Fields Library for Threat Detection Rules

Sysdig Secure enables you to create and customize Threat Detection Rules to secure your environment. A rule file, formatted in YAML, comprises conditions and outputs. You can specify event fields within the rule to define conditions and outputs. This topic covers the fields supported by Sysdig Secure, including those defined in the output key of a rule, which are also displayed in the associated events in the Event feed.

In a Threat Detection rule, a field refers to a specific attribute of an event captured from the system call. You use fields to define conditions and outputs within the rules, allowing you to specify what events should trigger events or actions based on the specified conditions. These fields help Sysdig Secure identify and respond to suspicious or unauthorized activities within your environment. This topic provides a comprehensive understanding of all the supported fields that you can include in a Threat Detection rule.

Field Class: evt

These fields can be used for all event types.

Event Sources: syscall

NameTypeDescription
evt.numUINT64The event number.
evt.timeCHARBUFThe event timestamp as a time string that includes the nanosecond part.
evt.time.sCHARBUFThe event timestamp as a time string with no nanoseconds.
evt.time.iso8601CHARBUFThe event timestamp in ISO 8601 format, including nanoseconds and time zone offset (in UTC).
evt.datetimeCHARBUFThe event timestamp as a time string that includes the date.
evt.datetime.sCHARBUFThe event timestamp as a datetime string with no nanoseconds.
evt.rawtimeABSTIMEThe absolute event timestamp, i.e. nanoseconds from epoch.
evt.rawtime.sABSTIMEThe integer part of the event timestamp (e.g. seconds since epoch).
evt.rawtime.nsABSTIMEThe fractional part of the absolute event timestamp.
evt.reltimeRELTIMEThe number of nanoseconds from the beginning of the capture.
evt.reltime.sRELTIMEThe number of seconds from the beginning of the capture.
evt.reltime.nsRELTIMEThe fractional part (in ns) of the time from the beginning of the capture.
evt.pluginnameCHARBUFif the event comes from a plugin-defined event source, the name of the plugin that generated it. The plugin must be currently loaded.
evt.plugininfoCHARBUFif the event comes from a plugin-defined event source, a summary of the event as formatted by the plugin. The plugin must be currently loaded.
evt.sourceCHARBUFThe name of the source that produced the event.
evt.is_asyncBOOL’true’ for asynchronous events, ‘false’ otherwise.
evt.asynctypeCHARBUFIf the event is asynchronous, the type of the event (e.g. ‘container’).
evt.hostnameCHARBUFThe hostname of the underlying host can be customized by setting an environment variable (e.g. FALCO_HOSTNAME for the Falco agent). This is valuable in Kubernetes setups, where the hostname can match the pod name particularly in DaemonSet deployments. To achieve this, assign Kubernetes’ spec.nodeName to the environment variable. Notably, spec.nodeName generally includes the cluster name.

Field Class: evt

The event fields that are applicable to syscall events. Note that for most events you can access the individual arguments of each syscall via evt.arg. For example, evt.arg.filename.

Event Sources: syscall

NameTypeDescription
evt.latencyRELTIMEThe delta between an exit event and the correspondent enter event, in nanoseconds.
evt.latency.sRELTIMEThe integer part of the event latency delta.
evt.latency.nsRELTIMEThe fractional part of the event latency delta.
evt.latency.humanCHARBUFThe delta between an exit event and the correspondent enter event, as a human readable string (e.g. 10.3ms).
evt.deltatimeRELTIMEThe delta between this event and the previous event, in nanoseconds.
evt.deltatime.sRELTIMEThe integer part of the delta between this event and the previous event.
evt.deltatime.nsRELTIMEThe fractional part of the delta between this event and the previous event.
evt.dirCHARBUFThe event direction can be either ‘>’ for enter events or ‘<’ for exit events.
evt.typeCHARBUFThe name of the event. For example, ‘open’.
evt.type.isUINT32Allows yoy to specify an event type, and returns 1 for events that are of that type. For example, evt.type.is.open returns 1 for open events, 0 for any other event.
syscall.typeCHARBUFFor system call events, the name of the system call. For example, ‘open’. Unset for other events. For example, switch or internal events. Use this field instead of evt.type if you need to make sure that the filtered/printed value is actually a system call.
evt.categoryCHARBUFThe event category. Example values are ‘file’ (for file operations like open and close), ’net’ (for network operations like socket and bind), memory (for things like brk or mmap), and so on.
evt.cpuINT16The number of the CPU where this event happened.
evt.argsCHARBUFAll the event arguments, aggregated into a single string.
evt.argCHARBUFOne of the event arguments specified by name or by number. Some events, such as return codes or FDs will be converted into a text representation when possible. E.g. ’evt.arg.fd’ or ’evt.arg[0]’.
evt.rawargDYNAMICOne of the event arguments specified by name. For example, ’evt.rawarg.fd’.
evt.infoCHARBUFFor most events, this field returns the same value as evt.args. However, for some events, such as those write to /dev/log, it provides higher level of information coming from decoding the arguments.
evt.bufferBYTEBUFThe binary data buffer for events that have one, like read(), recvfrom(), etc. Use this field in filters with ‘contains’ to search into I/O data buffers.
evt.buflenUINT64The length of the binary data buffer for events that have one, like read(), recvfrom(), etc.
evt.resCHARBUFevent return value, as a string. If the event failed, the result is an error code string, such as ‘ENOENT’, otherwise the result is the string ‘SUCCESS’.
evt.rawresINT64The event returns value as a number. For example, -2. Useful for range comparisons.
evt.failedBOOL’true’ for events that returned an error status.
evt.is_ioBOOL’true’ for events that read or write to FDs, like read(), send, recvfrom(), etc.
evt.is_io_readBOOL’true’ for events that read from FDs, like read(), recv(), recvfrom(), etc.
evt.is_io_writeBOOL’true’ for events that write to FDs, like write(), send(), etc.
evt.io_dirCHARBUF‘r’ for events that read from FDs, like read(); ‘w’ for events that write to FDs, like write().
evt.is_waitBOOL’true’ for events that make the thread wait, e.g. sleep(), select(), poll().
evt.wait_latencyRELTIMEFor events that make the thread wait (e.g. sleep(), select(), poll()), this is the time spent waiting for the event to return, in nanoseconds.
evt.is_syslogBOOL’true’ for events that are writes to /dev/log.
evt.countUINT32This filter field always returns 1.
evt.count.errorUINT32This filter field returns 1 for events that returned with an error.
evt.count.error.fileUINT32This filter field returns 1 for events that returned with an error and are related to file I/O.
evt.count.error.netUINT32This filter field returns 1 for events that returned with an error and are related to network I/O.
evt.count.error.memoryUINT32This filter field returns 1 for events that returned with an error and are related to memory allocation.
evt.count.error.otherUINT32This filter field returns 1 for events that returned with an error and are related to none of the previous categories.
evt.count.exitUINT32This filter field returns 1 for exit events.
evt.aroundUINT64Accepts the event if it’s around the specified time interval. The syntax is evt.around[T]=D, where T is the value returned by %evt.rawtime for the event and D is a delta in milliseconds. For example, evt.around[1404996934793590564]=1000 will return the events with timestamp with one second before the timestamp and one second after it, for a total of two seconds of capture.
evt.abspathCHARBUFAbsolute path calculated from dirfd and name during syscalls like renameat and symlinkat. Use ’evt.abspath.src’ or ’evt.abspath.dst’ for syscalls that support multiple paths.
evt.is_open_readBOOL’true’ for open/openat/openat2/open_by_handle_at events where the path was opened for reading
evt.is_open_writeBOOL’true’ for open/openat/openat2/open_by_handle_at events where the path was opened for writing
evt.is_open_execBOOL’true’ for open/openat/openat2/open_by_handle_at or creat events where a file is created with execute permissions
evt.is_open_createBOOL’true’ for for open/openat/openat2/open_by_handle_at events where a file is created.

Field Class: process

Additional information about the process and thread executing the syscall event.

