DESCRIPTION

Following is an overview of available syscall probes and convenience variables they offer. By default, each syscall probe has name and argstr convenience variables, which are not included in the overview in order to keep it short. Non dwarf-based nd_syscall probes are supposed to have the same convenience variables.

syscall.accept

addr_uaddr, addrlen_uaddr, sockfd

syscall.accept4

addr_uaddr, addrlen_uaddr, flags, flags_str, sockfd

syscall.access

mode, mode_str, pathname

syscall.acct

filename

syscall.add_key

description_uaddr, payload_uaddr, plen, ringid, type_uaddr

syscall.adjtimex

buf_str, buf_uaddr

syscall.alarm

seconds

syscall.arch_prctl

addr, code, code_str

syscall.bdflush

data, data_str, func

syscall.bind

addrlen, my_addr_uaddr, sockfd, uaddr_af, uaddr_ip, uaddr_ip_port, uaddr_ipv6_flowinfo, uaddr_ipv6_scope_id

syscall.bpf

attr_uaddr, cmd, cmd_str, size

syscall.brk

brk

syscall.capget

data_uaddr, header_uaddr

syscall.capset

data_uaddr, header_uaddr

syscall.chdir

path

syscall.chmod

mode, path

syscall.chown

group, owner, path

syscall.chown16

group, owner, path

syscall.chroot

path

syscall.clock_adjtime

clk_id, clk_id_str, tx_uaddr

syscall.clock_getres

clk_id, clk_id_str, res_uaddr

syscall.clock_gettime

clk_id, clk_id_str, tp_uaddr

syscall.clock_nanosleep

clk_id, clk_id_str, flags, flags_str, rem_uaddr, req_uaddr

syscall.clock_settime

clk_id, clk_id_str, tp_uaddr

syscall.clone

child_tid_uaddr, clone_flags, parent_tid_uaddr, stack_start

syscall.close

fd

syscall.compat_adjtimex

buf_str, buf_uaddr

syscall.compat_clock_nanosleep

clk_id, clk_id_str, flags, flags_str, rem_uaddr, req_uaddr

syscall.compat_execve

args, env_str, filename

syscall.compat_execveat

args, dirfd, dirfd_str, env_str, filename, flags, flags_str

syscall.compat_fadvise64

advice, fd, len, offset

syscall.compat_fadvise64_64

advice, fd, len, offset

syscall.compat_fallocate

fd, len, mode, offset

syscall.compat_ftruncate64

fd, length

syscall.compat_futex

futex_uaddr, op, uaddr2_uaddr, utime_uaddr, val3, val

syscall.compat_futimesat

dirfd, dirfd_str, filename, filename_uaddr, tvp_uaddr

syscall.compat_getitimer

value_uaddr, which

syscall.compat_lookup_dcookie

buffer_uaddr, cookie, len

syscall.compat_nanosleep

rem_uaddr, req_uaddr

syscall.compat_ppoll

syscall.compat_pselect6

syscall.compat_readahead

count, fd, offset

syscall.compat_recvmmsg

flags, flags_str, mmsg_uaddr, s, timeout_uaddr, vlen

syscall.compat_rt_sigprocmask

how, how_str, oldset_uaddr, set_uaddr

syscall.compat_select

exceptfds_uaddr, n, readfds_uaddr, timeout_uaddr, writefds_uaddr

syscall.compat_setitimer

ovalue_uaddr, value_uaddr, which

syscall.compat_signalfd

flags

syscall.compat_sys_msgctl

buf_uaddr, cmd, cmd_str, msqid

syscall.compat_sys_msgrcv

msgflg, msgflg_str, msgp_uaddr, msgsz, msgtyp, msqid

syscall.compat_sys_msgsnd

msgflg, msgflg_str, msgp_uaddr, msgsz, msqid

syscall.compat_sys_recvmsg

flags, flags_str, msg_uaddr, s

syscall.compat_sys_semctl

arg, cmd, cmdstr, semid, semnum

syscall.compat_sys_semtimedop

nsops, semid, sops_uaddr, timeout_uaddr

syscall.compat_sys_sendmsg

flags, flags_str, msg_uaddr, s

syscall.compat_sys_shmat

shmaddr_uaddr, shmflg, shmid

syscall.compat_sys_shmctl

buf_uaddr, cmd, cmd_str, shmid

syscall.compat_sys_utimes

filename

syscall.compat_truncate64

length, path, path_uaddr

syscall.compat_utime

actime, buf_uaddr, filename, filename_uaddr, modtime

syscall.compat_utimensat

dfd, dfd_str, filename, filename_uaddr, flags, flags_str, tsp_uaddr

syscall.compat_vmsplice

fd, flags, flags_str, iov, nr_segs

syscall.connect

addrlen, serv_addr_uaddr, sockfd, uaddr_af, uaddr_ip, uaddr_ip_port, uaddr_ipv6_flowinfo, uaddr_ipv6_scope_id

