summaryrefslogtreecommitdiff
path: root/internal
diff options
context:
space:
mode:
Diffstat (limited to 'internal')
-rw-r--r--internal/c/generated/tracepoints.c132
-rw-r--r--internal/c/generated/tracepoints.raku2
-rw-r--r--internal/c/tracepoints/open.c10
-rw-r--r--internal/c/types.h12
-rw-r--r--internal/event.go8
-rw-r--r--internal/eventloop.go54
-rw-r--r--internal/generated/nqc.raku29
-rw-r--r--internal/generated/tracepoints.raku2
-rw-r--r--internal/generated/tracepoints/tracepoints.go2
-rw-r--r--internal/generated/types/types.go216
10 files changed, 234 insertions, 233 deletions
diff --git a/internal/c/generated/tracepoints.c b/internal/c/generated/tracepoints.c
index 6e17c0c..21b38d7 100644
--- a/internal/c/generated/tracepoints.c
+++ b/internal/c/generated/tracepoints.c
@@ -78,7 +78,7 @@ int handle_sys_exit_cachestat(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_CACHESTAT;
+ ev->trace_id = SYS_EXIT_CACHESTAT;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -99,7 +99,7 @@ int handle_sys_enter_cachestat(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_CACHESTAT;
+ ev->trace_id = SYS_ENTER_CACHESTAT;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -120,7 +120,7 @@ int handle_sys_exit_close_range(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_CLOSE_RANGE;
+ ev->trace_id = SYS_EXIT_CLOSE_RANGE;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -141,7 +141,7 @@ int handle_sys_enter_close_range(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_CLOSE_RANGE;
+ ev->trace_id = SYS_ENTER_CLOSE_RANGE;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -162,7 +162,7 @@ int handle_sys_exit_close(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_CLOSE;
+ ev->trace_id = SYS_EXIT_CLOSE;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -183,7 +183,7 @@ int handle_sys_enter_close(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_CLOSE;
+ ev->trace_id = SYS_ENTER_CLOSE;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -204,7 +204,7 @@ int handle_sys_exit_fchown(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_FCHOWN;
+ ev->trace_id = SYS_EXIT_FCHOWN;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -225,7 +225,7 @@ int handle_sys_enter_fchown(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_FCHOWN;
+ ev->trace_id = SYS_ENTER_FCHOWN;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -246,7 +246,7 @@ int handle_sys_exit_fchmod(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_FCHMOD;
+ ev->trace_id = SYS_EXIT_FCHMOD;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -267,7 +267,7 @@ int handle_sys_enter_fchmod(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_FCHMOD;
+ ev->trace_id = SYS_ENTER_FCHMOD;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -288,7 +288,7 @@ int handle_sys_exit_fchdir(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_FCHDIR;
+ ev->trace_id = SYS_EXIT_FCHDIR;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -309,7 +309,7 @@ int handle_sys_enter_fchdir(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_FCHDIR;
+ ev->trace_id = SYS_ENTER_FCHDIR;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -330,7 +330,7 @@ int handle_sys_exit_ftruncate(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_FTRUNCATE;
+ ev->trace_id = SYS_EXIT_FTRUNCATE;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -351,7 +351,7 @@ int handle_sys_enter_ftruncate(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_FTRUNCATE;
+ ev->trace_id = SYS_ENTER_FTRUNCATE;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -372,7 +372,7 @@ int handle_sys_exit_copy_file_range(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_COPY_FILE_RANGE;
+ ev->trace_id = SYS_EXIT_COPY_FILE_RANGE;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -393,7 +393,7 @@ int handle_sys_enter_copy_file_range(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_NULL_EVENT;
- ev->syscall_id = SYS_ENTER_COPY_FILE_RANGE;
+ ev->trace_id = SYS_ENTER_COPY_FILE_RANGE;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -414,7 +414,7 @@ int handle_sys_exit_pwrite64(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_PWRITE64;
+ ev->trace_id = SYS_EXIT_PWRITE64;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -435,7 +435,7 @@ int handle_sys_enter_pwrite64(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_PWRITE64;
+ ev->trace_id = SYS_ENTER_PWRITE64;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -456,7 +456,7 @@ int handle_sys_exit_pread64(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_PREAD64;
+ ev->trace_id = SYS_EXIT_PREAD64;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -477,7 +477,7 @@ int handle_sys_enter_pread64(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_PREAD64;