Event Sources: syscall

NameTypeDescription
proc.exeCHARBUFThe first command-line argument (i.e., argv[0]), typically the executable name or a custom string as specified by the user. It is primarily obtained from syscall arguments, truncated after 4096 bytes, or, as a fallback, by reading /proc/PID/cmdline, in which case it may be truncated after 1024 bytes. This field may differ from the last component of proc.exepath, reflecting how command invocation and execution paths can vary.
proc.pexeCHARBUFThe proc.exe (first command line argument argv[0]) of the parent process.
proc.aexeCHARBUFThe proc.exe (first command line argument argv[0]) for a specific process ancestor. You can access different levels of ancestors by using indices. For example, proc.aexe[1] retrieves the proc.exe of the parent process, proc.aexe[2] retrieves the proc.exe of the grandparent process, and so on. The current process’s proc.exe line can be obtained using proc.aexe[0]. When used without any arguments, proc.aexe is applicable only in filters and matches any of the process ancestors. For instance, you can use proc.aexe endswith java to match any process ancestor whose proc.exe ends with the term java.
proc.exepathCHARBUFThe full executable path of a process, resolving to the canonical path for symlinks. This is primarily obtained from the kernel, or as a fallback, by reading /proc/PID/exe (in the latter case, the path is truncated after 1024 bytes). For eBPF drivers, due to verifier limits, path components may be truncated to 24 for legacy eBPF on kernel <5.2, 48 for legacy eBPF on kernel >=5.2, or 96 for modern eBPF.
proc.pexepathCHARBUFThe proc.exepath (full executable path) of the parent process.
proc.aexepathCHARBUFThe proc.exepath (full executable path) for a specific process ancestor. You can access different levels of ancestors by using indices. For example, proc.aexepath[1] retrieves the proc.exepath of the parent process, proc.aexepath[2] retrieves the proc.exepath of the grandparent process, and so on. The current process’s proc.exepath line can be obtained using proc.aexepath[0]. When used without any arguments, proc.aexepath is applicable only in filters and matches any of the process ancestors. For instance, you can use proc.aexepath endswith java to match any process ancestor whose path ends with the term java.
proc.nameCHARBUFThe process name (truncated after 16 characters) generating the event (task->comm). Truncation is determined by kernel settings and not by Falco. This field is collected from the syscalls args or, as a fallback, extracted from /proc/PID/status. The name of the process and the name of the executable file on disk (if applicable) can be different if a process is given a custom name which is often the case for example for java applications.
proc.pnameCHARBUFThe proc.name truncated after 16 characters) of the process generating the event.
proc.anameCHARBUFThe proc.name (truncated after 16 characters) for a specific process ancestor. You can access different levels of ancestors by using indices. For example, proc.aname[1] retrieves the proc.name of the parent process, proc.aname[2] retrieves the proc.name of the grandparent process, and so on. The current process’s proc.name line can be obtained using proc.aname[0]. When used without any arguments, proc.aname is applicable only in filters and matches any of the process ancestors. For instance, you can use proc.aname=bash to match any process ancestor whose name is bash.
proc.argsCHARBUFThe arguments passed on the command line when starting the process generating the event excluding argv[0] (truncated after 4096 bytes). This field is collected from the syscalls args or, as a fallback, extracted from /proc/PID/cmdline.
proc.cmdlineCHARBUFThe concatenation of proc.name + proc.args (truncated after 4096 bytes) when starting the process generating the event.
proc.pcmdlineCHARBUFThe proc.cmdline (full command line (proc.name + proc.args)) of the parent of the process generating the event.
proc.acmdlineCHARBUFThe full command line (proc.name + proc.args) for a specific process ancestor. You can access different levels of ancestors by using indices. For example, proc.acmdline[1] retrieves the full command line of the parent process, proc.acmdline[2] retrieves the proc.cmdline of the grandparent process, and so on. The current process’s full command line can be obtained using proc.acmdline[0]. When used without any arguments, proc.acmdline is applicable only in filters and matches any of the process ancestors. For instance, you can use proc.acmdline contains base64 to match any process ancestor whose command line contains the term base64.
proc.cmdnargsUINT64The number of command line args (proc.args).
proc.cmdlenargsUINT64The total count of characters / length of the command line args (proc.args) combined excluding whitespaces between args.
proc.exelineCHARBUFThe full command line, with exe as first argument (proc.exe + proc.args) when starting the process generating the event.
proc.envCHARBUFThe environment variables of the process generating the event as concatenated string ‘ENV_NAME=value ENV_NAME1=value1’. Can also be used to extract the value of a known env variable, e.g. proc.env[ENV_NAME].
proc.aenvCHARBUF[EXPERIMENTAL] This field can be used in three flavors: (1) as a filter checking all parents, e.g. ‘proc.aenv contains xyz’, which is similar to the familiar ‘proc.aname contains xyz’ approach, (2) checking the proc.env of a specified level of the parent, e.g. ‘proc.aenv[2]’, which is similar to the familiar ‘proc.aname[2]’ approach, or (3) checking the first matched value of a known ENV_NAME in the parent lineage, such as ‘proc.aenv[ENV_NAME]’ (across a max of 20 ancestor levels). This field may be deprecated or undergo breaking changes in future releases. Please use it with caution.
proc.cwdCHARBUFThe current working directory of the event.
proc.loginshellidINT64The pid of the oldest shell among the ancestors of the current process, if there is one. This field can be used to separate different user sessions.
proc.ttyUINT32The controlling terminal of the process. 0 for processes without a terminal.
proc.pidINT64The id of the process generating the event.
proc.ppidINT64The pid of the parent of the process generating the event.
proc.apidINT64The pid for a specific process ancestor. You can access different levels of ancestors by using indices. For example, proc.apid[1] retrieves the pid of the parent process, proc.apid[2] retrieves the pid of the grandparent process, and so on. The current process’s pid can be obtained using proc.apid[0]. When used without any arguments, proc.apid is applicable only in filters and matches any of the process ancestors. For instance, you can use proc.apid=1337 to match any process ancestor whose pid is equal to 1337.
proc.vpidINT64The id of the process generating the event as seen from its current PID namespace.
proc.pvpidINT64The id of the parent process generating the event as seen from its current PID namespace.
proc.sidINT64The session id of the process generating the event.
proc.snameCHARBUFThe name of the current process’s session leader. This is either the process with pid=proc.sid or the eldest ancestor that has the same sid as the current process.
proc.sid.exeCHARBUFThe first command line argument argv[0] (usually the executable name or a custom one) of the current process’s session leader. This is either the process with pid=proc.sid or the eldest ancestor that has the same sid as the current process.
proc.sid.exepathCHARBUFThe full executable path of the current process’s session leader. This is either the process with pid=proc.sid or the eldest ancestor that has the same sid as the current process.
proc.vpgidINT64The process group id of the process generating the event, as seen from its current PID namespace.
proc.vpgid.nameCHARBUFThe name of the current process’s process group leader. This is either the process with proc.vpgid == proc.vpid or the eldest ancestor that has the same vpgid as the current process. The description of proc.is_vpgid_leader offers additional insights.
proc.vpgid.exeCHARBUFThe first command line argument argv[0] (usually the executable name or a custom one) of the current process’s process group leader. This is either the process with proc.vpgid == proc.vpid or the eldest ancestor that has the same vpgid as the current process. The description of proc.is_vpgid_leader offers additional insights.
proc.vpgid.exepathCHARBUFThe full executable path of the current process’s process group leader. This is either the process with proc.vpgid == proc.vpid or the eldest ancestor that has the same vpgid as the current process. The description of proc.is_vpgid_leader offers additional insights.
proc.durationRELTIMENumber of nanoseconds since the process started.
proc.ppid.durationRELTIMENumber of nanoseconds since the parent process started.
proc.pid.tsRELTIMEStart of process as epoch timestamp in nanoseconds.
proc.ppid.tsRELTIMEStart of parent process as epoch timestamp in nanoseconds.
proc.is_exe_writableBOOL’true’ if this process’ executable file is writable by the same user that spawned the process.
proc.is_exe_upper_layerBOOL’true’ if this process’ executable file is in upper layer in overlayfs. This field value can only be trusted if the underlying kernel version is greater or equal than 3.18.0, since overlayfs was introduced at that time.
proc.is_exe_from_memfdBOOL’true’ if the executable file of the current process is an anonymous file created using memfd_create() and is being executed by referencing its file descriptor (fd). This type of file exists only in memory and not on disk. Relevant to detect malicious in-memory code injection. Requires kernel version greater or equal to 3.17.0.
proc.is_sid_leaderBOOL’true’ if this process is the leader of the process session, proc.sid == proc.vpid. For host processes vpid reflects pid.
proc.is_vpgid_leaderBOOL’true’ if this process is the leader of the virtual process group, proc.vpgid == proc.vpid. For host processes vpgid and vpid reflect pgid and pid. Can help to distinguish if the process was ‘directly’ executed for instance in a tty (similar to bash history logging, is_vpgid_leader would be ’true’) or executed as descendent process in the same process group which for example is the case when subprocesses are spawned from a script (is_vpgid_leader would be ‘false’).
proc.exe_inoINT64The inode number of the executable file on disk. Can be correlated with fd.ino.
proc.exe_ino.ctimeABSTIMELast status change time of executable file (inode->ctime) as epoch timestamp in nanoseconds. Time is changed by writing or by setting inode information e.g. owner, group, link count, mode etc.
proc.exe_ino.mtimeABSTIMELast modification time of executable file (inode->mtime) as epoch timestamp in nanoseconds. Time is changed by file modifications, e.g. by mknod, truncate, utime, write of more than zero bytes etc. For tracking changes in owner, group, link count or mode, use proc.exe_ino.ctime instead.
proc.exe_ino.ctime_duration_proc_startABSTIMENumber of nanoseconds between modifying status of executable image and spawning a new process using the changed executable image.
proc.exe_ino.ctime_duration_pidns_startABSTIMENumber of nanoseconds between PID namespace start ts and ctime exe file if PID namespace start predates ctime.
proc.pidns_init_start_tsUINT64Start of PID namespace (container or non container pid namespace) as epoch timestamp in nanoseconds.
thread.cap_permittedCHARBUFThe permitted capabilities set
thread.cap_inheritableCHARBUFThe inheritable capabilities set
thread.cap_effectiveCHARBUFThe effective capabilities set
proc.is_container_healthcheckBOOL’true’ if this process is running as a part of the container’s health check.
proc.is_container_liveness_probeBOOL’true’ if this process is running as a part of the container’s liveness probe.
proc.is_container_readiness_probeBOOL’true’ if this process is running as a part of the container’s readiness probe.
proc.fdopencountUINT64Number of open FDs for the process
proc.fdlimitINT64Maximum number of FDs the process can open.
proc.fdusageDOUBLEThe ratio between open FDs and maximum available FDs for the process.
proc.vmsizeUINT64Total virtual memory for the process (as kb).
proc.vmrssUINT64Resident non-swapped memory for the process (as kb).
proc.vmswapUINT64Swapped memory for the process (as kb).
thread.pfmajorUINT64Number of major page faults since thread start.
thread.pfminorUINT64Number of minor page faults since thread start.
thread.tidINT64The id of the thread generating the event.
thread.ismainBOOL’true’ if the thread generating the event is the main one in the process.
thread.vtidINT64The id of the thread generating the event as seen from its current PID namespace.
thread.exectimeRELTIMECPU time spent by the last scheduled thread, in nanoseconds. Exported by switch events only.
thread.totexectimeRELTIMETotal CPU time, in nanoseconds since the beginning of the capture, for the current thread. Exported by switch events only.
thread.cgroupsCHARBUFAll cgroups the thread belongs to, aggregated into a single string.
thread.cgroupCHARBUFThe cgroup the thread belongs to, for a specific subsystem. e.g. thread.cgroup.cpuacct.
proc.nthreadsUINT64The number of alive threads that the process generating the event currently has, including the leader thread. Please note that the leader thread may not be here, in that case ‘proc.nthreads’ and ‘proc.nchilds’ are equal
proc.nchildsUINT64The number of alive not leader threads that the process generating the event currently has. This excludes the leader thread.
thread.cpuDOUBLEThe CPU consumed by the thread in the last second.
thread.cpu.userDOUBLEThe user CPU consumed by the thread in the last second.
thread.cpu.systemDOUBLEThe system CPU consumed by the thread in the last second.
thread.vmsizeUINT64For the process main thread, this is the total virtual memory for the process (as kb). For the other threads, this field is zero.
thread.vmrssUINT64For the process main thread, this is the resident non-swapped memory for the process (as kb). For the other threads, this field is zero.