syscall.creat

mode, pathname

syscall.delete_module

flags, flags_str, name_user

syscall.dup

oldfd

syscall.dup2

flags, newfd, oldfd

syscall.dup3

flags, newfd, oldfd

syscall.epoll_create

flags, size

syscall.epoll_ctl

epfd, event_uaddr, fd, op, op_str

syscall.epoll_pwait

epfd, events_uaddr, maxevents, sigmask_uaddr, sigsetsize, timeout

syscall.epoll_wait

epfd, events_uaddr, maxevents, timeout

syscall.eventfd

count, flags, flags_str

syscall.execve

args, env_str, filename

syscall.execveat

args, dirfd, dirfd_str, env_str, filename, flags, flags_str

syscall.exit

status

syscall.exit_group

status

syscall.faccessat

dirfd, dirfd_str, mode, mode_str, pathname

syscall.fadvise64

advice, fd, len, offset

syscall.fadvise64_64

advice, fd, len, offset

syscall.fallocate

fd, len, mode, mode_str, offset

syscall.fanotify_init

event_f_flags, event_f_flags_str, flags, flags_str

syscall.fanotify_mark

dirfd, dirfd_str, fanotify_fd, flags, flags_str, mask, mask_str, pathname

syscall.fchdir

fd

syscall.fchmod

fildes, mode

syscall.fchmodat

dirfd, dirfd_str, mode, pathname

syscall.fchown

fd, group, owner

syscall.fchown16

fd, group, owner

syscall.fchownat

dirfd, dirfd_str, flags, flags_str, group, owner, pathname

syscall.fcntl

arg, cmd, cmd_str, fd

syscall.fdatasync

fd

syscall.fgetxattr

filedes, name_str, size, value_uaddr

syscall.finit_module

fd, flags, flags_str, uargs

syscall.flistxattr

filedes, list_uaddr, size

syscall.flock

fd, operation

syscall.fork

syscall.fremovexattr

filedes, name_str, name_uaddr

syscall.fsetxattr

filedes, flags, flags_str, name_str, name_uaddr, size, value_str, value_uaddr

syscall.fstat

buf_uaddr, filedes

syscall.fstatat

buf_uaddr, dirfd, dirfd_str, flags, flags_str, path

syscall.fstatfs

buf_uaddr, fd

syscall.fstatfs64

buf_uaddr, fd, sz

syscall.fsync

fd

syscall.ftruncate

fd, length

syscall.futex

futex_uaddr, op, uaddr2_uaddr, utime_uaddr, val3, val

syscall.futimesat

dirfd, dirfd_str, filename, filename_uaddr, tvp_uaddr

syscall.get_mempolicy

addr, flags, flags_str, maxnode, nmask_uaddr, policy_uaddr

syscall.get_robust_list

len_uaddr, list_head_uaddr, pid

syscall.get_thread_area

u_info_uaddr

syscall.getcpu

cpu_uaddr, node_uaddr, tcache_uaddr

syscall.getcwd

buf_uaddr, size

syscall.getdents

count, dirp_uaddr, fd

syscall.getegid

syscall.geteuid

syscall.getgid

syscall.getgroups

list_uaddr, size

