event_type = EXIT_RET_EVENT; - ev->trace_id = SYS_EXIT_CLOSE_RANGE; + ev->trace_id = SYS_EXIT_CACHESTAT; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_boot_ns(); @@ -3607,29 +3928,31 @@ int handle_sys_exit_close_range(struct trace_event_raw_sys_exit *ctx) { return 0; } -SEC("tracepoint/syscalls/sys_enter_cachestat") -int handle_sys_enter_cachestat(struct trace_event_raw_sys_enter *ctx) { +SEC("tracepoint/syscalls/sys_enter_reboot") +int handle_sys_enter_reboot(struct trace_event_raw_sys_enter *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; - struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0); + struct fcntl_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fcntl_event), 0); if (!ev) return 0; - ev->event_type = ENTER_FD_EVENT; - ev->trace_id = SYS_ENTER_CACHESTAT; + ev->event_type = ENTER_FCNTL_EVENT; + ev->trace_id = SYS_ENTER_REBOOT; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_boot_ns(); - ev->fd = (__s32)ctx->args[0]; + ev->fd = ctx->args[-1]; + ev->cmd = ctx->args[2]; + ev->arg = ctx->args[3]; bpf_ringbuf_submit(ev, 0); return 0; } -SEC("tracepoint/syscalls/sys_exit_cachestat") -int handle_sys_exit_cachestat(struct trace_event_raw_sys_exit *ctx) { +SEC("tracepoint/syscalls/sys_exit_reboot") +int handle_sys_exit_reboot(struct trace_event_raw_sys_exit *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -3639,7 +3962,7 @@ int handle_sys_exit_cachestat(struct trace_event_raw_sys_exit *ctx) { return 0; ev->event_type = EXIT_RET_EVENT; - ev->trace_id = SYS_EXIT_CACHESTAT; + ev->trace_id = SYS_EXIT_REBOOT; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_boot_ns(); diff --git a/internal/c/types.h b/internal/c/types.h index 01f1dd2..980578a 100644 --- a/internal/c/types.h +++ b/internal/c/types.h @@ -15,6 +15,8 @@ #define EXIT_NAME_EVENT 10 #define ENTER_PATH_EVENT 11 #define EXIT_PATH_EVENT 12 +#define ENTER_FCNTL_EVENT 13 +#define EXIT_FCNTL_EVENT 14 struct open_event { __u32 event_type; @@ -71,3 +73,14 @@ struct path_event { __u32 tid; char pathname[MAX_FILENAME_LENGTH]; }; + +struct fcntl_event { + __u32 event_type; + __u32 trace_id; + __u64 time; + __u32 pid; + __u32 tid; + __u32 fd; + __u32 cmd; + __u64 arg; +}; diff --git a/internal/flamegraph/collapsed.go b/internal/flamegraph/collapsed.go index 3b2f636..2c3e05a 100644 --- a/internal/flamegraph/collapsed.go +++ b/internal/flamegraph/collapsed.go @@ -18,6 +18,11 @@ func (c *counter) merge(other counter) { c.duration += other.duration } +// TODO: make it generic, generate multiple trace points +// path, traceid (syscall name), comm, pid, tid +// traceid, path is by default set in this order +// store an intermediate format which then can be converted to the others... +// e.g. path / traceid / comm / pid / tid / counter type collapsed map[string]map[types.TraceId]counter // TODO: Unit test this diff --git a/internal/tracepoints/generated_tracepoints.go b/internal/tracepoints/generated_tracepoints.go index 2b615b7..c9fce03 100644 --- a/internal/tracepoints/generated_tracepoints.go +++ b/internal/tracepoints/generated_tracepoints.go @@ -6,6 +6,8 @@ var List = []string{ "sys_exit_io_uring_register", "sys_enter_io_uring_enter", "sys_exit_io_uring_enter", + "sys_enter_quotactl", + "sys_exit_quotactl", "sys_enter_quotactl_fd", "sys_exit_quotactl_fd", "sys_enter_flock", @@ -14,6 +16,8 @@ var List = []string{ "sys_exit_fanotify_mark", "sys_enter_inotify_add_watch", "sys_exit_inotify_add_watch", + "sys_enter_fsconfig", + "sys_exit_fsconfig", "sys_enter_statfs", "sys_exit_statfs", "sys_enter_fstatfs", @@ -26,24 +30,34 @@ var List = []string{ "sys_exit_fsync", "sys_enter_fdatasync", "sys_exit_fdatasync", + "sys_enter_setxattrat", + "sys_exit_setxattrat", "sys_enter_setxattr", "sys_exit_setxattr", "sys_enter_lsetxattr", "sys_exit_lsetxattr", + "sys_enter_getxattrat", + "sys_exit_getxattrat", "sys_enter_getxattr", "sys_exit_getxattr", "sys_enter_lgetxattr", "sys_exit_lgetxattr", + "sys_enter_listxattrat", + "sys_exit_listxattrat", "sys_enter_listxattr", "sys_exit_listxattr", "sys_enter_llistxattr", "sys_exit_llistxattr", + "sys_enter_removexattrat", + "sys_exit_removexattrat", "sys_enter_removexattr", "sys_exit_removexattr", "sys_enter_lremovexattr", "sys_exit_lremovexattr", "sys_enter_open_tree", "sys_exit_open_tree", + "sys_enter_close_range", + "sys_exit_close_range", "sys_enter_getdents", "sys_exit_getdents", "sys_enter_getdents64", @@ -146,8 +160,8 @@ var List = []string{ "sys_exit_creat", "sys_enter_close", "sys_exit_close", - "sys_enter_close_range", - "sys_exit_close_range", "sys_enter_cachestat", "sys_exit_cachestat", + "sys_enter_reboot", + "sys_exit_reboot", } diff --git a/internal/types/generated_types.go b/internal/types/generated_types.go index bc202ed..fdcfa62 100644 --- a/internal/types/generated_types.go +++ b/internal/types/generated_types.go @@ -12,11 +12,11 @@ type EventType uint32 type TraceId uint32 var traceId2String = map[TraceId]string{ - 1485: "enter_io_uring_register", 1484: "exit_io_uring_register", 1466: "enter_io_uring_enter", 1465: "exit_io_uring_enter", 1127: "enter_quotactl_fd", 1126: "exit_quotactl_fd", 1096: "enter_flock", 1095: "exit_flock", 1038: "enter_fanotify_mark", 1037: "exit_fanotify_mark", 1032: "enter_inotify_add_watch", 1031: "exit_inotify_add_watch", 1022: "enter_statfs", 1021: "exit_statfs", 1020: "enter_fstatfs", 1019: "exit_fstatfs", 1014: "enter_utimensat", 1013: "exit_utimensat", 1012: "enter_futimesat", 1011: "exit_futimesat", 1002: "enter_fsync", 1001: "exit_fsync", 1000: "enter_fdatasync", 999: "exit_fdatasync", 958: "enter_setxattr", 957: "exit_setxattr", 956: "enter_lsetxattr", 955: "exit_lsetxattr", 952: "enter_getxattr", 951: "exit_getxattr", 950: "enter_lgetxattr", 949: "exit_lgetxattr", 946: "enter_listxattr", 945: "exit_listxattr", 944: "enter_llistxattr", 943: "exit_llistxattr", 940: "enter_removexattr", 939: "exit_removexattr", 938: "enter_lremovexattr", 937: "exit_lremovexattr", 932: "enter_open_tree", 931: "exit_open_tree", 900: "enter_getdents", 899: "exit_getdents", 898: "enter_getdents64", 897: "exit_getdents64", 896: "enter_ioctl", 895: "exit_ioctl", 894: "enter_fcntl", 893: "exit_fcntl", 892: "enter_mknodat", 891: "exit_mknodat", 890: "enter_mknod", 889: "exit_mknod", 888: "enter_mkdirat", 887: "exit_mkdirat", 886: "enter_mkdir", 885: "exit_mkdir", 884: "enter_rmdir", 883: "exit_rmdir", 882: "enter_unlinkat", 881: "exit_unlinkat", 880: "enter_unlink", 879: "exit_unlink", 878: "enter_symlinkat", 877: "exit_symlinkat", 876: "enter_symlink", 875: "exit_symlink", 874: "enter_linkat", 873: "exit_linkat", 872: "enter_link", 871: "exit_link", 870: "enter_renameat2", 869: "exit_renameat2", 868: "enter_renameat", 867: "exit_renameat", 866: "enter_rename", 865: "exit_rename", 860: "enter_execve", 859: "exit_execve", 858: "enter_execveat", 857: "exit_execveat", 856: "enter_newstat", 855: "exit_newstat", 854: "enter_newlstat", 853: "exit_newlstat", 852: "enter_newfstatat", 851: "exit_newfstatat", 850: "enter_newfstat", 849: "exit_newfstat", 848: "enter_readlinkat", 847: "exit_readlinkat", 844: "enter_statx", 843: "exit_statx", 842: "enter_lseek", 841: "exit_lseek", 840: "enter_read", 839: "exit_read", 838: "enter_write", 837: "exit_write", 836: "enter_pread64", 835: "exit_pread64", 834: "enter_pwrite64", 833: "exit_pwrite64", 814: "enter_ftruncate", 813: "exit_ftruncate", 810: "enter_faccessat", 809: "exit_faccessat", 808: "enter_faccessat2", 807: "exit_faccessat2", 806: "enter_access", 805: "exit_access", 804: "enter_chdir", 803: "exit_chdir", 802: "enter_fchdir", 801: "exit_fchdir", 800: "enter_chroot", 799: "exit_chroot", 798: "enter_fchmod", 797: "exit_fchmod", 796: "enter_fchmodat2", 795: "exit_fchmodat2", 794: "enter_fchmodat", 