+ ev->trace_id = SYS_ENTER_PREAD64;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -498,7 +498,7 @@ int handle_sys_exit_write(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_WRITE;
+ ev->trace_id = SYS_EXIT_WRITE;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -519,7 +519,7 @@ int handle_sys_enter_write(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_WRITE;
+ ev->trace_id = SYS_ENTER_WRITE;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -540,7 +540,7 @@ int handle_sys_exit_read(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_READ;
+ ev->trace_id = SYS_EXIT_READ;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -561,7 +561,7 @@ int handle_sys_enter_read(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_READ;
+ ev->trace_id = SYS_ENTER_READ;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -582,7 +582,7 @@ int handle_sys_exit_lseek(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_LSEEK;
+ ev->trace_id = SYS_EXIT_LSEEK;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -603,7 +603,7 @@ int handle_sys_enter_lseek(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_LSEEK;
+ ev->trace_id = SYS_ENTER_LSEEK;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -624,7 +624,7 @@ int handle_sys_exit_newfstat(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_NEWFSTAT;
+ ev->trace_id = SYS_EXIT_NEWFSTAT;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -645,7 +645,7 @@ int handle_sys_enter_newfstat(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_NEWFSTAT;
+ ev->trace_id = SYS_ENTER_NEWFSTAT;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -666,7 +666,7 @@ int handle_sys_exit_rename(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_RENAME;
+ ev->trace_id = SYS_EXIT_RENAME;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -687,7 +687,7 @@ int handle_sys_enter_rename(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_NAME_EVENT;
- ev->syscall_id = SYS_ENTER_RENAME;
+ ev->trace_id = SYS_ENTER_RENAME;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -710,7 +710,7 @@ int handle_sys_exit_renameat(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_RENAMEAT;
+ ev->trace_id = SYS_EXIT_RENAMEAT;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -731,7 +731,7 @@ int handle_sys_enter_renameat(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_NAME_EVENT;
- ev->syscall_id = SYS_ENTER_RENAMEAT;
+ ev->trace_id = SYS_ENTER_RENAMEAT;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -754,7 +754,7 @@ int handle_sys_exit_renameat2(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_RENAMEAT2;
+ ev->trace_id = SYS_EXIT_RENAMEAT2;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -775,7 +775,7 @@ int handle_sys_enter_renameat2(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_NAME_EVENT;
- ev->syscall_id = SYS_ENTER_RENAMEAT2;
+ ev->trace_id = SYS_ENTER_RENAMEAT2;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -798,7 +798,7 @@ int handle_sys_exit_link(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_LINK;
+ ev->trace_id = SYS_EXIT_LINK;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -819,7 +819,7 @@ int handle_sys_enter_link(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_NAME_EVENT;
- ev->syscall_id = SYS_ENTER_LINK;
+ ev->trace_id = SYS_ENTER_LINK;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -842,7 +842,7 @@ int handle_sys_exit_linkat(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_LINKAT;
+ ev->trace_id = SYS_EXIT_LINKAT;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -863,7 +863,7 @@ int handle_sys_enter_linkat(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_NAME_EVENT;
- ev->syscall_id = SYS_ENTER_LINKAT;
+ ev->trace_id = SYS_ENTER_LINKAT;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -886,7 +886,7 @@ int handle_sys_exit_symlink(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_SYMLINK;
+ ev->trace_id = SYS_EXIT_SYMLINK;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -907,7 +907,7 @@ int handle_sys_enter_symlink(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_NAME_EVENT;
- ev->syscall_id = SYS_ENTER_SYMLINK;
+ ev->trace_id = SYS_ENTER_SYMLINK;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -930,7 +930,7 @@ int handle_sys_exit_symlinkat(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_SYMLINKAT;
+ ev->trace_id = SYS_EXIT_SYMLINKAT;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -951,7 +951,7 @@ int handle_sys_enter_symlinkat(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_NAME_EVENT;
- ev->syscall_id = SYS_ENTER_SYMLINKAT;
+ ev->trace_id = SYS_ENTER_SYMLINKAT;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -974,7 +974,7 @@ int handle_sys_exit_fcntl(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_FCNTL;