syscall.gethostname

len, name_uaddr

syscall.getitimer

value_uaddr, which

syscall.getpeername

name_uaddr, namelen_uaddr, s

syscall.getpgid

pid

syscall.getpgrp

syscall.getpid

syscall.getppid

syscall.getpriority

which, who

syscall.getrandom

buf, count, flags, flags_str

syscall.getresgid

egid_uaddr, rgid_uaddr, sgid_uaddr

syscall.getresuid

euid_uaddr, ruid_uaddr, suid_uaddr

syscall.getrlimit

resource, rlim_uaddr

syscall.getrusage

usage_uaddr, who, who_str

syscall.getsid

pid

syscall.getsockname

name_uaddr, namelen_uaddr, s

syscall.getsockopt

fd, level, level_str, optlen_uaddr, optname, optname_str, optval_uaddr

syscall.gettid

syscall.gettimeofday

tv_uaddr, tz_uaddr

syscall.getuid

syscall.getxattr

name_str, path, size, value_uaddr

syscall.init_module

len, uargs, umod_uaddr

syscall.inotify_add_watch

fd, mask, path, path_uaddr

syscall.inotify_init

flags

syscall.inotify_rm_watch

fd, wd

syscall.io_cancel

ctx_id, iocb_uaddr, result_uaddr

syscall.io_destroy

ctx

syscall.io_getevents

ctx_id, events_uaddr, min_nr, nr, timeout_uaddr, timestr

syscall.io_setup

ctxp_uaddr, maxevents

syscall.io_submit

ctx_id, iocbpp_uaddr, nr

syscall.ioctl

argp, fd, request

syscall.ioperm

from, num, turn_on

syscall.iopl

level

syscall.ioprio_get

which, which_str, who

syscall.ioprio_set

ioprio, ioprio_str, which, which_str, who

syscall.kcmp

idx1, idx2, pid1, pid2, type, type_str

syscall.kexec_file_load

cmdline, cmdline_len, flags, flags_str, initrd_fd, kernel_fd

syscall.kexec_load

entry, flags, flags_str, nr_segments, segments_uaddr

syscall.keyctl

arg2, arg3, arg4, arg5, option

syscall.kill

pid, sig

syscall.lchown

group, owner, path

syscall.lchown16

group, owner, path

syscall.lgetxattr

name_str, path, size, value_uaddr

syscall.link

newpath, oldpath

syscall.linkat

flags, flags_str, newdirfd, newdirfd_str, newpath, olddirfd, olddirfd_str, oldpath

syscall.listen

backlog, sockfd

syscall.listxattr

list_uaddr, path, path_uaddr, size

syscall.llistxattr

list_uaddr, path, path_uaddr, size

syscall.llseek

fd, offset_high, offset_low, result_uaddr, whence, whence_str

syscall.lookup_dcookie

buffer_uaddr, cookie, len

syscall.lremovexattr

name_str, name_uaddr, path, path_uaddr

syscall.lseek

fildes, offset, whence, whence_str

syscall.lsetxattr

flags, flags_str, name_str, name_uaddr, path, path_uaddr, size, value_str, value_uaddr