Field Class: user

Information about the user executing the specific event.

Event Sources: syscall

NameTypeDescription
user.uidUINT32user ID.
user.nameCHARBUFuser name.
user.homedirCHARBUFhome directory of the user.
user.shellCHARBUFuser’s shell.
user.loginuidINT64audit user id (auid), internally the loginuid is of type uint32_t. However, if an invalid uid corresponding to UINT32_MAX is encountered, it is returned as -1 to support familiar filtering conditions.
user.loginnameCHARBUFaudit user name (auid).

Field Class: group

Information about the user group.

Event Sources: syscall

NameTypeDescription
group.gidUINT32group ID.
group.nameCHARBUFgroup name.

Field Class: container

Container information. If the event is not happening inside a container, both id and name will be set to ‘host’.

Event Sources: syscall

NameTypeDescription
container.idCHARBUFThe truncated container ID (first 12 characters), e.g. 3ad7b26ded6d is extracted from the Linux cgroups by Falco within the kernel. Consequently, this field is reliably available and serves as the lookup key for Falco’s synchronous or asynchronous requests against the container runtime socket to retrieve all other ‘container.’ information. One important aspect to be aware of is that if the process occurs on the host, meaning not in the container PID namespace, this field is set to a string called ‘host’. In Kubernetes, pod sandbox container processes can exist where container.id matches k8s.pod.sandbox_id, lacking other ‘container.’ details.
container.full_idCHARBUFThe full container ID, e.g. 3ad7b26ded6d8e7b23da7d48fe889434573036c27ae5a74837233de441c3601e. In contrast to container.id, we enrich this field as part of the container engine enrichment. In instances of userspace container engine lookup delays, this field may not be available yet.
container.nameCHARBUFThe container name. In instances of userspace container engine lookup delays, this field may not be available yet. One important aspect to be aware of is that if the process occurs on the host, meaning not in the container PID namespace, this field is set to a string called ‘host’.
container.imageCHARBUFThe container image name (e.g. falcosecurity/falco:latest for docker). In instances of userspace container engine lookup delays, this field may not be available yet.
container.image.idCHARBUFThe container image id (e.g. 6f7e2741b66b). In instances of userspace container engine lookup delays, this field may not be available yet.
container.typeCHARBUFThe container type, e.g. docker, cri-o, containerd etc.
container.privilegedBOOL’true’ for containers running as privileged, ‘false’ otherwise. In instances of userspace container engine lookup delays, this field may not be available yet.
container.mountsCHARBUFA space-separated list of mount information. Each item in the list has the format ‘source:dest:mode:rdrw:propagation’. In instances of userspace container engine lookup delays, this field may not be available yet.
container.mountCHARBUFInformation about a single mount, specified by number (e.g. container.mount[0]) or mount source (container.mount[/usr/local]). The pathname can be a glob (container.mount[/usr/local/*]), in which case the first matching mount will be returned. The information has the format ‘source:dest:mode:rdrw:propagation’. If there is no mount with the specified index or matching the provided source, returns the string “none” instead of a NULL value. In instances of userspace container engine lookup delays, this field may not be available yet.
container.mount.sourceCHARBUFThe mount source, specified by number (e.g. container.mount.source[0]) or mount destination (container.mount.source[/host/lib/modules]). The pathname can be a glob. In instances of userspace container engine lookup delays, this field may not be available yet.
container.mount.destCHARBUFThe mount destination, specified by number (e.g. container.mount.dest[0]) or mount source (container.mount.dest[/lib/modules]). The pathname can be a glob. In instances of userspace container engine lookup delays, this field may not be available yet.
container.mount.modeCHARBUFThe mount mode, specified by number (e.g. container.mount.mode[0]) or mount source (container.mount.mode[/usr/local]). The pathname can be a glob. In instances of userspace container engine lookup delays, this field may not be available yet.
container.mount.rdwrCHARBUFThe mount rdwr value, specified by number (e.g. container.mount.rdwr[0]) or mount source (container.mount.rdwr[/usr/local]). The pathname can be a glob. In instances of userspace container engine lookup delays, this field may not be available yet.
container.mount.propagationCHARBUFThe mount propagation value, specified by number (e.g. container.mount.propagation[0]) or mount source (container.mount.propagation[/usr/local]). The pathname can be a glob. In instances of userspace container engine lookup delays, this field may not be available yet.
container.image.repositoryCHARBUFThe container image repository (e.g. falcosecurity/falco). In instances of userspace container engine lookup delays, this field may not be available yet.
container.image.tagCHARBUFThe container image tag (e.g. stable, latest). In instances of userspace container engine lookup delays, this field may not be available yet.
container.image.digestCHARBUFThe container image registry digest (e.g. sha256:d977378f890d445c15e51795296e4e5062f109ce6da83e0a355fc4ad8699d27). In instances of userspace container engine lookup delays, this field may not be available yet.
container.healthcheckCHARBUFThe container’s health check. Will be the null value (“N/A”) if no healthcheck configured, “NONE” if configured but explicitly not created, and the healthcheck command line otherwise. In instances of userspace container engine lookup delays, this field may not be available yet.
container.liveness_probeCHARBUFThe container’s liveness probe. Will be the null value (“N/A”) if no liveness probe configured, the liveness probe command line otherwise. In instances of userspace container engine lookup delays, this field may not be available yet.
container.readiness_probeCHARBUFThe container’s readiness probe. Will be the null value (“N/A”) if no readiness probe configured, the readiness probe command line otherwise. In instances of userspace container engine lookup delays, this field may not be available yet.
container.start_tsUINT64Container start as epoch timestamp in nanoseconds based on proc.pidns_init_start_ts and extracted in the kernel and not from the container runtime socket / container engine.
container.durationRELTIMENumber of nanoseconds since container.start_ts.
container.ipCHARBUFThe container’s / pod’s primary ip address as retrieved from the container engine. Only ipv4 addresses are tracked. Consider container.cni.json (CRI use case) for logging ip addresses for each network interface. In instances of userspace container engine lookup delays, this field may not be available yet.
container.cni.jsonCHARBUFThe container’s / pod’s CNI result field from the respective pod status info. It contains ip addresses for each network interface exposed as unparsed escaped JSON string. Supported for CRI container engine (containerd, cri-o runtimes), optimized for containerd (some non-critical JSON keys removed). Useful for tracking ips (ipv4 and ipv6, dual-stack support) for each network interface (multi-interface support). In instances of userspace container engine lookup delays, this field may not be available yet.

Field Class: fd

Every syscall that has a file descriptor in its arguments has these fields set with information related to the file.