+ ev->trace_id = SYS_EXIT_FCNTL;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -995,7 +995,7 @@ int handle_sys_enter_fcntl(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_FCNTL;
+ ev->trace_id = SYS_ENTER_FCNTL;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1016,7 +1016,7 @@ int handle_sys_exit_ioctl(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_IOCTL;
+ ev->trace_id = SYS_EXIT_IOCTL;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1037,7 +1037,7 @@ int handle_sys_enter_ioctl(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_IOCTL;
+ ev->trace_id = SYS_ENTER_IOCTL;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1058,7 +1058,7 @@ int handle_sys_exit_getdents64(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_GETDENTS64;
+ ev->trace_id = SYS_EXIT_GETDENTS64;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1079,7 +1079,7 @@ int handle_sys_enter_getdents64(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_GETDENTS64;
+ ev->trace_id = SYS_ENTER_GETDENTS64;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1100,7 +1100,7 @@ int handle_sys_exit_getdents(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_GETDENTS;
+ ev->trace_id = SYS_EXIT_GETDENTS;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1121,7 +1121,7 @@ int handle_sys_enter_getdents(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_GETDENTS;
+ ev->trace_id = SYS_ENTER_GETDENTS;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1142,7 +1142,7 @@ int handle_sys_exit_sync_file_range(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_SYNC_FILE_RANGE;
+ ev->trace_id = SYS_EXIT_SYNC_FILE_RANGE;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1163,7 +1163,7 @@ int handle_sys_enter_sync_file_range(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_NULL_EVENT;
- ev->syscall_id = SYS_ENTER_SYNC_FILE_RANGE;
+ ev->trace_id = SYS_ENTER_SYNC_FILE_RANGE;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1184,7 +1184,7 @@ int handle_sys_exit_fdatasync(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_FDATASYNC;
+ ev->trace_id = SYS_EXIT_FDATASYNC;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1205,7 +1205,7 @@ int handle_sys_enter_fdatasync(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_FDATASYNC;
+ ev->trace_id = SYS_ENTER_FDATASYNC;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1226,7 +1226,7 @@ int handle_sys_exit_fsync(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_FSYNC;
+ ev->trace_id = SYS_EXIT_FSYNC;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1247,7 +1247,7 @@ int handle_sys_enter_fsync(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_FSYNC;
+ ev->trace_id = SYS_ENTER_FSYNC;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1268,7 +1268,7 @@ int handle_sys_exit_fstatfs(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_FSTATFS;
+ ev->trace_id = SYS_EXIT_FSTATFS;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1289,7 +1289,7 @@ int handle_sys_enter_fstatfs(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_FSTATFS;
+ ev->trace_id = SYS_ENTER_FSTATFS;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1310,7 +1310,7 @@ int handle_sys_exit_flock(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_FLOCK;
+ ev->trace_id = SYS_EXIT_FLOCK;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1331,7 +1331,7 @@ int handle_sys_enter_flock(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_FLOCK;
+ ev->trace_id = SYS_ENTER_FLOCK;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1352,7 +1352,7 @@ int handle_sys_exit_quotactl_fd(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_QUOTACTL_FD;
+ ev->trace_id = SYS_EXIT_QUOTACTL_FD;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1373,7 +1373,7 @@ int handle_sys_enter_quotactl_fd(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_QUOTACTL_FD;
+ ev->trace_id = SYS_ENTER_QUOTACTL_FD;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1394,7 +1394,7 @@ int handle_sys_exit_io_uring_register(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_IO_URING_REGISTER;
+ ev->trace_id = SYS_EXIT_IO_URING_REGISTER;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1415,7 +1415,7 @@ int handle_sys_enter_io_uring_register(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_IO_URING_REGISTER;
+ ev->trace_id = SYS_ENTER_IO_URING_REGISTER;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1436,7 +1436,7 @@ int handle_sys_exit_io_uring_enter(struct trace_event_raw_sys_exit *ctx) {
return 0;
ev->event_type = EXIT_RET_EVENT;
- ev->syscall_id = SYS_EXIT_IO_URING_ENTER;
+ ev->trace_id = SYS_EXIT_IO_URING_ENTER;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -1457,7 +1457,7 @@ int handle_sys_enter_io_uring_enter(struct trace_event_raw_sys_enter *ctx) {