syscall.lstat

buf_uaddr, path

syscall.madvise

advice, advice_str, length, start

syscall.mbind

flags, flags_str, len, maxnode, mode, mode_str, nmask_uaddr, start

syscall.memfd_create

flags, flags_str, uname

syscall.migrate_pages

maxnode, new_nodes, old_nodes, pid

syscall.mincore

length, start, vec_uaddr

syscall.mkdir

mode, pathname, pathname_uaddr

syscall.mkdirat

dirfd, dirfd_str, mode, pathname

syscall.mknod

dev, mode, pathname

syscall.mknodat

dev, dirfd, dirfd_str, mode, mode_str, pathname

syscall.mlock

addr, len

syscall.mlockall

flags

syscall.mmap2

fd, flags, length, pgoffset, prot, start

syscall.modify_ldt

bytecount, func, ptr_uaddr

syscall.mount

data, filesystemtype, mountflags, mountflags_str, source, target

syscall.move_pages

flags, flags_str, nodes, nr_pages, pages, pid, status

syscall.mprotect

addr, len, prot, prot_str

syscall.mq_getsetattr

mqdes, u_mqstat_uaddr, u_omqstat_uaddr

syscall.mq_notify

mqdes, notification_uaddr

syscall.mq_open

filename, mode, name_uaddr, oflag, u_attr_uaddr

syscall.mq_timedreceive

abs_timeout_uaddr, mqdes, msg_len, msg_prio_uaddr, msg_ptr_uaddr

syscall.mq_timedsend

abs_timeout_uaddr, mqdes, msg_len, msg_prio, msg_ptr_uaddr

syscall.mq_unlink

u_name, u_name_uaddr

syscall.mremap

flags, new_address, new_size, old_address, old_size

syscall.msgctl

buf_uaddr, cmd, cmd_str, msqid

syscall.msgget

key, key_str, msgflg, msgflg_str

syscall.msgrcv

msgflg, msgflg_str, msgp_uaddr, msgsz, msgtyp, msqid

syscall.msgsnd

msgflg, msgflg_str, msgp_uaddr, msgsz, msqid

syscall.msync

flags, length, start

syscall.munlock

addr, len

syscall.munlockall

syscall.munmap

length, start

syscall.name_to_handle_at

dfd, dfd_str, flags, flags_str, handle_uaddr, mnt_id_uaddr, pathname

syscall.nanosleep

rem_uaddr, req_uaddr

syscall.ni_syscall

syscall.nice

inc

syscall.open

filename, flags, mode

syscall.open_by_handle_at

flags, flags_str, handle_uaddr, mount_dfd, mount_dfd_str

syscall.openat

dfd, dfd_str, filename, flags, mode

syscall.pause

syscall.perf_event_open

attr_uaddr, cpu, flags, flags_str, group_fd, pid

syscall.personality

persona

syscall.pipe

fildes_uaddr, flag_str, flags, pipe0, pipe1

syscall.pivot_root

new_root_str, old_root_str

syscall.poll

nfds, timeout, ufds_uaddr

syscall.ppoll

syscall.prctl

arg2, arg3, arg4, arg5, option

syscall.pread

buf_uaddr, count, fd, offset

syscall.preadv

count, fd, offset, vector_uaddr

syscall.prlimit64

new_rlim_uaddr, old_rlim_uaddr, pid, resource

syscall.process_vm_readv

flags, liovcnt, local_iov_uaddr, pid, remote_iov_uaddr, riovcnt

syscall.process_vm_writev

flags, liovcnt, local_iov_uaddr, pid, remote_iov_uaddr, riovcnt

syscall.pselect6

syscall.ptrace

addr, data, pid, request

syscall.pwrite

buf_uaddr, count, fd, offset

syscall.pwritev

count, fd, offset, vector_uaddr

syscall.quotactl

addr_uaddr, cmd, cmd_str, id, special, special_str

syscall.read

buf_uaddr, count, fd

syscall.readahead

count, fd, offset

syscall.readdir

count, dirent, fd

syscall.readlink

buf_uaddr, bufsiz, path

syscall.readlinkat

buf_uaddr, bufsiz, dfd, dfd_str, path

syscall.readv

count, fd, vector_uaddr

syscall.reboot

arg_uaddr, flag, flag_str, magic2, magic2_str, magic, magic_str

syscall.recv

buf_uaddr, flags, flags_str, len, s

syscall.recvfrom

addr_uaddr, addrlen_uaddr, buf_uaddr, flags, flags_str, len, s

syscall.recvmmsg

flags, flags_str, mmsg_uaddr, s, timeout_uaddr, vlen

syscall.recvmsg

flags, flags_str, msg_uaddr, s

syscall.remap_file_pages

flags, pgoff, prot, size, start

syscall.removexattr

name_str, path

syscall.rename

newpath, oldpath

syscall.renameat

newdfd, newdfd_str, newname, newname_str, olddfd, olddfd_str, oldname, oldname_str

