AFAIK different linux tracing tools gather information from /sys/kernel/debug/tracing/events directory where different events are logged. Can anyone explain the difference between "syscalls" event and "raw_syscalls" event?

I want to know this difference in order to find out which event to trace if I want to log all system calls currently being invoked on my system. I know there are tools like strace and perf trace out there, but I want to create my own.

1 Answer 1


The syscalls group has separate events for each specific syscall, with the arguments traced according to that syscall.

The sys_enter and sys_exit events in raw_syscalls/ trace every syscall that happens, but it can only display the syscall number and the values of the arguments, without their names.

As for which one is better for implementing a tool like strace, with syscalls you can easily display the basic information about the syscall (i.e. syscall name, arguments names and raw argument values).

However, note that this information is very little compared to what a tool like strace gets by attaching with ptrace to the program. That is because in syscalls events, the kernel doesn't dereference any pointer passed to the syscall, while with ptrace, strace has full access to the program's memory and can dereference arguments at will.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .