Following is an overview of available syscall probes and convenience variables they offer. By default, each syscall probe has name and argstr convenience variables, which are not included in the overview in order to keep it short. Non dwarf-based nd_syscall probes are supposed to have the same convenience variables.
Table 35.1. Syscalls list
| syscall | params |
|---|---|
| accept | addr_uaddr, addrlen_uaddr, sockfd |
| accept4 | addr_uaddr, addrlen_uaddr, flags, flags_str, sockfd |
| access | mode, mode_str, pathname |
| acct | filename |
| add_key | description_uaddr, payload_uaddr, plen, ringid, type_uaddr |
| adjtimex | buf_str, buf_uaddr |
| alarm | seconds |
| arch_prctl | addr, code, code_str |
| bdflush | data, data_str, func |
| bind | addrlen, my_addr_uaddr, sockfd, uaddr_af, uaddr_ip, uaddr_ip_port, uaddr_ipv6_flowinfo, uaddr_ipv6_scope_id |
| bpf | attr_uaddr, cmd, cmd_str, size |
| brk | brk |
| capget | data_uaddr, header_uaddr |
| capset | data_uaddr, header_uaddr |
| chdir | path |
| chmod | mode, path |
| chown | group, owner, path |
| chown16 | group, owner, path |
| chroot | path |
| clock_adjtime | clk_id, clk_id_str, tx_uaddr |
| clock_getres | clk_id, clk_id_str, res_uaddr |
| clock_gettime | clk_id, clk_id_str, tp_uaddr |
| clock_nanosleep | clk_id, clk_id_str, flags, flags_str, rem_uaddr, req_uaddr |
| clock_settime | clk_id, clk_id_str, tp_uaddr |
| clone | child_tid_uaddr, clone_flags, parent_tid_uaddr, stack_start |
| close | fd |
| compat_adjtimex | buf_str, buf_uaddr |
| compat_clock_nanosleep | clk_id, clk_id_str, flags, flags_str, rem_uaddr, req_uaddr |
| compat_execve | args, env_str, filename |
| compat_execveat | args, dirfd, dirfd_str, env_str, filename, flags, flags_str |
| compat_fadvise64 | advice, fd, len, offset |
| compat_fadvise64_64 | advice, fd, len, offset |
| compat_fallocate | fd, len, mode, offset |
| compat_ftruncate64 | fd, length |
| compat_futex | futex_uaddr, op, uaddr2_uaddr, utime_uaddr, val3, val |
| compat_futimesat | dirfd, dirfd_str, filename, filename_uaddr, tvp_uaddr |
| compat_getitimer | value_uaddr, which |
| compat_lookup_dcookie | buffer_uaddr, cookie, len |
| compat_nanosleep | rem_uaddr, req_uaddr |
| compat_ppoll | |
| compat_pselect6 | |
| compat_readahead | count, fd, offset |
| compat_recvmmsg | flags, flags_str, mmsg_uaddr, s, timeout_uaddr, vlen |
| compat_rt_sigprocmask | how, how_str, oldset_uaddr, set_uaddr |
| compat_select | exceptfds_uaddr, n, readfds_uaddr, timeout_uaddr, writefds_uaddr |
| compat_setitimer | ovalue_uaddr, value_uaddr, which |
| compat_signalfd | flags |
| compat_sys_msgctl | buf_uaddr, cmd, cmd_str, msqid |
| compat_sys_msgrcv | msgflg, msgflg_str, msgp_uaddr, msgsz, msgtyp, msqid |
| compat_sys_msgsnd | msgflg, msgflg_str, msgp_uaddr, msgsz, msqid |
| compat_sys_recvmsg | flags, flags_str, msg_uaddr, s |
| compat_sys_semctl | arg, cmd, cmdstr, semid, semnum |
| compat_sys_semtimedop | nsops, semid, sops_uaddr, timeout_uaddr |
| compat_sys_sendmsg | flags, flags_str, msg_uaddr, s |
| compat_sys_shmat | shmaddr_uaddr, shmflg, shmid |
| compat_sys_shmctl | buf_uaddr, cmd, cmd_str, shmid |
| compat_sys_utimes | filename |
| compat_truncate64 | length, path, path_uaddr |
| compat_utime | actime, buf_uaddr, filename, filename_uaddr, modtime |
| compat_utimensat | dfd, dfd_str, filename, filename_uaddr, flags, flags_str, tsp_uaddr |