Event Sources: syscall

NameTypeDescription
fd.numINT64the unique number identifying the file descriptor.
fd.typeCHARBUFtype of FD. Can be ‘file’, ‘directory’, ‘ipv4’, ‘ipv6’, ‘unix’, ‘pipe’, ’event’, ‘signalfd’, ’eventpoll’, ‘inotify’ ‘signalfd’ or ‘memfd’.
fd.typecharCHARBUFtype of FD as a single character. Can be ‘f’ for file, 4 for IPv4 socket, 6 for IPv6 socket, ‘u’ for unix socket, p for pipe, ’e’ for eventfd, ’s’ for signalfd, ’l’ for eventpoll, ‘i’ for inotify, ‘b’ for bpf, ‘u’ for userfaultd, ‘r’ for io_uring, ’m’ for memfd ,‘o’ for unknown.
fd.nameCHARBUFFD full name. If the fd is a file, this field contains the full path. If the FD is a socket, this field contain the connection tuple.
fd.directoryCHARBUFIf the fd is a file, the directory that contains it.
fd.filenameCHARBUFIf the fd is a file, the filename without the path.
fd.ipIPADDRmatches the ip address (client or server) of the fd.
fd.cipIPADDRclient IP address.
fd.sipIPADDRserver IP address.
fd.lipIPADDRlocal IP address.
fd.ripIPADDRremote IP address.
fd.portPORTmatches the port (either client or server) of the fd.
fd.cportPORTfor TCP/UDP FDs, the client port.
fd.sportPORTfor TCP/UDP FDs, server port.
fd.lportPORTfor TCP/UDP FDs, the local port.
fd.rportPORTfor TCP/UDP FDs, the remote port.
fd.l4protoCHARBUFthe IP protocol of a socket. Can be ’tcp’, ‘udp’, ‘icmp’ or ‘raw’.
fd.sockfamilyCHARBUFthe socket family for socket events. Can be ‘ip’ or ‘unix’.
fd.is_serverBOOL’true’ if the process owning this FD is the server endpoint in the connection.
fd.uidCHARBUFa unique identifier for the FD, created by chaining the FD number and the thread ID.
fd.containernameCHARBUFchaining of the container ID and the FD name. Useful when trying to identify which container an FD belongs to.
fd.containerdirectoryCHARBUFchaining of the container ID and the directory name. Useful when trying to identify which container a directory belongs to.
fd.protoPORTmatches the protocol (either client or server) of the fd.
fd.cprotoCHARBUFfor TCP/UDP FDs, the client protocol.
fd.sprotoCHARBUFfor TCP/UDP FDs, server protocol.
fd.lprotoCHARBUFfor TCP/UDP FDs, the local protocol.
fd.rprotoCHARBUFfor TCP/UDP FDs, the remote protocol.
fd.netIPNETmatches the IP network (client or server) of the fd.
fd.cnetIPNETmatches the client IP network of the fd.
fd.snetIPNETmatches the server IP network of the fd.
fd.lnetIPNETmatches the local IP network of the fd.
fd.rnetIPNETmatches the remote IP network of the fd.
fd.connectedBOOLfor TCP/UDP FDs, ’true’ if the socket is connected.
fd.name_changedBOOLTrue when an event changes the name of an fd used by this event. This can occur in some cases such as udp connections where the connection tuple changes.
fd.cip.nameCHARBUFDomain name associated with the client IP address.
fd.sip.nameCHARBUFDomain name associated with the server IP address.
fd.lip.nameCHARBUFDomain name associated with the local IP address.
fd.rip.nameCHARBUFDomain name associated with the remote IP address.
fd.devINT32device number (major/minor) containing the referenced file
fd.dev.majorINT32major device number containing the referenced file
fd.dev.minorINT32minor device number containing the referenced file
fd.inoINT64inode number of the referenced file
fd.namerawCHARBUFFD full name raw. Just like fd.name, but only used if fd is a file path. File path is kept raw with limited sanitization and without deriving the absolute path.
fd.typesCHARBUFList of FD types in used. Can be passed an fd number e.g. fd.types[0] to get the type of stdout as a single item list.

Field Class: fs.path

Every syscall that has a filesystem path in its arguments has these fields set with information related to the path arguments. This differs from the fd.* fields as it includes syscalls like unlink, rename, etc. that act directly on filesystem paths as compared to opened file descriptors.

Event Sources: syscall

NameTypeDescription
fs.path.nameCHARBUFFor any event type that deals with a filesystem path, the path the file syscall is operating on. This path is always fully resolved, prepending the thread cwd when needed.
fs.path.namerawCHARBUFFor any event type that deals with a filesystem path, the path the file syscall is operating on. This path is always the path provided to the syscall and may not be fully resolved.
fs.path.sourceCHARBUFFor any event type that deals with a filesystem path, and specifically for a source and target like mv, cp, etc, the source path the file syscall is operating on. This path is always fully resolved, prepending the thread cwd when needed.
fs.path.sourcerawCHARBUFFor any event type that deals with a filesystem path, and specifically for a source and target like mv, cp, etc, the source path the file syscall is operating on. This path is always the path provided to the syscall and may not be fully resolved.
fs.path.targetCHARBUFFor any event type that deals with a filesystem path, and specifically for a target and target like mv, cp, etc, the target path the file syscall is operating on. This path is always fully resolved, prepending the thread cwd when needed.
fs.path.targetrawCHARBUFFor any event type that deals with a filesystem path, and specifically for a target and target like mv, cp, etc, the target path the file syscall is operating on. This path is always the path provided to the syscall and may not be fully resolved.

Field Class: syslog

Content of Syslog messages.

Event Sources: syscall

NameTypeDescription
syslog.facility.strCHARBUFfacility as a string.
syslog.facilityUINT32facility as a number (0-23).
syslog.severity.strCHARBUFseverity as a string. Can have one of these values: emerg, alert, crit, err, warn, notice, info, debug
syslog.severityUINT32severity as a number (0-7).
syslog.messageCHARBUFmessage sent to syslog.

Field Class: fdlist

Poll event related fields.

Event Sources: syscall

NameTypeDescription
fdlist.numsCHARBUFfor poll events, this is a comma-separated list of the FD numbers in the ‘fds’ argument, returned as a string.
fdlist.namesCHARBUFfor poll events, this is a comma-separated list of the FD names in the ‘fds’ argument, returned as a string.
fdlist.cipsCHARBUFfor poll events, this is a comma-separated list of the client IP addresses in the ‘fds’ argument, returned as a string.
fdlist.sipsCHARBUFfor poll events, this is a comma-separated list of the server IP addresses in the ‘fds’ argument, returned as a string.
fdlist.cportsCHARBUFfor TCP/UDP FDs, for poll events, this is a comma-separated list of the client TCP/UDP ports in the ‘fds’ argument, returned as a string.
fdlist.sportsCHARBUFfor poll events, this is a comma-separated list of the server TCP/UDP ports in the ‘fds’ argument, returned as a string.

Field Class: k8s

Kubernetes context about pods and namespace name. These fields are populated with data gathered from the container runtime.

Event Sources: syscall

NameTypeDescription
k8s.ns.nameCHARBUFThe Kubernetes namespace name. This field is extracted from the container runtime socket simultaneously as we look up the ‘container.*’ fields. In cases of lookup delays, it may not be available yet.
k8s.pod.nameCHARBUFThe Kubernetes pod name. This field is extracted from the container runtime socket simultaneously as we look up the ‘container.*’ fields. In cases of lookup delays, it may not be available yet.
k8s.pod.idCHARBUF[LEGACY] The Kubernetes pod UID, e.g. 3e41dc6b-08a8-44db-bc2a-3724b18ab19a. This legacy field points to k8s.pod.uid; however, the pod ID typically refers to the pod sandbox ID. We recommend using the semantically more accurate k8s.pod.uid field. This field is extracted from the container runtime socket simultaneously as we look up the ‘container.*’ fields. In cases of lookup delays, it may not be available yet.
k8s.pod.uidCHARBUFThe Kubernetes pod UID, e.g. 3e41dc6b-08a8-44db-bc2a-3724b18ab19a. Note that the pod UID is a unique identifier assigned upon pod creation within Kubernetes, allowing the Kubernetes control plane to manage and track pods reliably. As such, it is fundamentally a different concept compared to the pod sandbox ID. This field is extracted from the container runtime socket simultaneously as we look up the ‘container.*’ fields. In cases of lookup delays, it may not be available yet.
k8s.pod.sandbox_idCHARBUFThe truncated Kubernetes pod sandbox ID (first 12 characters), e.g 63060edc2d3a. The sandbox ID is specific to the container runtime environment. It is the equivalent of the container ID for the pod / sandbox and extracted from the Linux cgroups. As such, it differs from the pod UID. This field is extracted from the container runtime socket simultaneously as we look up the ‘container.’ fields. In cases of lookup delays, it may not be available yet. In Kubernetes, pod sandbox container processes can exist where container.id matches k8s.pod.sandbox_id, lacking other ‘container.’ details.
k8s.pod.full_sandbox_idCHARBUFThe full Kubernetes pod / sandbox ID, e.g 63060edc2d3aa803ab559f2393776b151f99fc5b05035b21db66b3b62246ad6a. This field is extracted from the container runtime socket simultaneously as we look up the ‘container.*’ fields. In cases of lookup delays, it may not be available yet.
k8s.pod.labelCHARBUFThe Kubernetes pod label. The label can be accessed either with the familiar brackets notation, e.g. ‘k8s.pod.label[foo]’ or by appending a dot followed by the name, e.g. ‘k8s.pod.label.foo’. The label name itself can include the original special characters such as ‘.’, ‘-’, ‘_’ or ‘/’ characters. For instance, ‘k8s.pod.label[app.kubernetes.io/name]’, ‘k8s.pod.label.app.kubernetes.io/name’ or ‘k8s.pod.label[custom-label_one]’ are all valid. This field is extracted from the container runtime socket simultaneously as we look up the ‘container.*’ fields. In cases of lookup delays, it may not be available yet.
k8s.pod.labelsCHARBUFThe Kubernetes pod comma-separated key/value labels. E.g. ‘foo1:bar1,foo2:bar2’. This field is extracted from the container runtime socket simultaneously as we look up the ‘container.*’ fields. In cases of lookup delays, it may not be available yet.
k8s.pod.ipCHARBUFThe Kubernetes pod ip, same as container.ip field as each container in a pod shares the network stack of the sandbox / pod. Only ipv4 addresses are tracked. Consider k8s.pod.cni.json for logging ip addresses for each network interface. This field is extracted from the container runtime socket simultaneously as we look up the ‘container.*’ fields. In cases of lookup delays, it may not be available yet.
k8s.pod.cni.jsonCHARBUFThe Kubernetes pod CNI result field from the respective pod status info, same as container.cni.json field. It contains ip addresses for each network interface exposed as unparsed escaped JSON string. Supported for CRI container engine (containerd, cri-o runtimes), optimized for containerd (some non-critical JSON keys removed). Useful for tracking ips (ipv4 and ipv6, dual-stack support) for each network interface (multi-interface support). This field is extracted from the container runtime socket simultaneously as we look up the ‘container.*’ fields. In cases of lookup delays, it may not be available yet.