return 0;
ev->event_type = ENTER_FD_EVENT;
- ev->syscall_id = SYS_ENTER_IO_URING_ENTER;
+ ev->trace_id = SYS_ENTER_IO_URING_ENTER;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
diff --git a/internal/c/generated/tracepoints.raku b/internal/c/generated/tracepoints.raku
index 6eb938b..cc78fbb 100644
--- a/internal/c/generated/tracepoints.raku
+++ b/internal/c/generated/tracepoints.raku
@@ -88,7 +88,7 @@ class Format {
return 0;
ev->event_type = {(is-enter ?? 'ENTER_' !! 'EXIT_') ~ event-struct.uc};
- ev->syscall_id = {$!name.uc};
+ ev->trace_id = {$!name.uc};
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
diff --git a/internal/c/tracepoints/open.c b/internal/c/tracepoints/open.c
index ef57d90..b4e8757 100644
--- a/internal/c/tracepoints/open.c
+++ b/internal/c/tracepoints/open.c
@@ -5,17 +5,17 @@
#define SYS_EXIT_OPENAT 3
#define SYS_ENTER_OPENAT 4
-static __always_inline int _handle_sys_enter_open(struct trace_event_raw_sys_enter *ctx, __u32 syscall_id) {
+static __always_inline int _handle_sys_enter_open(struct trace_event_raw_sys_enter *ctx, __u32 trace_id) {
__u32 pid, tid;
if (filter(&pid, &tid))
return 0;
- struct open_enter_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct open_enter_event), 0);
+ struct open_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct open_event), 0);
if (!ev)
return 0;
ev->event_type = ENTER_OPEN_EVENT;
- ev->syscall_id = syscall_id;
+ ev->trace_id = trace_id;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
@@ -29,7 +29,7 @@ static __always_inline int _handle_sys_enter_open(struct trace_event_raw_sys_ent
return 0;
}
-static __always_inline int _handle_sys_exit_open(struct trace_event_raw_sys_exit *ctx, __u32 syscall_id) {
+static __always_inline int _handle_sys_exit_open(struct trace_event_raw_sys_exit *ctx, __u32 trace_id) {
__u32 pid, tid;
if (filter(&pid, &tid))
return 0;
@@ -39,7 +39,7 @@ static __always_inline int _handle_sys_exit_open(struct trace_event_raw_sys_exit
return 0;
ev->event_type = EXIT_FD_EVENT;
- ev->syscall_id = syscall_id;
+ ev->trace_id = trace_id;
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_ns() / 1000;
diff --git a/internal/c/types.h b/internal/c/types.h
index 57f39f0..017e1fb 100644
--- a/internal/c/types.h
+++ b/internal/c/types.h
@@ -14,9 +14,9 @@
#define ENTER_NAME_EVENT 9
#define EXIT_NAME_EVENT 10
-struct open_enter_event {
+struct open_event {
__u32 event_type;
- __u32 syscall_id;
+ __u32 trace_id;
__u32 pid;
__u32 tid;
__u32 time;
@@ -26,7 +26,7 @@ struct open_enter_event {
struct null_event {
__u32 event_type;
- __u32 syscall_id;
+ __u32 trace_id;
__u32 pid;
__u32 tid;
__u32 time;
@@ -34,7 +34,7 @@ struct null_event {
struct fd_event {
__u32 event_type;
- __u32 syscall_id;
+ __u32 trace_id;
__u32 pid;
__u32 tid;
__u32 time;
@@ -43,7 +43,7 @@ struct fd_event {
struct ret_event {
__u32 event_type;
- __u32 syscall_id;
+ __u32 trace_id;
__u32 pid;
__u32 tid;
__s64 ret;
@@ -52,7 +52,7 @@ struct ret_event {
struct name_event {
__u32 event_type;
- __u32 syscall_id;
+ __u32 trace_id;
__u32 pid;
__u32 tid;
__u32 time;
diff --git a/internal/event.go b/internal/event.go
index 371a79b..beb8af6 100644
--- a/internal/event.go
+++ b/internal/event.go
@@ -9,7 +9,7 @@ import (
type event interface {
String() string
- GetSyscallId() SyscallId
+ GetTraceId() TraceId
GetPid() uint32
GetTid() uint32
GetTime() uint32
@@ -23,8 +23,8 @@ type enterExitEvent struct {
tracepointMismatch bool
}
-func (e enterExitEvent) is(id SyscallId) bool {
- return e.enterEv.GetSyscallId() == id
+func (e enterExitEvent) is(id TraceId) bool {
+ return e.enterEv.GetTraceId() == id
}
func (e enterExitEvent) String() string {
@@ -46,7 +46,7 @@ func (e enterExitEvent) String() string {
sb.WriteString(strconv.FormatInt(int64(e.enterEv.GetTid()), 10))
sb.WriteString(" ")
- sb.WriteString(e.enterEv.GetSyscallId().Name())
+ sb.WriteString(e.enterEv.GetTraceId().Name())
if retEv, ok := e.exitEv.(*RetEvent); ok {
sb.WriteString(":")
sb.WriteString(strconv.FormatInt(int64(retEv.Ret), 10))
diff --git a/internal/eventloop.go b/internal/eventloop.go
index bf0ddf2..2ebd01c 100644
--- a/internal/eventloop.go
+++ b/internal/eventloop.go
@@ -43,56 +43,54 @@ func events(rawCh <-chan []byte) <-chan enterExitEvent {
delete(enterEvs, exitEv.GetTid())
ev.exitEv = exitEv
- // TODO: Rename SyscallId to TraceId
// Expect ID one lower, otherwise, enter and exit tracepoints
// don't match up. E.g.:
// enterEv:SYS_ENTER_OPEN => exitEv:SYS_EXIT_OPEN
- if ev.enterEv.GetSyscallId()-1 != ev.exitEv.GetSyscallId() {
+ if ev.enterEv.GetTraceId()-1 != ev.exitEv.GetTraceId() {
ev.tracepointMismatch = true
}
- // TODO: switch here on type?