793: "exit_fchmodat", 792: "enter_chmod", 791: "exit_chmod", 790: "enter_fchownat", 789: "exit_fchownat", 788: "enter_chown", 787: "exit_chown", 786: "enter_lchown", 785: "exit_lchown", 784: "enter_fchown", 783: "exit_fchown", 782: "enter_open", 781: "exit_open", 780: "enter_openat", 779: "exit_openat", 778: "enter_openat2", 777: "exit_openat2", 776: "enter_creat", 775: "exit_creat", 774: "enter_close", 773: "exit_close", 772: "enter_close_range", 771: "exit_close_range", 592: "enter_cachestat", 591: "exit_cachestat", + 1513: "enter_io_uring_register", 1512: "exit_io_uring_register", 1494: "enter_io_uring_enter", 1493: "exit_io_uring_enter", 1153: "enter_quotactl", 1152: "exit_quotactl", 1151: "enter_quotactl_fd", 1150: "exit_quotactl_fd", 1120: "enter_flock", 1119: "exit_flock", 1062: "enter_fanotify_mark", 1061: "exit_fanotify_mark", 1056: "enter_inotify_add_watch", 1055: "exit_inotify_add_watch", 1048: "enter_fsconfig", 1047: "exit_fsconfig", 1046: "enter_statfs", 1045: "exit_statfs", 1044: "enter_fstatfs", 1043: "exit_fstatfs", 1038: "enter_utimensat", 1037: "exit_utimensat", 1036: "enter_futimesat", 1035: "exit_futimesat", 1026: "enter_fsync", 1025: "exit_fsync", 1024: "enter_fdatasync", 1023: "exit_fdatasync", 982: "enter_setxattrat", 981: "exit_setxattrat", 980: "enter_setxattr", 979: "exit_setxattr", 978: "enter_lsetxattr", 977: "exit_lsetxattr", 974: "enter_getxattrat", 973: "exit_getxattrat", 972: "enter_getxattr", 971: "exit_getxattr", 970: "enter_lgetxattr", 969: "exit_lgetxattr", 966: "enter_listxattrat", 965: "exit_listxattrat", 964: "enter_listxattr", 963: "exit_listxattr", 962: "enter_llistxattr", 961: "exit_llistxattr", 958: "enter_removexattrat", 957: "exit_removexattrat", 956: "enter_removexattr", 955: "exit_removexattr", 954: "enter_lremovexattr", 953: "exit_lremovexattr", 948: "enter_open_tree", 947: "exit_open_tree", 930: "enter_close_range", 929: "exit_close_range", 910: "enter_getdents", 909: "exit_getdents", 908: "enter_getdents64", 907: "exit_getdents64", 906: "enter_ioctl", 905: "exit_ioctl", 904: "enter_fcntl", 903: "exit_fcntl", 902: "enter_mknodat", 901: "exit_mknodat", 900: "enter_mknod", 899: "exit_mknod", 898: "enter_mkdirat", 897: "exit_mkdirat", 896: "enter_mkdir", 895: "exit_mkdir", 894: "enter_rmdir", 893: "exit_rmdir", 892: "enter_unlinkat", 891: "exit_unlinkat", 890: "enter_unlink", 889: "exit_unlink", 888: "enter_symlinkat", 887: "exit_symlinkat", 886: "enter_symlink", 885: "exit_symlink", 884: "enter_linkat", 883: "exit_linkat", 882: "enter_link", 881: "exit_link", 880: "enter_renameat2", 879: "exit_renameat2", 878: "enter_renameat", 877: "exit_renameat", 876: "enter_rename", 875: "exit_rename", 870: "enter_execve", 869: "exit_execve", 868: "enter_execveat", 867: "exit_execveat", 866: "enter_newstat", 865: "exit_newstat", 864: "enter_newlstat", 863: "exit_newlstat", 862: "enter_newfstatat", 861: "exit_newfstatat", 860: "enter_newfstat", 859: "exit_newfstat", 858: "enter_readlinkat", 857: "exit_readlinkat", 854: "enter_statx", 853: "exit_statx", 852: "enter_lseek", 851: "exit_lseek", 850: "enter_read", 849: "exit_read", 848: "enter_write", 847: "exit_write", 846: "enter_pread64", 845: "exit_pread64", 844: "enter_pwrite64", 843: "exit_pwrite64", 824: "enter_ftruncate", 823: "exit_ftruncate", 820: "enter_faccessat", 819: "exit_faccessat", 818: "enter_faccessat2", 817: "exit_faccessat2", 816: "enter_access", 815: "exit_access", 814: "enter_chdir", 813: "exit_chdir", 812: "enter_fchdir", 811: "exit_fchdir", 810: "enter_chroot", 809: "exit_chroot", 808: "enter_fchmod", 807: "exit_fchmod", 806: "enter_fchmodat2", 805: "exit_fchmodat2", 804: "enter_fchmodat", 803: "exit_fchmodat", 802: "enter_chmod", 801: "exit_chmod", 800: "enter_fchownat", 799: "exit_fchownat", 798: "enter_chown", 797: "exit_chown", 796: "enter_lchown", 795: "exit_lchown", 