syscall.renameat2

flags, flags_str, newdfd, newdfd_str, newname, newname_str, olddfd, olddfd_str, oldname, oldname_str

syscall.request_key

callout_info_uaddr, description_uaddr, destringid, type_uaddr

syscall.restart_syscall

syscall.rmdir

pathname

syscall.rt_sigaction

act_uaddr, oact_uaddr, sig, sigsetsize

syscall.rt_sigaction32

act_uaddr, oact_uaddr, sig, sigsetsize

syscall.rt_sigpending

set_uaddr, sigsetsize

syscall.rt_sigprocmask

how, how_str, oldset_uaddr, set_uaddr

syscall.rt_sigqueueinfo

pid, sig, uinfo_uaddr

syscall.rt_sigreturn

syscall.rt_sigsuspend

set_uaddr, sigsetsize

syscall.rt_sigtimedwait

sigsetsize, uinfo_uaddr, uthese_uaddr, uts_uaddr

syscall.rt_tgsigqueueinfo

sig, tgid, tid, uinfo_uaddr

syscall.sched_get_priority_max

policy

syscall.sched_get_priority_min

policy

syscall.sched_getaffinity

len, mask_uaddr, pid

syscall.sched_getattr

flags, pid, sched_attr_str, sched_attr_uaddr, size

syscall.sched_getparam

p_uaddr, pid

syscall.sched_getscheduler

pid

syscall.sched_rr_get_interval

pid, tp_uaddr

syscall.sched_setaffinity

len, mask_uaddr, pid

syscall.sched_setattr

flags, pid, sched_attr_str, sched_attr_uaddr

syscall.sched_setparam

p_uaddr, pid

syscall.sched_setscheduler

p_uaddr, pid, policy, policy_str

syscall.sched_yield

syscall.seccomp

flags, flags_str, op, op_str, uargs, uargs_uaddr

syscall.select

exceptfds_uaddr, n, readfds_uaddr, timeout_uaddr, writefds_uaddr

syscall.semctl

arg, cmd, cmdstr, semid, semnum

syscall.semget

key, key_str, nsems, semflg, semflg_str

syscall.semop

nsops, semid, sops_uaddr

syscall.semtimedop

nsops, semid, sops_uaddr, timeout_uaddr

syscall.send

buf_uaddr, flags, flags_str, len, s

syscall.sendfile

count, in_fd, offset_uaddr, out_fd

syscall.sendmmsg

flags, flags_str, mmsg_uaddr, s, vlen

syscall.sendmsg

flags, flags_str, msg_uaddr, s

syscall.sendto

buf_uaddr, flags, flags_str, len, s, to_uaddr, tolen

syscall.set_mempolicy

maxnode, mode, mode_str, nmask_uaddr

syscall.set_robust_list

len, list_head_uaddr

syscall.set_thread_area

u_info_uaddr

syscall.set_tid_address

tidptr_uaddr

syscall.setdomainname

domainname_str, domainname_uaddr, len

syscall.setfsgid

fsgid

syscall.setfsuid

fsuid

syscall.setgid

gid

syscall.setgroups

list_uaddr, size

syscall.sethostname

hostname_uaddr, len, name_str

syscall.setitimer

ovalue_uaddr, value_uaddr, which

syscall.setns

fd, nstype

syscall.setpgid

pgid, pid

syscall.setpriority

prio, which, which_str, who

syscall.setregid

egid, rgid

syscall.setregid16

egid, rgid

syscall.setresgid

egid, rgid, sgid

syscall.setresgid16

egid, rgid, sgid

syscall.setresuid

euid, ruid, suid

syscall.setresuid16

euid, ruid, suid

syscall.setreuid

euid, ruid

syscall.setreuid16

euid, ruid

syscall.setrlimit

resource, rlim_uaddr

syscall.setsid

syscall.setsockopt

fd, level, level_str, optlen, optname, optname_str, optval_uaddr

syscall.settimeofday

tv_uaddr, tz_uaddr

syscall.settimeofday32

tv_uaddr, tz_uaddr

syscall.setuid

uid

syscall.setxattr

flags, flags_str, name_str, name_uaddr, path, path_uaddr, size, value_str, value_uaddr