Field Class: security-dns (plugin)

Event Sources: syscall

NameTypeDescription
dns.domainCHARBUFThe domain being queried (e.g. sysdig.com) as a string.
dns.query_typeCHARBUFThe type of lookup (e.g. A, AAAA, CNAME) of the query as a string.
dns.query_classCHARBUFThe class of lookup (e.g. IN) as a string.
dns.successBOOLWhether the query was successful or not as a boolean value.
dns.typeCHARBUFThe type of DNS event as a string, either “query” or “response”.
dns.resultUINT64The result code (RCODE) of the query, 0 on success, see RFC-1035 for other values.
dns.truncatedBOOLWhether or not the query was truncated as a boolean value.
dns.query.domainsCHARBUFA list of all the domains being queried as strings.
dns.query.domainCHARBUFAn indexed field for the domain being queried as a string.
dns.query.typeCHARBUFAn indexed field for the type of query (e.g. A, AAAA, CNAME) being queried as a string.
dns.query.classCHARBUFAn indexed field for the class of query (e.g. IN) being queried as a string.
dns.query.lengthsUINT64The total length of the string of each domain being looked up.
dns.query.lengthUINT64An indexed field for the length of the domain string in each query.
dns.response.domainsCHARBUFA list of all the domains in the response as strings.
dns.response.domainCHARBUFAn indexed field for each domain in the response as a string.
dns.response.ttlUINT64An indexed field for The Time To Live of the record as an integer
dns.response.typeCHARBUFAn indexed field for the type of respose (e.g. A, AAAA, CNAME) as a string. This can differ from what was originally queried.
dns.response.classCHARBUFAn indexed field for the class of respose (e.g. IN) as a string.
dns.response.valuesCHARBUFA list containing the value of each response as a string.
dns.response.valueCHARBUFAn indexed field for the class of respose (e.g. IN) as a string.
dns.response.cnamesCHARBUFA list of all the CNAMES in the response as strings. This will be empty if no CNAME records are present.
dns.response.cnameCHARBUFAn indexed field for CNAME response records. This will be empty if the given index is not a CNAME.
dns.response.txtsCHARBUFA list of all the TXT records in the response as strings. This will be empty if no TXT records are present.
dns.response.txtCHARBUFAn indexed field for TXT response records. This will be empty if the given index is not a TXT record.
dns.response.srvsCHARBUFA list of all the SRV records in the response as strings. This will be empty if no SRV records are present.
dns.response.srvCHARBUFAn indexed field for SRV response records. This will be empty if the given index is not an SRV record.
dns.response.ipsIPADDRList of IP addresses in the response.
dns.response.ipIPADDRAn indexed field for ip address (A, AAAA) response records. This will be empty if the given index is not an A or AAAA record.
dns.server_ipIPADDRThe ip address of the DNS server.
connect.domainsCHARBUFDomain names which map to fd.sip in the connect syscall

Field Class: security-hashing (plugin)

Event Sources: syscall

NameTypeDescription
proc.hash.sha256CHARBUFThe hash of the file executed by this process
proc.hash.has_matchBOOLWhether or not the hash of the file beeing executed by this process has a match in the hash database
proc.hash.categoryCHARBUFIn case proc.has_match is true, the category of the malware being executed

