[....]
probe syscall.read = kernel.function("sys_read") {
name = "read"
fd = $fd
buf_uaddr = $buf
count = $count
tracestr = "read ".string(fd)." ".string(count)
}
probe syscall.read.return = kernel.function("sys_read").return {
name = "read"
returnp = 1
}
--------
probe syscall.open, syscall.read,
syscall.open.return, syscall.read.return {
if (pid() == target()) {
if (returnp)
printf("%s returned %d\n", name, returnval())
else
log(tracestr)
}
}
Note that I've replaced "kernel.syscall" with just "syscall".
I've created a string "tracestr" that each syscall returns with the name
and formatted arguments. I've been debating if I want to include the
name or just the args. So in my example I would do
printf("%s: %s\n", name, argstr)
I've created another variable all return probes set called "returnp".