794: "enter_fchown", 793: "exit_fchown", 792: "enter_open", 791: "exit_open", 790: "enter_openat", 789: "exit_openat", 788: "enter_openat2", 787: "exit_openat2", 786: "enter_creat", 785: "exit_creat", 784: "enter_close", 783: "exit_close", 599: "enter_cachestat", 598: "exit_cachestat", 281: "enter_reboot", 280: "exit_reboot", } var traceId2Name = map[TraceId]string{ - 1485: "io_uring_register", 1484: "io_uring_register", 1466: "io_uring_enter", 1465: "io_uring_enter", 1127: "quotactl_fd", 1126: "quotactl_fd", 1096: "flock", 1095: "flock", 1038: "fanotify_mark", 1037: "fanotify_mark", 1032: "inotify_add_watch", 1031: "inotify_add_watch", 1022: "statfs", 1021: "statfs", 1020: "fstatfs", 1019: "fstatfs", 1014: "utimensat", 1013: "utimensat", 1012: "futimesat", 1011: "futimesat", 1002: "fsync", 1001: "fsync", 1000: "fdatasync", 999: "fdatasync", 958: "setxattr", 957: "setxattr", 956: "lsetxattr", 955: "lsetxattr", 952: "getxattr", 951: "getxattr", 950: "lgetxattr", 949: "lgetxattr", 946: "listxattr", 945: "listxattr", 944: "llistxattr", 943: "llistxattr", 940: "removexattr", 939: "removexattr", 938: "lremovexattr", 937: "lremovexattr", 932: "open_tree", 931: "open_tree", 900: "getdents", 899: "getdents", 898: "getdents64", 897: "getdents64", 896: "ioctl", 895: "ioctl", 894: "fcntl", 893: "fcntl", 892: "mknodat", 891: "mknodat", 890: "mknod", 889: "mknod", 888: "mkdirat", 887: "mkdirat", 886: "mkdir", 885: "mkdir", 884: "rmdir", 883: "rmdir", 882: "unlinkat", 881: "unlinkat", 880: "unlink", 879: "unlink", 878: "symlinkat", 877: "symlinkat", 876: "symlink", 875: "symlink", 874: "linkat", 873: "linkat", 872: "link", 871: "link", 870: "renameat2", 869: "renameat2", 868: "renameat", 867: "renameat", 866: "rename", 865: "rename", 860: "execve", 859: "execve", 858: "execveat", 857: "execveat", 856: "newstat", 855: "newstat", 854: "newlstat", 853: "newlstat", 852: "newfstatat", 851: "newfstatat", 850: "newfstat", 849: "newfstat", 848: "readlinkat", 847: "readlinkat", 844: "statx", 843: "statx", 842: "lseek", 841: "lseek", 840: "read", 839: "read", 838: "write", 837: "write", 836: "pread64", 835: "pread64", 834: "pwrite64", 833: "pwrite64", 814: "ftruncate", 813: "ftruncate", 810: "faccessat", 809: "faccessat", 808: "faccessat2", 807: "faccessat2", 806: "access", 805: "access", 804: "chdir", 803: "chdir", 802: "fchdir", 801: "fchdir", 800: "chroot", 799: "chroot", 798: "fchmod", 797: "fchmod", 796: "fchmodat2", 795: "fchmodat2", 794: "fchmodat", 793: "fchmodat", 792: "chmod", 791: "chmod", 790: "fchownat", 789: "fchownat", 788: "chown", 787: "chown", 786: "lchown", 785: "lchown", 784: "fchown", 783: "fchown", 782: "open", 781: "open", 780: "openat", 779: "openat", 778: "openat2", 777: "openat2", 776: "creat", 775: "creat", 774: "close", 773: "close", 772: "close_range", 771: "close_range", 592: "cachestat", 591: "cachestat", + 1513: "io_uring_register", 1512: "io_uring_register", 1494: "io_uring_enter", 1493: "io_uring_enter", 1153: "quotactl", 1152: "quotactl", 1151: "quotactl_fd", 1150: "quotactl_fd", 1120: "flock", 1119: "flock", 1062: "fanotify_mark", 1061: "fanotify_mark", 1056: "inotify_add_watch", 1055: "inotify_add_watch", 1048: "fsconfig", 1047: "fsconfig", 1046: "statfs", 1045: "statfs", 1044: "fstatfs", 1043: "fstatfs", 1038: "utimensat", 1037: "utimensat", 1036: "futimesat", 1035: "futimesat", 1026: "fsync", 1025: "fsync", 1024: "fdatasync", 1023: "fdatasync", 982: "setxattrat", 981: "setxattrat", 980: "setxattr", 979: "setxattr", 978: "lsetxattr", 977: "lsetxattr", 974: "getxattrat", 973: "getxattrat", 972: "getxattr", 971: "getxattr", 970: "lgetxattr", 969: "lgetxattr", 966: "listxattrat", 965: "listxattrat", 964: "listxattr", 963: "listxattr", 962: "llistxattr", 961: "llistxattr", 958: "removexattrat", 957: "removexattrat", 956: "removexattr", 955: "removexattr", 954: "lremovexattr", 953: "lremovexattr", 948: "open_tree", 947: "open_tree", 930: "close_range", 929: "close_range", 910: "getdents", 909: "getdents", 908: "getdents64", 907: "getdents64", 906: "ioctl", 905: "ioctl", 904: "fcntl", 903: "fcntl", 902: "mknodat", 901: "mknodat", 900: "mknod", 899: "mknod", 898: "mkdirat", 897: "mkdirat", 896: "mkdir", 895: "mkdir", 894: "rmdir", 893: "rmdir", 892: "unlinkat", 891: "unlinkat", 890: "unlink", 889: "unlink", 888: "symlinkat", 887: "symlinkat", 886: "symlink", 885: "symlink", 884: "linkat", 883: "linkat", 882: "link", 881: "link", 880: "renameat2", 879: "renameat2", 878: "renameat", 877: "renameat", 876: "rename", 875: "rename", 870: "execve", 869: "execve", 868: "execveat", 867: "execveat", 866: "newstat", 865: "newstat", 864: "newlstat", 863: "newlstat", 862: "newfstatat", 861: "newfstatat", 860: "newfstat", 859: "newfstat", 858: "readlinkat", 857: "readlinkat", 854: "statx", 853: "statx", 852: "lseek", 851: "lseek", 850: "read", 849: "read", 848: "write", 847: "write", 846: "pread64", 845: "pread64", 844: "pwrite64", 843: "pwrite64", 824: "ftruncate", 823: "ftruncate", 820: "faccessat", 819: "faccessat", 818: "faccessat2", 817: "faccessat2", 816: "access", 815: "access", 814: "chdir", 813: "chdir", 812: "fchdir", 811: "fchdir", 810: "chroot", 809: "chroot", 808: "fchmod", 807: "fchmod", 806: "fchmodat2", 805: "fchmodat2", 804: "fchmodat", 803: "fchmodat", 802: "chmod", 801: "chmod", 800: "fchownat", 799: "fchownat", 798: "chown", 797: "chown", 796: "lchown", 795: "lchown", 794: "fchown", 793: "fchown", 792: "open", 791: "open", 790: "openat", 789: "openat", 788: "openat2", 787: "openat2", 786: "creat", 785: "creat", 784: "close", 783: "close", 599: "cachestat", 598: "cachestat", 281: "reboot", 280: "reboot", } func (s TraceId) String() string { @@ -49,6 +49,8 @@ const ENTER_NAME_EVENT = 9 const EXIT_NAME_EVENT = 10 const ENTER_PATH_EVENT = 11 const EXIT_PATH_EVENT = 12 +const ENTER_FCNTL_EVENT = 13 +const EXIT_FCNTL_EVENT = 14 type OpenEvent struct { EventType EventType @@ -352,151 +354,217 @@ func (p *PathEvent) Recycle() { poolOfPathEvents.Put(p) } -const SYS_ENTER_IO_URING_REGISTER TraceId = 1485 -const SYS_EXIT_IO_URING_REGISTER TraceId = 1484 -const SYS_ENTER_IO_URING_ENTER TraceId = 1466 -const SYS_EXIT_IO_URING_ENTER TraceId = 1465 -const SYS_ENTER_QUOTACTL_FD TraceId = 1127 -const SYS_EXIT_QUOTACTL_FD TraceId = 1126 -const SYS_ENTER_FLOCK TraceId = 1096 -const SYS_EXIT_FLOCK TraceId = 1095 -const SYS_ENTER_FANOTIFY_MARK TraceId = 1038 -const SYS_EXIT_FANOTIFY_MARK TraceId = 1037 -const SYS_ENTER_INOTIFY_ADD_WATCH TraceId = 1032 -const SYS_EXIT_INOTIFY_ADD_WATCH TraceId = 1031 -const SYS_ENTER_STATFS TraceId = 1022 -const SYS_EXIT_STATFS TraceId = 1021 -const SYS_ENTER_FSTATFS TraceId = 1020 -const SYS_EXIT_FSTATFS TraceId = 1019 -const SYS_ENTER_UTIMENSAT TraceId = 1014 -const SYS_EXIT_UTIMENSAT TraceId = 1013 -const SYS_ENTER_FUTIMESAT TraceId = 1012 -const SYS_EXIT_FUTIMESAT TraceId = 1011 -const SYS_ENTER_FSYNC TraceId = 1002 -const SYS_EXIT_FSYNC TraceId = 1001 -const SYS_ENTER_FDATASYNC TraceId = 1000 -const SYS_EXIT_FDATASYNC TraceId = 999 -const SYS_ENTER_SETXATTR TraceId = 958 -const SYS_EXIT_SETXATTR TraceId = 957 -const SYS_ENTER_LSETXATTR TraceId = 956 -const SYS_EXIT_LSETXATTR TraceId = 955 -const SYS_ENTER_GETXATTR TraceId = 952 -const SYS_EXIT_GETXATTR TraceId = 951 -const SYS_ENTER_LGETXATTR TraceId = 950 -const SYS_EXIT_LGETXATTR TraceId = 949 -const SYS_ENTER_LISTXATTR TraceId = 946 -const SYS_EXIT_LISTXATTR TraceId = 945 -const SYS_ENTER_LLISTXATTR TraceId = 944 -const SYS_EXIT_LLISTXATTR TraceId = 943 -const SYS_ENTER_REMOVEXATTR TraceId = 940 -const SYS_EXIT_REMOVEXATTR TraceId = 939 -const SYS_ENTER_LREMOVEXATTR TraceId = 938 -const SYS_EXIT_LREMOVEXATTR TraceId = 937 -const SYS_ENTER_OPEN_TREE TraceId = 932 -const SYS_EXIT_OPEN_TREE