Syscall events

DefaultDirNameParams
Yes>openFSPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, UINT32 mode
Yes<openFD fd, FSPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, UINT32 mode, UINT32 dev, UINT64 ino
Yes>closeFD fd
Yes<closeERRNO res
No>readFD fd, UINT32 size
No<readERRNO res, BYTEBUF data
No>writeFD fd, UINT32 size
No<writeERRNO res, BYTEBUF data
Yes>socketENUMFLAGS32 domain: AF_NFC, AF_ALG, AF_CAIF, AF_IEEE802154, AF_PHONET, AF_ISDN, AF_RXRPC, AF_IUCV, AF_BLUETOOTH, AF_TIPC, AF_CAN, AF_LLC, AF_WANPIPE, AF_PPPOX, AF_IRDA, AF_SNA, AF_RDS, AF_ATMSVC, AF_ECONET, AF_ASH, AF_PACKET, AF_ROUTE, AF_NETLINK, AF_KEY, AF_SECURITY, AF_NETBEUI, AF_DECnet, AF_ROSE, AF_INET6, AF_X25, AF_ATMPVC, AF_BRIDGE, AF_NETROM, AF_APPLETALK, AF_IPX, AF_AX25, AF_INET, AF_LOCAL, AF_UNIX, AF_UNSPEC, UINT32 type, UINT32 proto
Yes<socketFD fd
Yes>bindFD fd
Yes<bindERRNO res, SOCKADDR addr
Yes>connectFD fd, SOCKADDR addr
Yes<connectERRNO res, SOCKTUPLE tuple, FD fd
Yes>listenFD fd, INT32 backlog
Yes<listenERRNO res
No>sendFD fd, UINT32 size
No<sendERRNO res, BYTEBUF data
Yes>sendtoFD fd, UINT32 size, SOCKTUPLE tuple
Yes<sendtoERRNO res, BYTEBUF data
No>recvFD fd, UINT32 size
No<recvERRNO res, BYTEBUF data
Yes>recvfromFD fd, UINT32 size
Yes<recvfromERRNO res, BYTEBUF data, SOCKTUPLE tuple
Yes>shutdownFD fd, ENUMFLAGS8 how: SHUT_UNKNOWN, SHUT_RDWR, SHUT_WR, SHUT_RD
Yes<shutdownERRNO res
Yes>getsockname
Yes<getsockname
Yes>getpeername
Yes<getpeername
Yes>socketpairENUMFLAGS32 domain: AF_NFC, AF_ALG, AF_CAIF, AF_IEEE802154, AF_PHONET, AF_ISDN, AF_RXRPC, AF_IUCV, AF_BLUETOOTH, AF_TIPC, AF_CAN, AF_LLC, AF_WANPIPE, AF_PPPOX, AF_IRDA, AF_SNA, AF_RDS, AF_ATMSVC, AF_ECONET, AF_ASH, AF_PACKET, AF_ROUTE, AF_NETLINK, AF_KEY, AF_SECURITY, AF_NETBEUI, AF_DECnet, AF_ROSE, AF_INET6, AF_X25, AF_ATMPVC, AF_BRIDGE, AF_NETROM, AF_APPLETALK, AF_IPX, AF_AX25, AF_INET, AF_LOCAL, AF_UNIX, AF_UNSPEC, UINT32 type, UINT32 proto
Yes<socketpairERRNO res, FD fd1, FD fd2, UINT64 source, UINT64 peer
Yes>setsockopt
Yes<setsockoptERRNO res, FD fd, ENUMFLAGS8 level: SOL_SOCKET, SOL_TCP, UNKNOWN, ENUMFLAGS8 optname: SO_COOKIE, SO_MEMINFO, SO_PEERGROUPS, SO_ATTACH_BPF, SO_INCOMING_CPU, SO_BPF_EXTENSIONS, SO_MAX_PACING_RATE, SO_BUSY_POLL, SO_SELECT_ERR_QUEUE, SO_LOCK_FILTER, SO_NOFCS, SO_PEEK_OFF, SO_WIFI_STATUS, SO_RXQ_OVFL, SO_DOMAIN, SO_PROTOCOL, SO_TIMESTAMPING, SO_MARK, SO_TIMESTAMPNS, SO_PASSSEC, SO_PEERSEC, SO_ACCEPTCONN, SO_TIMESTAMP, SO_PEERNAME, SO_DETACH_FILTER, SO_ATTACH_FILTER, SO_BINDTODEVICE, SO_SECURITY_ENCRYPTION_NETWORK, SO_SECURITY_ENCRYPTION_TRANSPORT, SO_SECURITY_AUTHENTICATION, SO_SNDTIMEO, SO_RCVTIMEO, SO_SNDLOWAT, SO_RCVLOWAT, SO_PEERCRED, SO_PASSCRED, SO_REUSEPORT, SO_BSDCOMPAT, SO_LINGER, SO_PRIORITY, SO_NO_CHECK, SO_OOBINLINE, SO_KEEPALIVE, SO_RCVBUFFORCE, SO_SNDBUFFORCE, SO_RCVBUF, SO_SNDBUF, SO_BROADCAST, SO_DONTROUTE, SO_ERROR, SO_TYPE, SO_REUSEADDR, SO_DEBUG, UNKNOWN, DYNAMIC val, UINT32 optlen
Yes>getsockopt
Yes<getsockoptERRNO res, FD fd, ENUMFLAGS8 level: SOL_SOCKET, SOL_TCP, UNKNOWN, ENUMFLAGS8 optname: SO_COOKIE, SO_MEMINFO, SO_PEERGROUPS, SO_ATTACH_BPF, SO_INCOMING_CPU, SO_BPF_EXTENSIONS, SO_MAX_PACING_RATE, SO_BUSY_POLL, SO_SELECT_ERR_QUEUE, SO_LOCK_FILTER, SO_NOFCS, SO_PEEK_OFF, SO_WIFI_STATUS, SO_RXQ_OVFL, SO_DOMAIN, SO_PROTOCOL, SO_TIMESTAMPING, SO_MARK, SO_TIMESTAMPNS, SO_PASSSEC, SO_PEERSEC, SO_ACCEPTCONN, SO_TIMESTAMP, SO_PEERNAME, SO_DETACH_FILTER, SO_ATTACH_FILTER, SO_BINDTODEVICE, SO_SECURITY_ENCRYPTION_NETWORK, SO_SECURITY_ENCRYPTION_TRANSPORT, SO_SECURITY_AUTHENTICATION, SO_SNDTIMEO, SO_RCVTIMEO, SO_SNDLOWAT, SO_RCVLOWAT, SO_PEERCRED, SO_PASSCRED, SO_REUSEPORT, SO_BSDCOMPAT, SO_LINGER, SO_PRIORITY, SO_NO_CHECK, SO_OOBINLINE, SO_KEEPALIVE, SO_RCVBUFFORCE, SO_SNDBUFFORCE, SO_RCVBUF, SO_SNDBUF, SO_BROADCAST, SO_DONTROUTE, SO_ERROR, SO_TYPE, SO_REUSEADDR, SO_DEBUG, UNKNOWN, DYNAMIC val, UINT32 optlen
Yes>sendmsgFD fd, UINT32 size, SOCKTUPLE tuple
Yes<sendmsgERRNO res, BYTEBUF data
No>sendmmsg
No<sendmmsg
Yes>recvmsgFD fd
Yes<recvmsgERRNO res, UINT32 size, BYTEBUF data, SOCKTUPLE tuple, BYTEBUF msgcontrol
No>recvmmsg
No<recvmmsg
Yes>creatFSPATH name, UINT32 mode
Yes<creatFD fd, FSPATH name, UINT32 mode, UINT32 dev, UINT64 ino
Yes>pipe
Yes<pipeERRNO res, FD fd1, FD fd2, UINT64 ino
Yes>eventfdUINT64 initval, UINT32 flags
Yes<eventfdFD res
Yes>futexUINT64 addr, ENUMFLAGS16 op: FUTEX_CLOCK_REALTIME, FUTEX_PRIVATE_FLAG, FUTEX_CMP_REQUEUE_PI, FUTEX_WAIT_REQUEUE_PI, FUTEX_WAKE_BITSET, FUTEX_WAIT_BITSET, FUTEX_TRYLOCK_PI, FUTEX_UNLOCK_PI, FUTEX_LOCK_PI, FUTEX_WAKE_OP, FUTEX_CMP_REQUEUE, FUTEX_REQUEUE, FUTEX_FD, FUTEX_WAKE, FUTEX_WAIT, UINT64 val
Yes<futexERRNO res
Yes>stat
Yes<statERRNO res, FSPATH path
Yes>lstat
Yes<lstatERRNO res, FSPATH path
Yes>fstatFD fd
Yes<fstatERRNO res
Yes>stat64
Yes<stat64ERRNO res, FSPATH path
Yes>lstat64
Yes<lstat64ERRNO res, FSPATH path
Yes>fstat64FD fd
Yes<fstat64ERRNO res
Yes>epoll_waitERRNO maxevents
Yes<epoll_waitERRNO res
Yes>pollFDLIST fds, INT64 timeout
Yes<pollERRNO res, FDLIST fds
Yes>select
Yes<selectERRNO res
Yes>lseekFD fd, UINT64 offset, ENUMFLAGS8 whence: SEEK_END, SEEK_CUR, SEEK_SET
Yes<lseekERRNO res
Yes>llseekFD fd, UINT64 offset, ENUMFLAGS8 whence: SEEK_END, SEEK_CUR, SEEK_SET
Yes<llseekERRNO res
Yes>getcwd
Yes<getcwdERRNO res, CHARBUF path
Yes>chdir
Yes<chdirERRNO res, CHARBUF path
Yes>fchdirFD fd
Yes<fchdirERRNO res
No>preadFD fd, UINT32 size, UINT64 pos
No<preadERRNO res, BYTEBUF data
No>pwriteFD fd, UINT32 size, UINT64 pos
No<pwriteERRNO res, BYTEBUF data
No>readvFD fd
No<readvERRNO res, UINT32 size, BYTEBUF data
No>writevFD fd, UINT32 size
No<writevERRNO res, BYTEBUF data
No>preadvFD fd, UINT64 pos
No<preadvERRNO res, UINT32 size, BYTEBUF data
No>pwritevFD fd, UINT32 size, UINT64 pos
No<pwritevERRNO res, BYTEBUF data
Yes>signalfdFD fd, UINT32 mask, UINT8 flags
Yes<signalfdFD res
Yes>killPID pid, SIGTYPE sig
Yes<killERRNO res
Yes>tkillPID tid, SIGTYPE sig
Yes<tkillERRNO res
Yes>tgkillPID pid, PID tid, SIGTYPE sig
Yes<tgkillERRNO res
Yes>nanosleepRELTIME interval
Yes<nanosleepERRNO res
Yes>timerfd_createUINT8 clockid, UINT8 flags
Yes<timerfd_createFD res
Yes>inotify_initUINT8 flags
Yes<inotify_initFD res
Yes>getrlimitENUMFLAGS8 resource: RLIMIT_UNKNOWN, RLIMIT_RTTIME, RLIMIT_RTPRIO, RLIMIT_NICE, RLIMIT_MSGQUEUE, RLIMIT_SIGPENDING, RLIMIT_LOCKS, RLIMIT_AS, RLIMIT_MEMLOCK, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_RSS, RLIMIT_CORE, RLIMIT_STACK, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_CPU
Yes<getrlimitERRNO res, INT64 cur, INT64 max
Yes>setrlimitENUMFLAGS8 resource: RLIMIT_UNKNOWN, RLIMIT_RTTIME, RLIMIT_RTPRIO, RLIMIT_NICE, RLIMIT_MSGQUEUE, RLIMIT_SIGPENDING, RLIMIT_LOCKS, RLIMIT_AS, RLIMIT_MEMLOCK, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_RSS, RLIMIT_CORE, RLIMIT_STACK, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_CPU
