The syscall
provider makes available a probe at
the entry to and return from every system call in the system.
Because system calls are the primary interface between user-level
applications and the operating system kernel, the
syscall
provider can offer tremendous insight
into application behavior with respect to the system.