syscall provides a pair of probes for each system call: an entry probe that fires before the system call is entered, and a return probe that fires after the system call has completed, but before control has been transferred back to user-level. For all syscall probes, the function name is set as the name of the instrumented system call.

Often, the system call names that are provided by syscall correspond to names in the Section 2 manual pages. However, some syscall provider probes do not directly correspond to any documented system call. Some common reasons for this discrepancy are described in the following sections.