Yes<setrlimitERRNO res, INT64 cur, INT64 max, ENUMFLAGS8 resource: RLIMIT_UNKNOWN, RLIMIT_RTTIME, RLIMIT_RTPRIO, RLIMIT_NICE, RLIMIT_MSGQUEUE, RLIMIT_SIGPENDING, RLIMIT_LOCKS, RLIMIT_AS, RLIMIT_MEMLOCK, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_RSS, RLIMIT_CORE, RLIMIT_STACK, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_CPU
Yes>prlimitPID pid, ENUMFLAGS8 resource: RLIMIT_UNKNOWN, RLIMIT_RTTIME, RLIMIT_RTPRIO, RLIMIT_NICE, RLIMIT_MSGQUEUE, RLIMIT_SIGPENDING, RLIMIT_LOCKS, RLIMIT_AS, RLIMIT_MEMLOCK, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_RSS, RLIMIT_CORE, RLIMIT_STACK, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_CPU
Yes<prlimitERRNO res, INT64 newcur, INT64 newmax, INT64 oldcur, INT64 oldmax, INT64 pid, ENUMFLAGS8 resource: RLIMIT_UNKNOWN, RLIMIT_RTTIME, RLIMIT_RTPRIO, RLIMIT_NICE, RLIMIT_MSGQUEUE, RLIMIT_SIGPENDING, RLIMIT_LOCKS, RLIMIT_AS, RLIMIT_MEMLOCK, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_RSS, RLIMIT_CORE, RLIMIT_STACK, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_CPU
Yes>fcntlFD fd, ENUMFLAGS8 cmd: F_GETPIPE_SZ, F_SETPIPE_SZ, F_NOTIFY, F_DUPFD_CLOEXEC, F_CANCELLK, F_GETLEASE, F_SETLEASE, F_GETOWN_EX, F_SETOWN_EX, F_SETLKW64, F_SETLK64, F_GETLK64, F_GETSIG, F_SETSIG, F_GETOWN, F_SETOWN, F_SETLKW, F_SETLK, F_GETLK, F_SETFL, F_GETFL, F_SETFD, F_GETFD, F_DUPFD, F_OFD_GETLK, F_OFD_SETLK, F_OFD_SETLKW, UNKNOWN
Yes<fcntlFD res, FD fd, ENUMFLAGS8 cmd: F_GETPIPE_SZ, F_SETPIPE_SZ, F_NOTIFY, F_DUPFD_CLOEXEC, F_CANCELLK, F_GETLEASE, F_SETLEASE, F_GETOWN_EX, F_SETOWN_EX, F_SETLKW64, F_SETLK64, F_GETLK64, F_GETSIG, F_SETSIG, F_GETOWN, F_SETOWN, F_SETLKW, F_SETLK, F_GETLK, F_SETFL, F_GETFL, F_SETFD, F_GETFD, F_DUPFD, F_OFD_GETLK, F_OFD_SETLK, F_OFD_SETLKW, UNKNOWN
Yes>brkUINT64 addr
Yes<brkUINT64 res, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap
Yes>mmapUINT64 addr, UINT64 length, FLAGS32 prot: PROT_READ, PROT_WRITE, PROT_EXEC, PROT_SEM, PROT_GROWSDOWN, PROT_GROWSUP, PROT_SAO, PROT_NONE, FLAGS32 flags: MAP_SHARED, MAP_PRIVATE, MAP_FIXED, MAP_ANONYMOUS, MAP_32BIT, MAP_RENAME, MAP_NORESERVE, MAP_POPULATE, MAP_NONBLOCK, MAP_GROWSDOWN, MAP_DENYWRITE, MAP_EXECUTABLE, MAP_INHERIT, MAP_FILE, MAP_LOCKED, FD fd, UINT64 offset
Yes<mmapERRNO res, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap
Yes>mmap2UINT64 addr, UINT64 length, FLAGS32 prot: PROT_READ, PROT_WRITE, PROT_EXEC, PROT_SEM, PROT_GROWSDOWN, PROT_GROWSUP, PROT_SAO, PROT_NONE, FLAGS32 flags: MAP_SHARED, MAP_PRIVATE, MAP_FIXED, MAP_ANONYMOUS, MAP_32BIT, MAP_RENAME, MAP_NORESERVE, MAP_POPULATE, MAP_NONBLOCK, MAP_GROWSDOWN, MAP_DENYWRITE, MAP_EXECUTABLE, MAP_INHERIT, MAP_FILE, MAP_LOCKED, FD fd, UINT64 pgoffset
Yes<mmap2ERRNO res, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap
Yes>munmapUINT64 addr, UINT64 length
Yes<munmapERRNO res, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap
Yes>spliceFD fd_in, FD fd_out, UINT64 size, FLAGS32 flags: SPLICE_F_MOVE, SPLICE_F_NONBLOCK, SPLICE_F_MORE, SPLICE_F_GIFT
Yes<spliceERRNO res
Yes>ptraceENUMFLAGS16 request: PTRACE_SINGLEBLOCK, PTRACE_SYSEMU_SINGLESTEP, PTRACE_SYSEMU, PTRACE_ARCH_PRCTL, PTRACE_SET_THREAD_AREA, PTRACE_GET_THREAD_AREA, PTRACE_OLDSETOPTIONS, PTRACE_SETFPXREGS, PTRACE_GETFPXREGS, PTRACE_SETFPREGS, PTRACE_GETFPREGS, PTRACE_SETREGS, PTRACE_GETREGS, PTRACE_SETSIGMASK, PTRACE_GETSIGMASK, PTRACE_PEEKSIGINFO, PTRACE_LISTEN, PTRACE_INTERRUPT, PTRACE_SEIZE, PTRACE_SETREGSET, PTRACE_GETREGSET, PTRACE_SETSIGINFO, PTRACE_GETSIGINFO, PTRACE_GETEVENTMSG, PTRACE_SETOPTIONS, PTRACE_SYSCALL, PTRACE_DETACH, PTRACE_ATTACH, PTRACE_SINGLESTEP, PTRACE_KILL, PTRACE_CONT, PTRACE_POKEUSR, PTRACE_POKEDATA, PTRACE_POKETEXT, PTRACE_PEEKUSR, PTRACE_PEEKDATA, PTRACE_PEEKTEXT, PTRACE_TRACEME, PTRACE_UNKNOWN, PID pid
Yes<ptraceERRNO res, DYNAMIC addr, DYNAMIC data
Yes>ioctlFD fd, UINT64 request, UINT64 argument
Yes<ioctlERRNO res
Yes>rename
Yes<renameERRNO res, FSPATH oldpath, FSPATH newpath
Yes>renameat
Yes<renameatERRNO res, FD olddirfd, FSRELPATH oldpath, FD newdirfd, FSRELPATH newpath
Yes>symlink
Yes<symlinkERRNO res, CHARBUF target, FSPATH linkpath
Yes>symlinkat
Yes<symlinkatERRNO res, CHARBUF target, FD linkdirfd, FSRELPATH linkpath
No>sendfileFD out_fd, FD in_fd, UINT64 offset, UINT64 size
No<sendfileERRNO res, UINT64 offset
Yes>quotactlFLAGS16 cmd: Q_QUOTAON, Q_QUOTAOFF, Q_GETFMT, Q_GETINFO, Q_SETINFO, Q_GETQUOTA, Q_SETQUOTA, Q_SYNC, Q_XQUOTAON, Q_XQUOTAOFF, Q_XGETQUOTA, Q_XSETQLIM, Q_XGETQSTAT, Q_XQUOTARM, Q_XQUOTASYNC, FLAGS8 type: USRQUOTA, GRPQUOTA, UINT32 id, FLAGS8 quota_fmt: QFMT_NOT_USED, QFMT_VFS_OLD, QFMT_VFS_V0, QFMT_VFS_V1
Yes<quotactlERRNO res, CHARBUF special, CHARBUF quotafilepath, UINT64 dqb_bhardlimit, UINT64 dqb_bsoftlimit, UINT64 dqb_curspace, UINT64 dqb_ihardlimit, UINT64 dqb_isoftlimit, RELTIME dqb_btime, RELTIME dqb_itime, RELTIME dqi_bgrace, RELTIME dqi_igrace, FLAGS8 dqi_flags: DQF_NONE, V1_DQF_RSQUASH, FLAGS8 quota_fmt_out: QFMT_NOT_USED, QFMT_VFS_OLD, QFMT_VFS_V0, QFMT_VFS_V1
Yes>setresuidUID ruid, UID euid, UID suid
Yes<setresuidERRNO res
Yes>setresgidGID rgid, GID egid, GID sgid
Yes<setresgidERRNO res
Yes>setuidUID uid
Yes<setuidERRNO res
Yes>setgidGID gid
Yes<setgidERRNO res
Yes>getuid
Yes<getuidUID uid
Yes>geteuid
Yes<geteuidUID euid
Yes>getgid
Yes<getgidGID gid
Yes>getegid
Yes<getegidGID egid
Yes>getresuid
Yes<getresuidERRNO res, UID ruid, UID euid, UID suid
Yes>getresgid
Yes<getresgidERRNO res, GID rgid, GID egid, GID sgid
Yes>clone
Yes<clonePID res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, INT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, FLAGS32 flags: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP, UINT32 uid, UINT32 gid, PID vtid, PID vpid, UINT64 pidns_init_start_ts
Yes>fork
Yes<forkPID res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, INT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, FLAGS32 flags: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP, UINT32 uid, UINT32 gid, PID vtid, PID vpid, UINT64 pidns_init_start_ts
Yes>vfork
Yes<vforkPID res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, INT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, FLAGS32 flags: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP, UINT32 uid, UINT32 gid, PID vtid, PID vpid, UINT64 pidns_init_start_ts
Yes>getdentsFD fd
Yes<getdentsERRNO res
Yes>getdents64FD fd
Yes<getdents64ERRNO res
Yes>setnsFD fd, FLAGS32 nstype: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP
Yes<setnsERRNO res
Yes>flockFD fd, FLAGS32 operation: LOCK_SH, LOCK_EX, LOCK_NB, LOCK_UN, LOCK_NONE
Yes<flockERRNO res
Yes>accept
