BEGIN
Probe
The BEGIN
probe fires before any other probe. No other probe fires until all BEGIN
clauses are completed. You can use this probe to initialize any state that is required in other probes. The following example shows how to use the BEGIN
probe to initialize an associative array to map between mmap
protection bits and a textual representation. For information about the mmap
system call, see the mmap
(2) man page.
BEGIN { prot[0] = "---"; prot[1] = "r--"; prot[2] = "-w-"; prot[3] = "rw-"; prot[4] = "--x"; prot[5] = "r-x"; prot[6] = "-wx"; prot[7] = "rwx"; } syscall::mmap:entry { printf("mmap with prot = %s", prot[arg2 & 0x7]); }
The BEGIN
probe fires in an unspecified context. This means that the output of stack
or ustack
, and the value of context-specific variables (for example, execname
), are all arbitrary. These values should not be relied upon or interpreted to infer any meaningful information. No arguments are defined for the BEGIN
probe.