| compat_vmsplice | fd, flags, flags_str, iov, nr_segs |
| connect | addrlen, serv_addr_uaddr, sockfd, uaddr_af, uaddr_ip, uaddr_ip_port, uaddr_ipv6_flowinfo, uaddr_ipv6_scope_id |
| creat | mode, pathname |
| delete_module | flags, flags_str, name_user |
| dup | oldfd |
| dup2 | flags, newfd, oldfd |
| dup3 | flags, newfd, oldfd |
| epoll_create | flags, size |
| epoll_ctl | epfd, event_uaddr, fd, op, op_str |
| epoll_pwait | epfd, events_uaddr, maxevents, sigmask_uaddr, sigsetsize, timeout |
| epoll_wait | epfd, events_uaddr, maxevents, timeout |
| eventfd | count, flags, flags_str |
| execve | args, env_str, filename |
| execveat | args, dirfd, dirfd_str, env_str, filename, flags, flags_str |
| exit | status |
| exit_group | status |
| faccessat | dirfd, dirfd_str, mode, mode_str, pathname |
| fadvise64 | advice, fd, len, offset |
| fadvise64_64 | advice, fd, len, offset |
| fallocate | fd, len, mode, mode_str, offset |
| fanotify_init | event_f_flags, event_f_flags_str, flags, flags_str |
| fanotify_mark | dirfd, dirfd_str, fanotify_fd, flags, flags_str, mask, mask_str, pathname |
| fchdir | fd |
| fchmod | fildes, mode |
| fchmodat | dirfd, dirfd_str, mode, pathname |
| fchown | fd, group, owner |
| fchown16 | fd, group, owner |
| fchownat | dirfd, dirfd_str, flags, flags_str, group, owner, pathname |
| fcntl | arg, cmd, cmd_str, fd |
| fdatasync | fd |
| fgetxattr | filedes, name_str, size, value_uaddr |
| finit_module | fd, flags, flags_str, uargs |
| flistxattr | filedes, list_uaddr, size |
| flock | fd, operation |
| fork | |
| fremovexattr | filedes, name_str, name_uaddr |
| fsetxattr | filedes, flags, flags_str, name_str, name_uaddr, size, value_str, value_uaddr |
| fstat | buf_uaddr, filedes |
| fstatat | buf_uaddr, dirfd, dirfd_str, flags, flags_str, path |
| fstatfs | buf_uaddr, fd |
| fstatfs64 | buf_uaddr, fd, sz |
| fsync | fd |
| ftruncate | fd, length |
| futex | futex_uaddr, op, uaddr2_uaddr, utime_uaddr, val3, val |
| futimesat | dirfd, dirfd_str, filename, filename_uaddr, tvp_uaddr |
| get_mempolicy | addr, flags, flags_str, maxnode, nmask_uaddr, policy_uaddr |
| get_robust_list | len_uaddr, list_head_uaddr, pid |
| get_thread_area | u_info_uaddr |
| getcpu | cpu_uaddr, node_uaddr, tcache_uaddr |
| getcwd | buf_uaddr, size |
| getdents | count, dirp_uaddr, fd |
| getegid | |
| geteuid | |
| getgid | |
| getgroups | list_uaddr, size |
| gethostname | len, name_uaddr |
| getitimer | value_uaddr, which |
| getpeername | name_uaddr, namelen_uaddr, s |
| getpgid | pid |
| getpgrp | |
| getpid | |
| getppid | |
| getpriority | which, who |
| getrandom | buf, count, flags, flags_str |
| getresgid | egid_uaddr, rgid_uaddr, sgid_uaddr |
| getresuid | euid_uaddr, ruid_uaddr, suid_uaddr |
| getrlimit | resource, rlim_uaddr |
| getrusage | usage_uaddr, who, who_str |
| getsid | pid |
| getsockname | name_uaddr, namelen_uaddr, s |
| getsockopt | fd, level, level_str, optlen_uaddr, optname, optname_str, optval_uaddr |
| gettid | |
| gettimeofday | tv_uaddr, tz_uaddr |
| getuid | |
| getxattr | name_str, path, size, value_uaddr |
| init_module | len, uargs, umod_uaddr |
| inotify_add_watch | fd, mask, path, path_uaddr |
| inotify_init | flags |
| inotify_rm_watch | fd, wd |
| io_cancel | ctx_id, iocb_uaddr, result_uaddr |
| io_destroy | ctx |
