BEGIN Probe

The BEGIN probe fires before any other probe. No other probe fires until all BEGIN clauses are completed. You can use this probe to initialize any state that is required in other probes. The following example shows how to use the BEGIN probe to initialize an associative array to map between mmap protection bits and a textual representation. For information about the mmap system call, see the mmap(2) man page.

BEGIN
{
        prot[0] = "---";
        prot[1] = "r--";
        prot[2] = "-w-";
        prot[3] = "rw-";
        prot[4] = "--x";
        prot[5] = "r-x";
        prot[6] = "-wx";
        prot[7] = "rwx";
}

syscall::mmap:entry
{
        printf("mmap with prot = %s", prot[arg2 & 0x7]);
}

The BEGIN probe fires in an unspecified context. This means that the output of stack or ustack, and the value of context-specific variables (for example, execname), are all arbitrary. These values should not be relied upon or interpreted to infer any meaningful information. No arguments are defined for the BEGIN probe.