syscall.sgetmask

syscall.shmat

shmaddr_uaddr, shmflg, shmid

syscall.shmctl

buf_uaddr, cmd, cmd_str, shmid

syscall.shmdt

shmaddr_uaddr

syscall.shmget

key, shmflg, shmflg_str, size

syscall.shutdown

how, how_str, s

syscall.sigaction32

act_uaddr, oact_uaddr, sig

syscall.sigaltstack

uoss_uaddr, uss_uaddr

syscall.signal

handler, sig

syscall.signalfd

flags

syscall.sigpending

syscall.sigprocmask

how, how_str, oldset_uaddr, set_uaddr

syscall.sigreturn

syscall.sigsuspend

mask

syscall.socket

family, protocol, type

syscall.socketpair

family, protocol, sv_uaddr, type

syscall.splice

fd_in, fd_out, flags, flags_str, len, off_in, off_out

syscall.ssetmask

newmask, newmask_str

syscall.stat

buf_uaddr, filename, filename_uaddr

syscall.statfs

buf_uaddr, path

syscall.statfs64

buf_uaddr, path, sz

syscall.stime

t_uaddr

syscall.swapoff

path

syscall.swapon

path, swapflags, swapflags_str

syscall.symlink

newpath, oldpath

syscall.symlinkat

newdfd, newdfd_str, newname, newname_str, oldname, oldname_str

syscall.sync

syscall.sync_file_range

fd, flags, flags_str, nbytes, offset

syscall.syncfs

fd

syscall.sysctl

syscall.sysfs

arg1, arg2, option

syscall.sysinfo

info_uaddr

syscall.syslog

bufp_uaddr, len, type

syscall.tee

fdin, fdout, flags, len

syscall.tgkill

pid, sig, tgid

syscall.time

t_uaddr

syscall.timer_create

clockid, clockid_str, evp_uaddr, timerid_uaddr

syscall.timer_delete

timerid

syscall.timer_getoverrun

timerid

syscall.timer_gettime

timerid, value_uaddr

syscall.timer_settime

flags, ovalue_uaddr, timerid, value_uaddr

syscall.timerfd_create

clockid, clockid_str, flags, flags_str

syscall.timerfd_gettime

fd, value_uaddr

syscall.timerfd_settime

fd, flags, flags_str, ovalue_uaddr, value_uaddr

syscall.times

buf_uaddr

syscall.tkill

pid, sig

syscall.truncate

length, path, path_uaddr

syscall.umask

mask

syscall.umount

flags, flags_str, target

syscall.uname

syscall.unlink

pathname, pathname_uaddr

syscall.unlinkat

dfd, dfd_str, flag, flag_str, pathname, pathname_str

syscall.unshare

unshare_flags

syscall.ustat

dev, ubuf_uaddr

syscall.ustat32

dev, ubuf_uaddr

syscall.utime

actime, buf_uaddr, filename, filename_uaddr, modtime

syscall.utimensat

dfd, dfd_str, filename, filename_uaddr, flags, flags_str, tsp_uaddr

syscall.utimes

filename, filename_uaddr, tvp_uaddr

syscall.vfork

syscall.vhangup

syscall.vmsplice

fd, flags, flags_str, iov, nr_segs

syscall.wait4

options, options_str, pid, rusage_uaddr, status_uaddr

syscall.waitid

infop_uaddr, options, options_str, pid, rusage_uaddr, which, which_str

syscall.waitpid

options, options_str, pid, status_uaddr

syscall.write

buf_uaddr, count, fd

syscall.writev

count, fd, vector_uaddr