AFAIK different linux tracing tools gather information from /sys/kernel/debug/tracing/events directory where different events are logged. Can anyone explain the difference between "syscalls" event and "raw_syscalls" event?

I want to know this difference in order to find out which event to trace if I want to log all system calls currently being invoked on my system. I know there are tools like strace and perf trace out there, but I want to create my own.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.