-
- // Handle file open.
- if ev.is(SYS_ENTER_OPENAT) || ev.is(SYS_ENTER_OPEN) {
- openEnterEv := ev.enterEv.(*OpenEnterEvent)
+ switch v := ev.enterEv.(type) {
+ case *OpenEvent:
+ openEv := ev.enterEv.(*OpenEvent)
fd := ev.exitEv.(*FdEvent).Fd
- file := fdFile{fd, string(openEnterEv.Filename[:])}
+ file := fdFile{fd, string(openEv.Filename[:])}
if fd >= 0 {
files[fd] = file
}
ev.file = file
- comm := string(openEnterEv.Comm[:])
- comms[openEnterEv.Tid] = comm
- ev.comm = comm
-
- evCh <- ev
- return
- }
+ comm := string(openEv.Comm[:])
+ comms[openEv.Tid] = comm
- // Generic handling of any syscall with newname/oldname arguments
- if nameEvent, ok := ev.enterEv.(*NameEvent); ok {
+ case *NameEvent:
+ nameEvent := ev.enterEv.(*NameEvent)
ev.file = oldnameNewnameFile{
oldname: string(nameEvent.Oldname[:]),
newname: string(nameEvent.Newname[:]),
}
- }
+ ev.comm, _ = comms[ev.enterEv.GetTid()]
- // Generic handling of any syscall expecting a file descriptor (fd)
- if fdEvent, ok := ev.enterEv.(*FdEvent); ok {
- if file_, ok := files[fdEvent.Fd]; ok {
+ case *FdEvent:
+ fd := ev.enterEv.(*FdEvent).Fd
+ if file_, ok := files[fd]; ok {
ev.file = file_
+ if ev.is(SYS_ENTER_CLOSE) {
+ delete(files, fd)
+ }
} else {
- ev.file = fdFile{fdEvent.Fd, "?"}
- }
- if ev.is(SYS_ENTER_CLOSE) {
- delete(files, fdEvent.Fd)
+ ev.file = fdFile{fd, "?"}
}
+ ev.comm, _ = comms[ev.enterEv.GetTid()]
+
+ case *NullEvent:
+ ev.comm, _ = comms[ev.enterEv.GetTid()]
+
+ default:
+ panic(fmt.Sprintf("unknown type: %v", v))
}
- ev.comm, _ = comms[ev.enterEv.GetTid()]
evCh <- ev
}
@@ -102,7 +100,7 @@ func events(rawCh <-chan []byte) <-chan enterExitEvent {
for raw := range rawCh {
switch EventType(raw[0]) {
case ENTER_OPEN_EVENT:
- enter(NewOpenEnterEvent(raw))
+ enter(NewOpenEvent(raw))
case EXIT_OPEN_EVENT:
exit(NewFdEvent(raw))
case ENTER_FD_EVENT:
@@ -116,7 +114,7 @@ func events(rawCh <-chan []byte) <-chan enterExitEvent {
case ENTER_NAME_EVENT:
enter(NewNameEvent(raw))
default:
- panic(fmt.Sprintf("Unhandled event type %s", EventType(raw[0])))
+ panic(fmt.Sprintf("unhandled event type %v", EventType(raw[0])))
}
}
}()
diff --git a/internal/generated/nqc.raku b/internal/generated/nqc.raku
index 82d2a34..1a293f0 100644
--- a/internal/generated/nqc.raku
+++ b/internal/generated/nqc.raku
@@ -28,10 +28,13 @@ class NQCToGoActions {
has Bool $!constant-type-set;
method TOP($/) {
- make "// This file was generated - don't change manually!\n"
- ~ "package types\n\n"
- ~ self!constant-go-methods ~ "\n"
- ~ $<construct>.map(*.made).join('');
+ make qq:to/END/;
+ // Code generated - don't change manually!