TraceId = 931 -const SYS_ENTER_GETDENTS TraceId = 900 -const SYS_EXIT_GETDENTS TraceId = 899 -const SYS_ENTER_GETDENTS64 TraceId = 898 -const SYS_EXIT_GETDENTS64 TraceId = 897 -const SYS_ENTER_IOCTL TraceId = 896 -const SYS_EXIT_IOCTL TraceId = 895 -const SYS_ENTER_FCNTL TraceId = 894 -const SYS_EXIT_FCNTL TraceId = 893 -const SYS_ENTER_MKNODAT TraceId = 892 -const SYS_EXIT_MKNODAT TraceId = 891 -const SYS_ENTER_MKNOD TraceId = 890 -const SYS_EXIT_MKNOD TraceId = 889 -const SYS_ENTER_MKDIRAT TraceId = 888 -const SYS_EXIT_MKDIRAT TraceId = 887 -const SYS_ENTER_MKDIR TraceId = 886 -const SYS_EXIT_MKDIR TraceId = 885 -const SYS_ENTER_RMDIR TraceId = 884 -const SYS_EXIT_RMDIR TraceId = 883 -const SYS_ENTER_UNLINKAT TraceId = 882 -const SYS_EXIT_UNLINKAT TraceId = 881 -const SYS_ENTER_UNLINK TraceId = 880 -const SYS_EXIT_UNLINK TraceId = 879 -const SYS_ENTER_SYMLINKAT TraceId = 878 -const SYS_EXIT_SYMLINKAT TraceId = 877 -const SYS_ENTER_SYMLINK TraceId = 876 -const SYS_EXIT_SYMLINK TraceId = 875 -const SYS_ENTER_LINKAT TraceId = 874 -const SYS_EXIT_LINKAT TraceId = 873 -const SYS_ENTER_LINK TraceId = 872 -const SYS_EXIT_LINK TraceId = 871 -const SYS_ENTER_RENAMEAT2 TraceId = 870 -const SYS_EXIT_RENAMEAT2 TraceId = 869 -const SYS_ENTER_RENAMEAT TraceId = 868 -const SYS_EXIT_RENAMEAT TraceId = 867 -const SYS_ENTER_RENAME TraceId = 866 -const SYS_EXIT_RENAME TraceId = 865 -const SYS_ENTER_EXECVE TraceId = 860 -const SYS_EXIT_EXECVE TraceId = 859 -const SYS_ENTER_EXECVEAT TraceId = 858 -const SYS_EXIT_EXECVEAT TraceId = 857 -const SYS_ENTER_NEWSTAT TraceId = 856 -const SYS_EXIT_NEWSTAT TraceId = 855 -const SYS_ENTER_NEWLSTAT TraceId = 854 -const SYS_EXIT_NEWLSTAT TraceId = 853 -const SYS_ENTER_NEWFSTATAT TraceId = 852 -const SYS_EXIT_NEWFSTATAT TraceId = 851 -const SYS_ENTER_NEWFSTAT TraceId = 850 -const SYS_EXIT_NEWFSTAT TraceId = 849 -const SYS_ENTER_READLINKAT TraceId = 848 -const SYS_EXIT_READLINKAT TraceId = 847 -const SYS_ENTER_STATX TraceId = 844 -const SYS_EXIT_STATX TraceId = 843 -const SYS_ENTER_LSEEK TraceId = 842 -const SYS_EXIT_LSEEK TraceId = 841 -const SYS_ENTER_READ TraceId = 840 -const SYS_EXIT_READ TraceId = 839 -const SYS_ENTER_WRITE TraceId = 838 -const SYS_EXIT_WRITE TraceId = 837 -const SYS_ENTER_PREAD64 TraceId = 836 -const SYS_EXIT_PREAD64 TraceId = 835 -const SYS_ENTER_PWRITE64 TraceId = 834 -const SYS_EXIT_PWRITE64 TraceId = 833 -const SYS_ENTER_FTRUNCATE TraceId = 814 -const SYS_EXIT_FTRUNCATE TraceId = 813 -const SYS_ENTER_FACCESSAT TraceId = 810 -const SYS_EXIT_FACCESSAT TraceId = 809 -const SYS_ENTER_FACCESSAT2 TraceId = 808 -const SYS_EXIT_FACCESSAT2 TraceId = 807 -const SYS_ENTER_ACCESS TraceId = 806 -const SYS_EXIT_ACCESS TraceId = 805 -const SYS_ENTER_CHDIR TraceId = 804 -const SYS_EXIT_CHDIR TraceId = 803 -const SYS_ENTER_FCHDIR TraceId = 802 -const SYS_EXIT_FCHDIR TraceId = 801 -const SYS_ENTER_CHROOT TraceId = 800 -const SYS_EXIT_CHROOT TraceId = 799 -const SYS_ENTER_FCHMOD TraceId = 798 -const SYS_EXIT_FCHMOD TraceId = 797 -const SYS_ENTER_FCHMODAT2 TraceId = 796 -const SYS_EXIT_FCHMODAT2 TraceId = 795 -const SYS_ENTER_FCHMODAT TraceId = 794 -const SYS_EXIT_FCHMODAT TraceId = 793 -const SYS_ENTER_CHMOD TraceId = 792 -const SYS_EXIT_CHMOD TraceId = 791 -const SYS_ENTER_FCHOWNAT TraceId = 790 -const SYS_EXIT_FCHOWNAT TraceId = 789 -const SYS_ENTER_CHOWN TraceId = 788 -const SYS_EXIT_CHOWN TraceId = 787 -const SYS_ENTER_LCHOWN TraceId = 786 -const SYS_EXIT_LCHOWN TraceId = 785 -const SYS_ENTER_FCHOWN TraceId = 784 -const SYS_EXIT_FCHOWN TraceId = 783 -const SYS_ENTER_OPEN TraceId = 782 -const SYS_EXIT_OPEN TraceId = 781 -const SYS_ENTER_OPENAT TraceId = 780 -const SYS_EXIT_OPENAT TraceId = 779 -const SYS_ENTER_OPENAT2 TraceId = 778 -const SYS_EXIT_OPENAT2 TraceId = 777 -const SYS_ENTER_CREAT TraceId = 776 -const SYS_EXIT_CREAT TraceId = 775 -const