| io_getevents | ctx_id, events_uaddr, min_nr, nr, timeout_uaddr, timestr |
| io_setup | ctxp_uaddr, maxevents |
| io_submit | ctx_id, iocbpp_uaddr, nr |
| ioctl | argp, fd, request |
| ioperm | from, num, turn_on |
| iopl | level |
| ioprio_get | which, which_str, who |
| ioprio_set | ioprio, ioprio_str, which, which_str, who |
| kcmp | idx1, idx2, pid1, pid2, type, type_str |
| kexec_file_load | cmdline, cmdline_len, flags, flags_str, initrd_fd, kernel_fd |
| kexec_load | entry, flags, flags_str, nr_segments, segments_uaddr |
| keyctl | arg2, arg3, arg4, arg5, option |
| kill | pid, sig |
| lchown | group, owner, path |
| lchown16 | group, owner, path |
| lgetxattr | name_str, path, size, value_uaddr |
| link | newpath, oldpath |
| linkat | flags, flags_str, newdirfd, newdirfd_str, newpath, olddirfd, olddirfd_str, oldpath |
| listen | backlog, sockfd |
| listxattr | list_uaddr, path, path_uaddr, size |
| llistxattr | list_uaddr, path, path_uaddr, size |
| llseek | fd, offset_high, offset_low, result_uaddr, whence, whence_str |
| lookup_dcookie | buffer_uaddr, cookie, len |
| lremovexattr | name_str, name_uaddr, path, path_uaddr |
| lseek | fildes, offset, whence, whence_str |
| lsetxattr | flags, flags_str, name_str, name_uaddr, path, path_uaddr, size, value_str, value_uaddr |
| lstat | buf_uaddr, path |
| madvise | advice, advice_str, length, start |
| mbind | flags, flags_str, len, maxnode, mode, mode_str, nmask_uaddr, start |
| memfd_create | flags, flags_str, uname |
| migrate_pages | maxnode, new_nodes, old_nodes, pid |
| mincore | length, start, vec_uaddr |
| mkdir | mode, pathname, pathname_uaddr |
| mkdirat | dirfd, dirfd_str, mode, pathname |
| mknod | dev, mode, pathname |
| mknodat | dev, dirfd, dirfd_str, mode, mode_str, pathname |
| mlock | addr, len |
| mlockall | flags |
| mmap2 | fd, flags, length, pgoffset, prot, start |
| modify_ldt | bytecount, func, ptr_uaddr |
| mount | data, filesystemtype, mountflags, mountflags_str, source, target |
| move_pages | flags, flags_str, nodes, nr_pages, pages, pid, status |
| mprotect | addr, len, prot, prot_str |
| mq_getsetattr | mqdes, u_mqstat_uaddr, u_omqstat_uaddr |
| mq_notify | mqdes, notification_uaddr |
| mq_open | filename, mode, name_uaddr, oflag, u_attr_uaddr |
| mq_timedreceive | abs_timeout_uaddr, mqdes, msg_len, msg_prio_uaddr, msg_ptr_uaddr |
| mq_timedsend | abs_timeout_uaddr, mqdes, msg_len, msg_prio, msg_ptr_uaddr |
| mq_unlink | u_name, u_name_uaddr |
| mremap | flags, new_address, new_size, old_address, old_size |
| msgctl | buf_uaddr, cmd, cmd_str, msqid |
| msgget | key, key_str, msgflg, msgflg_str |
| msgrcv | msgflg, msgflg_str, msgp_uaddr, msgsz, msgtyp, msqid |
| msgsnd | msgflg, msgflg_str, msgp_uaddr, msgsz, msqid |
| msync | flags, length, start |
| munlock | addr, len |
| munlockall | |
| munmap | length, start |
| name_to_handle_at | dfd, dfd_str, flags, flags_str, handle_uaddr, mnt_id_uaddr, pathname |
| nanosleep | rem_uaddr, req_uaddr |
| ni_syscall | |
| nice | inc |
| open | filename, flags, mode |
| open_by_handle_at | flags, flags_str, handle_uaddr, mount_dfd, mount_dfd_str |
| openat | dfd, dfd_str, filename, flags, mode |
| pause | |
| perf_event_open | attr_uaddr, cpu, flags, flags_str, group_fd, pid |
| personality | persona |
| pipe | fildes_uaddr, flag_str, flags, pipe0, pipe1 |
| pivot_root | new_root_str, old_root_str |