+ package types
+
+ {self!constant-go-methods}
+ {$<construct>.map(*.made).join('')}
+ END
}
method construct($/) {
@@ -44,7 +47,7 @@ class NQCToGoActions {
method constant($/) {
push @!const-names: ~$<identifier>;
- my $const-type = $<identifier>.starts-with('SYS_') ?? ' SyscallId ' !! '';
+ my $const-type = $<identifier>.starts-with('SYS_') ?? ' TraceId ' !! '';
make qq:to/END/;
const {$<identifier>}$const-type = {$<number>}
@@ -54,23 +57,23 @@ class NQCToGoActions {
method !constant-go-methods returns Str {
qq:to/END/;
type EventType uint32
- type SyscallId uint32
+ type TraceId uint32
- func (s SyscallId) String() string \{
+ func (s TraceId) String() string \{
switch (s) \{
{@!const-names.grep(/^SYS_/).map({
"case $_: return \"{$_.subst('SYS_', '').lc}\""
}).join('; ')}
- default: panic(fmt.Sprintf("Unknown SyscallId: %d", s))
+ default: panic(fmt.Sprintf("Unknown TraceId: %d", s))
\}
\}
- func (s SyscallId) Name() string \{
+ func (s TraceId) Name() string \{
switch (s) \{
{@!const-names.grep(/^SYS_/).map({
"case $_: return \"{$_.subst(/'SYS_ENTER_'|'SYS_EXIT_'/, '').lc}\""
}).join('; ')}
- default: panic(fmt.Sprintf("Unknown SyscallId: %d", s))
+ default: panic(fmt.Sprintf("Unknown TraceId: %d", s))
\}
\}
END
@@ -107,8 +110,8 @@ class NQCToGoActions {
return $self-ref.EventType
\}
- func ($self-ref *{$<identifier>.made}) GetSyscallId() SyscallId \{
- return $self-ref.SyscallId
+ func ($self-ref *{$<identifier>.made}) GetTraceId() TraceId \{
+ return $self-ref.TraceId
\}
func ($self-ref *{$<identifier>.made}) GetPid() uint32 \{
@@ -150,7 +153,7 @@ class NQCToGoActions {
}
method member($/) {
- my Str $type = $<identifier>.made eq 'SyscallId' ?? 'SyscallId' !! $<type>.made;
+ my Str $type = $<identifier>.made eq 'TraceId' ?? 'TraceId' !! $<type>.made;
$type = 'EventType' if $<identifier>.made eq 'EventType';
make $<identifier>.made ~ ' ' ~ ($<arraysize> // '') ~ $type;
}
diff --git a/internal/generated/tracepoints.raku b/internal/generated/tracepoints.raku
index 6cdc0d0..90834a1 100644
--- a/internal/generated/tracepoints.raku
+++ b/internal/generated/tracepoints.raku
@@ -7,7 +7,7 @@ my @tracepoints = gather for $*IN.slurp.split("\n") {
}
say qq:to/END/;
-// This file was generated - don't change manually!
+// Code generated - don't change manually!
package tracepoints
var List = []string\{
diff --git a/internal/generated/tracepoints/tracepoints.go b/internal/generated/tracepoints/tracepoints.go
index 41c7d60..22eed77 100644
--- a/internal/generated/tracepoints/tracepoints.go
+++ b/internal/generated/tracepoints/tracepoints.go
@@ -1,4 +1,4 @@
-// This file was generated - don't change manually!
+// Code generated - don't change manually!
package tracepoints
var List = []string{
diff --git a/internal/generated/types/types.go b/internal/generated/types/types.go
index 30f5936..4abcadc 100644
--- a/internal/generated/types/types.go
+++ b/internal/generated/types/types.go
@@ -1,4 +1,4 @@
-// This file was generated - don't change manually!
+// Code generated - don't change manually!
package types
import (
@@ -9,9 +9,9 @@ import (
)
type EventType uint32
-type SyscallId uint32
+type TraceId uint32
-func (s SyscallId) String() string {
+func (s TraceId) String() string {
switch s {
case SYS_EXIT_