SYS_ENTER_CLOSE TraceId = 774 -const SYS_EXIT_CLOSE TraceId = 773 -const SYS_ENTER_CLOSE_RANGE TraceId = 772 -const SYS_EXIT_CLOSE_RANGE TraceId = 771 -const SYS_ENTER_CACHESTAT TraceId = 592 -const SYS_EXIT_CACHESTAT TraceId = 591 +type FcntlEvent struct { + EventType EventType + TraceId TraceId + Time uint64 + Pid uint32 + Tid uint32 + Fd uint32 + Cmd uint32 + Arg uint64 +} + +func (f FcntlEvent) String() string { + return fmt.Sprintf("EventType:%v TraceId:%v Time:%v Pid:%v Tid:%v Fd:%v Cmd:%v Arg:%v", f.EventType, f.TraceId, f.Time, f.Pid, f.Tid, f.Fd, f.Cmd, f.Arg) +} + +func (f *FcntlEvent) GetEventType() EventType { + return f.EventType +} + +func (f *FcntlEvent) GetTraceId() TraceId { + return f.TraceId +} + +func (f *FcntlEvent) GetPid() uint32 { + return f.Pid +} + +func (f *FcntlEvent) GetTid() uint32 { + return f.Tid +} + +func (f *FcntlEvent) GetTime() uint64 { + return f.Time +} + +var poolOfFcntlEvents = sync.Pool{ + New: func() interface{} { return &FcntlEvent{} }, +} + +func NewFcntlEvent(raw []byte) *FcntlEvent { + f := poolOfFcntlEvents.Get().(*FcntlEvent) + if err := binary.Read(bytes.NewReader(raw), binary.LittleEndian, f); err != nil { + fmt.Println(f, raw, len(raw), err) + panic(raw) + } + return f +} + +func (f *FcntlEvent) Recycle() { + poolOfFcntlEvents.Put(f) +} + +const SYS_ENTER_IO_URING_REGISTER TraceId = 1513 +const SYS_EXIT_IO_URING_REGISTER TraceId = 1512 +const SYS_ENTER_IO_URING_ENTER TraceId = 1494 +const SYS_EXIT_IO_URING_ENTER TraceId = 1493 +const SYS_ENTER_QUOTACTL TraceId = 1153 +const SYS_EXIT_QUOTACTL TraceId = 1152 +const SYS_ENTER_QUOTACTL_FD TraceId = 1151 +const SYS_EXIT_QUOTACTL_FD TraceId = 1150 +const SYS_ENTER_FLOCK TraceId = 1120 +const SYS_EXIT_FLOCK TraceId = 1119 +const SYS_ENTER_FANOTIFY_MARK TraceId = 1062 +const SYS_EXIT_FANOTIFY_MARK TraceId = 1061 +const SYS_ENTER_INOTIFY_ADD_WATCH TraceId = 1056 +const SYS_EXIT_INOTIFY_ADD_WATCH TraceId = 1055 +const SYS_ENTER_FSCONFIG TraceId = 1048 +const SYS_EXIT_FSCONFIG TraceId = 1047 +const SYS_ENTER_STATFS TraceId = 1046 +const SYS_EXIT_STATFS TraceId = 1045 +const SYS_ENTER_FSTATFS TraceId = 1044 +const SYS_EXIT_FSTATFS TraceId = 1043 +const SYS_ENTER_UTIMENSAT TraceId = 1038 +const SYS_EXIT_UTIMENSAT TraceId = 1037 +const SYS_ENTER_FUTIMESAT TraceId = 1036 +const SYS_EXIT_FUTIMESAT TraceId = 1035 +const SYS_ENTER_FSYNC TraceId = 1026 +const SYS_EXIT_FSYNC TraceId = 1025 +const SYS_ENTER_FDATASYNC TraceId = 1024 +const SYS_EXIT_FDATASYNC TraceId = 1023 +const SYS_ENTER_SETXATTRAT TraceId = 982 +const SYS_EXIT_SETXATTRAT TraceId = 981 +const SYS_ENTER_SETXATTR TraceId = 980 +const SYS_EXIT_SETXATTR TraceId = 979 +const SYS_ENTER_LSETXATTR TraceId = 978 +const SYS_EXIT_LSETXATTR TraceId = 977 +const SYS_ENTER_GETXATTRAT TraceId = 974 +const SYS_EXIT_GETXATTRAT TraceId = 973 +const SYS_ENTER_GETXATTR TraceId = 972 +const SYS_EXIT_GETXATTR TraceId = 971 +const SYS_ENTER_LGETXATTR TraceId = 970 +const SYS_EXIT_LGETXATTR TraceId = 969 +const SYS_ENTER_LISTXATTRAT TraceId = 966 +const SYS_EXIT_LISTXATTRAT TraceId = 965 +const SYS_ENTER_LISTXATTR TraceId = 964 +const SYS_EXIT_LISTXATTR TraceId = 963 +const SYS_ENTER_LLISTXATTR TraceId = 962 +const SYS_EXIT_LLISTXATTR TraceId = 961 +const SYS_ENTER_REMOVEXATTRAT TraceId = 958 +const SYS_EXIT_REMOVEXATTRAT TraceId = 957 +const SYS_ENTER_REMOVEXATTR TraceId = 956 +const SYS_EXIT_REMOVEXATTR TraceId = 955 +const SYS_ENTER_LREMOVEXATTR TraceId = 954 +const SYS_EXIT_LREMOVEXATTR TraceId = 953 +const SYS_ENTER_OPEN_TREE TraceId = 948 +const SYS_EXIT_OPEN_TREE TraceId = 947 +const SYS_ENTER_CLOSE_RANGE TraceId = 930 +const SYS_EXIT_CLOSE_RANGE TraceId = 929 +const SYS_ENTER_GETDENTS TraceId = 910 +const SYS_EXIT_GETDENTS TraceId = 909 +const SYS_ENTER_GETDENTS64 TraceId = 908 +const SYS_EXIT_GETDENTS64 TraceId = 907 +const SYS_ENTER_IOCTL TraceId = 906 +const SYS_EXIT_IOCTL TraceId = 905 +const SYS_ENTER_FCNTL TraceId = 904 +const SYS_EXIT_FCNTL TraceId = 903 +const SYS_ENTER_MKNODAT TraceId = 902 +const SYS_EXIT_MKNODAT TraceId = 901 +const SYS_ENTER_MKNOD TraceId = 900 +const SYS_EXIT_MKNOD TraceId = 899 +const SYS_ENTER_MKDIRAT TraceId = 898 +const SYS_EXIT_MKDIRAT TraceId = 897 +const SYS_ENTER_MKDIR TraceId = 896 +const SYS_EXIT_MKDIR TraceId = 895 +const SYS_ENTER_RMDIR TraceId = 894 +const SYS_EXIT_RMDIR TraceId = 893 +const SYS_ENTER_UNLINKAT TraceId = 892 +const SYS_EXIT_UNLINKAT TraceId = 891 +const SYS_ENTER_UNLINK TraceId = 890 +const SYS_EXIT_UNLINK TraceId = 889 +const SYS_ENTER_SYMLINKAT TraceId = 888 +const SYS_EXIT_SYMLINKAT TraceId = 887 +const SYS_ENTER_SYMLINK TraceId = 886 +const SYS_EXIT_SYMLINK TraceId = 885 +const SYS_ENTER_LINKAT TraceId = 884 +const SYS_EXIT_LINKAT TraceId = 883 +const SYS_ENTER_LINK TraceId = 882 +const SYS_EXIT_LINK TraceId = 881 +const SYS_ENTER_RENAMEAT2 TraceId = 880 +const SYS_EXIT_RENAMEAT2 TraceId = 879 +const SYS_ENTER_RENAMEAT TraceId = 878 +const SYS_EXIT_RENAMEAT TraceId = 877 +const SYS_ENTER_RENAME TraceId = 876 +const SYS_EXIT_RENAME TraceId = 875 +const SYS_ENTER_EXECVE TraceId = 870 +const SYS_EXIT_EXECVE TraceId = 869 +const SYS_ENTER_EXECVEAT TraceId = 868 +const SYS_EXIT_EXECVEAT TraceId = 867 +const SYS_ENTER_NEWSTAT TraceId = 866 +const SYS_EXIT_NEWSTAT TraceId = 865 +const SYS_ENTER_NEWLSTAT TraceId = 864 +const SYS_EXIT_NEWLSTAT TraceId = 863 +const SYS_ENTER_NEWFSTATAT TraceId = 862 +const SYS_EXIT_NEWFSTATAT TraceId = 861 +const SYS_ENTER_NEWFSTAT TraceId = 860 +const SYS_EXIT_NEWFSTAT TraceId = 859 +const SYS_ENTER_READLINKAT TraceId = 858 +const SYS_EXIT_READLINKAT TraceId = 857 +const SYS_ENTER_STATX TraceId = 854 +const SYS_EXIT_STATX TraceId = 853 +const SYS_ENTER_LSEEK TraceId = 852 +const SYS_EXIT_LSEEK TraceId = 851 +const SYS_ENTER_READ TraceId = 850 +const SYS_EXIT_READ TraceId = 849 +const SYS_ENTER_WRITE TraceId = 848 +const SYS_EXIT_WRITE TraceId = 847 +const SYS_ENTER_PREAD64 TraceId = 846 +const SYS_EXIT_PREAD64 TraceId = 845 +const SYS_ENTER_PWRITE64 TraceId = 844 +const SYS_EXIT_PWRITE64 TraceId = 843 +const SYS_ENTER_FTRUNCATE TraceId = 824 +const SYS_EXIT_FTRUNCATE TraceId = 823 +const SYS_ENTER_FACCESSAT TraceId = 820 +const SYS_EXIT_FACCESSAT TraceId = 819 +const SYS_ENTER_FACCESSAT2 TraceId = 818 +const SYS_EXIT_FACCESSAT2 TraceId = 817 +const SYS_ENTER_ACCESS TraceId = 816 +const SYS_EXIT_ACCESS TraceId = 815 +const SYS_ENTER_CHDIR TraceId = 814 +const SYS_EXIT_CHDIR TraceId = 813 +const SYS_ENTER_FCHDIR TraceId = 812 +const SYS_EXIT_FCHDIR TraceId = 811 +const SYS_ENTER_CHROOT TraceId = 810 +const SYS_EXIT_CHROOT TraceId = 809 +const SYS_ENTER_FCHMOD TraceId = 808 +const SYS_EXIT_FCHMOD TraceId = 807 +const SYS_ENTER_FCHMODAT2 TraceId = 806 +const SYS_EXIT_FCHMODAT2 TraceId = 805 +const SYS_ENTER_FCHMODAT TraceId = 804 +const SYS_EXIT_FCHMODAT TraceId = 803 +const SYS_ENTER_CHMOD TraceId = 802 +const SYS_EXIT_CHMOD TraceId = 801 +const SYS_ENTER_FCHOWNAT TraceId = 800 +const SYS_EXIT_FCHOWNAT TraceId = 799 +const SYS_ENTER_CHOWN TraceId = 798 +const SYS_EXIT_CHOWN TraceId = 797 +const SYS_ENTER_LCHOWN TraceId = 796 +const SYS_EXIT_LCHOWN TraceId = 795 +const SYS_ENTER_FCHOWN TraceId = 794 +const SYS_EXIT_FCHOWN TraceId = 793 +const SYS_ENTER_OPEN TraceId = 792 +const SYS_EXIT_OPEN TraceId = 791 +const SYS_ENTER_OPENAT TraceId = 790 +const SYS_EXIT_OPENAT TraceId = 789 +const SYS_ENTER_OPENAT2 TraceId = 788 +const SYS_EXIT_OPENAT2 TraceId = 787 +const SYS_ENTER_CREAT TraceId = 786 +const SYS_EXIT_CREAT TraceId = 785 +const SYS_ENTER_CLOSE TraceId = 784 +const SYS_EXIT_CLOSE TraceId = 783 +const SYS_ENTER_CACHESTAT TraceId = 599 +const SYS_EXIT_CACHESTAT TraceId = 598 +const SYS_ENTER_REBOOT TraceId = 281 +const SYS_EXIT_REBOOT TraceId = 280 |