| poll | nfds, timeout, ufds_uaddr |
| ppoll | |
| prctl | arg2, arg3, arg4, arg5, option |
| pread | buf_uaddr, count, fd, offset |
| preadv | count, fd, offset, vector_uaddr |
| prlimit64 | new_rlim_uaddr, old_rlim_uaddr, pid, resource |
| process_vm_readv | flags, liovcnt, local_iov_uaddr, pid, remote_iov_uaddr, riovcnt |
| process_vm_writev | flags, liovcnt, local_iov_uaddr, pid, remote_iov_uaddr, riovcnt |
| pselect6 | |
| ptrace | addr, data, pid, request |
| pwrite | buf_uaddr, count, fd, offset |
| pwritev | count, fd, offset, vector_uaddr |
| quotactl | addr_uaddr, cmd, cmd_str, id, special, special_str |
| read | buf_uaddr, count, fd |
| readahead | count, fd, offset |
| readdir | count, dirent, fd |
| readlink | buf_uaddr, bufsiz, path |
| readlinkat | buf_uaddr, bufsiz, dfd, dfd_str, path |
| readv | count, fd, vector_uaddr |
| reboot | arg_uaddr, flag, flag_str, magic2, magic2_str, magic, magic_str |
| recv | buf_uaddr, flags, flags_str, len, s |
| recvfrom | addr_uaddr, addrlen_uaddr, buf_uaddr, flags, flags_str, len, s |
| recvmmsg | flags, flags_str, mmsg_uaddr, s, timeout_uaddr, vlen |
| recvmsg | flags, flags_str, msg_uaddr, s |
| remap_file_pages | flags, pgoff, prot, size, start |
| removexattr | name_str, path |
| rename | newpath, oldpath |
| renameat | newdfd, newdfd_str, newname, newname_str, olddfd, olddfd_str, oldname, oldname_str |
| renameat2 | flags, flags_str, newdfd, newdfd_str, newname, newname_str, olddfd, olddfd_str, oldname, oldname_str |
| request_key | callout_info_uaddr, description_uaddr, destringid, type_uaddr |
| restart_syscall | |
| rmdir | pathname |
| rt_sigaction | act_uaddr, oact_uaddr, sig, sigsetsize |
| rt_sigaction32 | act_uaddr, oact_uaddr, sig, sigsetsize |
| rt_sigpending | set_uaddr, sigsetsize |
| rt_sigprocmask | how, how_str, oldset_uaddr, set_uaddr |
| rt_sigqueueinfo | pid, sig, uinfo_uaddr |
| rt_sigreturn | |
| rt_sigsuspend | set_uaddr, sigsetsize |
| rt_sigtimedwait | sigsetsize, uinfo_uaddr, uthese_uaddr, uts_uaddr |
| rt_tgsigqueueinfo | sig, tgid, tid, uinfo_uaddr |
| sched_get_priority_max | policy |
| sched_get_priority_min | policy |
| sched_getaffinity | len, mask_uaddr, pid |
| sched_getattr | flags, pid, sched_attr_str, sched_attr_uaddr, size |
| sched_getparam | p_uaddr, pid |
| sched_getscheduler | pid |
| sched_rr_get_interval | pid, tp_uaddr |
| sched_setaffinity | len, mask_uaddr, pid |
| sched_setattr | flags, pid, sched_attr_str, sched_attr_uaddr |
| sched_setparam | p_uaddr, pid |
| sched_setscheduler | p_uaddr, pid, policy, policy_str |
| sched_yield | |
| seccomp | flags, flags_str, op, op_str, uargs, uargs_uaddr |
| select | exceptfds_uaddr, n, readfds_uaddr, timeout_uaddr, writefds_uaddr |
| semctl | arg, cmd, cmdstr, semid, semnum |
| semget | key, key_str, nsems, semflg, semflg_str |
| semop | nsops, semid, sops_uaddr |
| semtimedop | nsops, semid, sops_uaddr, timeout_uaddr |
| send | buf_uaddr, flags, flags_str, len, s |
| sendfile | count, in_fd, offset_uaddr, out_fd |
| sendmmsg | flags, flags_str, mmsg_uaddr, s, vlen |
| sendmsg | flags, flags_str, msg_uaddr, s |
| sendto | buf_uaddr, flags, flags_str, len, s, to_uaddr, tolen |
| set_mempolicy | maxnode, mode, mode_str, nmask_uaddr |
| set_robust_list | len, list_head_uaddr |
| set_thread_area | u_info_uaddr |
| set_tid_address | tidptr_uaddr |
| setdomainname | domainname_str, domainname_uaddr, len |
