syscall
provides a pair of probes for each
system call: an entry
probe that fires before
the system call is entered, and a return
probe that fires after the system call has completed, but before
control has been transferred back to user-level. For all
syscall
probes, the function name is set as
the name of the instrumented system call.
Often, the system call names that are provided by
syscall
correspond to names in the Section 2
manual pages. However, some syscall
provider
probes do not directly correspond to any documented system call.
Some common reasons for this discrepancy are described in the
following sections.