| setfsgid | fsgid |
| setfsuid | fsuid |
| setgid | gid |
| setgroups | list_uaddr, size |
| sethostname | hostname_uaddr, len, name_str |
| setitimer | ovalue_uaddr, value_uaddr, which |
| setns | fd, nstype |
| setpgid | pgid, pid |
| setpriority | prio, which, which_str, who |
| setregid | egid, rgid |
| setregid16 | egid, rgid |
| setresgid | egid, rgid, sgid |
| setresgid16 | egid, rgid, sgid |
| setresuid | euid, ruid, suid |
| setresuid16 | euid, ruid, suid |
| setreuid | euid, ruid |
| setreuid16 | euid, ruid |
| setrlimit | resource, rlim_uaddr |
| setsid | |
| setsockopt | fd, level, level_str, optlen, optname, optname_str, optval_uaddr |
| settimeofday | tv_uaddr, tz_uaddr |
| settimeofday32 | tv_uaddr, tz_uaddr |
| setuid | uid |
| setxattr | flags, flags_str, name_str, name_uaddr, path, path_uaddr, size, value_str, value_uaddr |
| sgetmask | |
| shmat | shmaddr_uaddr, shmflg, shmid |
| shmctl | buf_uaddr, cmd, cmd_str, shmid |
| shmdt | shmaddr_uaddr |
| shmget | key, shmflg, shmflg_str, size |
| shutdown | how, how_str, s |
| sigaction32 | act_uaddr, oact_uaddr, sig |
| sigaltstack | uoss_uaddr, uss_uaddr |
| signal | handler, sig |
| signalfd | flags |
| sigpending | |
| sigprocmask | how, how_str, oldset_uaddr, set_uaddr |
| sigreturn | |
| sigsuspend | mask |
| socket | family, protocol, type |
| socketpair | family, protocol, sv_uaddr, type |
| splice | fd_in, fd_out, flags, flags_str, len, off_in, off_out |
| ssetmask | newmask, newmask_str |
| stat | buf_uaddr, filename, filename_uaddr |
| statfs | buf_uaddr, path |
| statfs64 | buf_uaddr, path, sz |
| stime | t_uaddr |
| swapoff | path |
| swapon | path, swapflags, swapflags_str |
| symlink | newpath, oldpath |
| symlinkat | newdfd, newdfd_str, newname, newname_str, oldname, oldname_str |
| sync | |
| sync_file_range | fd, flags, flags_str, nbytes, offset |
| syncfs | fd |
| sysctl | |
| sysfs | arg1, arg2, option |
| sysinfo | info_uaddr |
| syslog | bufp_uaddr, len, type |
| tee | fdin, fdout, flags, len |
| tgkill | pid, sig, tgid |
| time | t_uaddr |
| timer_create | clockid, clockid_str, evp_uaddr, timerid_uaddr |
| timer_delete | timerid |
| timer_getoverrun | timerid |
| timer_gettime | timerid, value_uaddr |
| timer_settime | flags, ovalue_uaddr, timerid, value_uaddr |
| timerfd_create | clockid, clockid_str, flags, flags_str |
| timerfd_gettime | fd, value_uaddr |
| timerfd_settime | fd, flags, flags_str, ovalue_uaddr, value_uaddr |
| times | buf_uaddr |
| tkill | pid, sig |
| truncate | length, path, path_uaddr |
| umask | mask |
| umount | flags, flags_str, target |
| uname | |
| unlink | pathname, pathname_uaddr |
| unlinkat | dfd, dfd_str, flag, flag_str, pathname, pathname_str |
| unshare | unshare_flags |
| ustat | dev, ubuf_uaddr |
| ustat32 | dev, ubuf_uaddr |
| utime | actime, buf_uaddr, filename, filename_uaddr, modtime |
| utimensat | dfd, dfd_str, filename, filename_uaddr, flags, flags_str, tsp_uaddr |
| utimes | filename, filename_uaddr, tvp_uaddr |
| vfork | |
| vhangup | |
| vmsplice | fd, flags, flags_str, iov, nr_segs |
| wait4 | options, options_str, pid, rusage_uaddr, status_uaddr |
| waitid | infop_uaddr, options, options_str, pid, rusage_uaddr, which, which_str |
| waitpid | options, options_str, pid, status_uaddr |
| write | buf_uaddr, count, fd |
| writev | count, fd, vector_uaddr |