Yes<acceptFD fd, SOCKTUPLE tuple, UINT8 queuepct, UINT32 queuelen, UINT32 queuemax
Yes>semopINT32 semid
Yes<semopERRNO res, UINT32 nsops, UINT16 sem_num_0, INT16 sem_op_0, FLAGS16 sem_flg_0: IPC_NOWAIT, SEM_UNDO, UINT16 sem_num_1, INT16 sem_op_1, FLAGS16 sem_flg_1: IPC_NOWAIT, SEM_UNDO
Yes>semctlINT32 semid, INT32 semnum, FLAGS16 cmd: IPC_STAT, IPC_SET, IPC_RMID, IPC_INFO, SEM_INFO, SEM_STAT, GETALL, GETNCNT, GETPID, GETVAL, GETZCNT, SETALL, SETVAL, INT32 val
Yes<semctlERRNO res
Yes>ppollFDLIST fds, RELTIME timeout, SIGSET sigmask
Yes<ppollERRNO res, FDLIST fds
Yes>mountFLAGS32 flags: RDONLY, NOSUID, NODEV, NOEXEC, SYNCHRONOUS, REMOUNT, MANDLOCK, DIRSYNC, NOATIME, NODIRATIME, BIND, MOVE, REC, SILENT, POSIXACL, UNBINDABLE, PRIVATE, SLAVE, SHARED, RELATIME, KERNMOUNT, I_VERSION, STRICTATIME, LAZYTIME, NOSEC, BORN, ACTIVE, NOUSER
Yes<mountERRNO res, CHARBUF dev, FSPATH dir, CHARBUF type
Yes>semgetINT32 key, INT32 nsems, FLAGS32 semflg: IPC_EXCL, IPC_CREAT
Yes<semgetERRNO res
Yes>accessFLAGS32 mode: F_OK, R_OK, W_OK, X_OK
Yes<accessERRNO res, FSPATH name
Yes>chroot
Yes<chrootERRNO res, FSPATH path
Yes>setsid
Yes<setsidPID res
Yes>mkdirUINT32 mode
Yes<mkdirERRNO res, FSPATH path
Yes>rmdir
Yes<rmdirERRNO res, FSPATH path
Yes>unshareFLAGS32 flags: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP
Yes<unshareERRNO res
Yes>execveFSPATH filename
Yes<execveERRNO res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, UINT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, BYTEBUF env, UINT32 tty, PID pgid, UID loginuid, FLAGS32 flags: EXE_WRITABLE, EXE_UPPER_LAYER, EXE_FROM_MEMFD, UINT64 cap_inheritable, UINT64 cap_permitted, UINT64 cap_effective, UINT64 exe_ino, ABSTIME exe_ino_ctime, ABSTIME exe_ino_mtime, UID uid, FSPATH trusted_exepath
Yes>setpgidPID pid, PID pgid
Yes<setpgidPID res
Yes>seccompUINT64 op, UINT64 flags
Yes<seccompERRNO res
Yes>unlink
Yes<unlinkERRNO res, FSPATH path
Yes>unlinkat
Yes<unlinkatERRNO res, FD dirfd, FSRELPATH name, FLAGS32 flags: AT_REMOVEDIR
Yes>mkdirat
Yes<mkdiratERRNO res, FD dirfd, FSRELPATH path, UINT32 mode
Yes>openatFD dirfd, FSRELPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, UINT32 mode
Yes<openatFD fd, FD dirfd, FSRELPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, UINT32 mode, UINT32 dev, UINT64 ino
Yes>link
Yes<linkERRNO res, FSPATH oldpath, FSPATH newpath
Yes>linkat
Yes<linkatERRNO res, FD olddir, FSRELPATH oldpath, FD newdir, FSRELPATH newpath, FLAGS32 flags: AT_SYMLINK_FOLLOW, AT_EMPTY_PATH
Yes>fchmodat
Yes<fchmodatERRNO res, FD dirfd, FSRELPATH filename, MODE mode
Yes>chmod
Yes<chmodERRNO res, FSPATH filename, MODE mode
Yes>fchmod
Yes<fchmodERRNO res, FD fd, MODE mode
Yes>renameat2
Yes<renameat2ERRNO res, FD olddirfd, FSRELPATH oldpath, FD newdirfd, FSRELPATH newpath, FLAGS32 flags: RENAME_NOREPLACE, RENAME_EXCHANGE, RENAME_WHITEOUT
Yes>userfaultfd
Yes<userfaultfdERRNO res, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED
Yes>openat2FD dirfd, FSRELPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, UINT32 mode, FLAGS32 resolve: RESOLVE_BENEATH, RESOLVE_IN_ROOT, RESOLVE_NO_MAGICLINKS, RESOLVE_NO_SYMLINKS, RESOLVE_NO_XDEV, RESOLVE_CACHED
Yes<openat2FD fd, FD dirfd, FSRELPATH name, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, UINT32 mode, FLAGS32 resolve: RESOLVE_BENEATH, RESOLVE_IN_ROOT, RESOLVE_NO_MAGICLINKS, RESOLVE_NO_SYMLINKS, RESOLVE_NO_XDEV, RESOLVE_CACHED, UINT32 dev, UINT64 ino
Yes>mprotectUINT64 addr, UINT64 length, FLAGS32 prot: PROT_READ, PROT_WRITE, PROT_EXEC, PROT_SEM, PROT_GROWSDOWN, PROT_GROWSUP, PROT_SAO, PROT_NONE
Yes<mprotectERRNO res
Yes>execveatFD dirfd, FSRELPATH pathname, FLAGS32 flags: AT_EMPTY_PATH, AT_SYMLINK_NOFOLLOW
Yes<execveatERRNO res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, UINT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, BYTEBUF env, UINT32 tty, PID pgid, UID loginuid, FLAGS32 flags: EXE_WRITABLE, EXE_UPPER_LAYER, EXE_FROM_MEMFD, UINT64 cap_inheritable, UINT64 cap_permitted, UINT64 cap_effective, UINT64 exe_ino, ABSTIME exe_ino_ctime, ABSTIME exe_ino_mtime, UID uid, FSPATH trusted_exepath
Yes>copy_file_rangeFD fdin, UINT64 offin, UINT64 len
Yes<copy_file_rangeERRNO res, FD fdout, UINT64 offout
Yes>clone3
Yes<clone3PID res, CHARBUF exe, BYTEBUF args, PID tid, PID pid, PID ptid, CHARBUF cwd, INT64 fdlimit, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap, CHARBUF comm, BYTEBUF cgroups, FLAGS32 flags: CLONE_FILES, CLONE_FS, CLONE_IO, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, CLONE_PARENT, CLONE_PARENT_SETTID, CLONE_PTRACE, CLONE_SIGHAND, CLONE_SYSVSEM, CLONE_THREAD, CLONE_UNTRACED, CLONE_VM, CLONE_INVERTED, NAME_CHANGED, CLOSED, CLONE_NEWUSER, CLONE_CHILD_CLEARTID, CLONE_CHILD_SETTID, CLONE_SETTLS, CLONE_STOPPED, CLONE_VFORK, CLONE_NEWCGROUP, UINT32 uid, UINT32 gid, PID vtid, PID vpid, UINT64 pidns_init_start_ts
Yes>open_by_handle_at
Yes<open_by_handle_atFD fd, FD mountfd, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED, FSPATH path, UINT32 dev, UINT64 ino
Yes>io_uring_setup
Yes<io_uring_setupERRNO res, UINT32 entries, UINT32 sq_entries, UINT32 cq_entries, FLAGS32 flags: IORING_SETUP_IOPOLL, IORING_SETUP_SQPOLL, IORING_SQ_NEED_WAKEUP, IORING_SETUP_SQ_AFF, IORING_SETUP_CQSIZE, IORING_SETUP_CLAMP, IORING_SETUP_ATTACH_RW, IORING_SETUP_R_DISABLED, UINT32 sq_thread_cpu, UINT32 sq_thread_idle, FLAGS32 features: IORING_FEAT_SINGLE_MMAP, IORING_FEAT_NODROP, IORING_FEAT_SUBMIT_STABLE, IORING_FEAT_RW_CUR_POS, IORING_FEAT_CUR_PERSONALITY, IORING_FEAT_FAST_POLL, IORING_FEAT_POLL_32BITS, IORING_FEAT_SQPOLL_NONFIXED, IORING_FEAT_ENTER_EXT_ARG, IORING_FEAT_NATIVE_WORKERS, IORING_FEAT_RSRC_TAGS
Yes>io_uring_enter
Yes<io_uring_enterERRNO res, FD fd, UINT32 to_submit, UINT32 min_complete, FLAGS32 flags: IORING_ENTER_GETEVENTS, IORING_ENTER_SQ_WAKEUP, IORING_ENTER_SQ_WAIT, IORING_ENTER_EXT_ARG, SIGSET sig
Yes>io_uring_register
Yes<io_uring_registerERRNO res, FD fd, ENUMFLAGS16 opcode: IORING_REGISTER_BUFFERS, IORING_UNREGISTER_BUFFERS, IORING_REGISTER_FILES, IORING_UNREGISTER_FILES, IORING_REGISTER_EVENTFD, IORING_UNREGISTER_EVENTFD, IORING_REGISTER_FILES_UPDATE, IORING_REGISTER_EVENTFD_ASYNC, IORING_REGISTER_PROBE, IORING_REGISTER_PERSONALITY, IORING_UNREGISTER_PERSONALITY, IORING_REGISTER_RESTRICTIONS, IORING_REGISTER_ENABLE_RINGS, IORING_REGISTER_FILES2, IORING_REGISTER_FILES_UPDATE2, IORING_REGISTER_BUFFERS2, IORING_REGISTER_BUFFERS_UPDATE, IORING_REGISTER_IOWQ_AFF, IORING_UNREGISTER_IOWQ_AFF, IORING_REGISTER_IOWQ_MAX_WORKERS, IORING_REGISTER_RING_FDS, IORING_UNREGISTER_RING_FDS, UINT64 arg, UINT32 nr_args
Yes>mlock
Yes<mlockERRNO res, UINT64 addr, UINT64 len
Yes>munlock
Yes<munlockERRNO res, UINT64 addr, UINT64 len
Yes>mlockall
Yes<mlockallERRNO res, FLAGS32 flags: MCL_CURRENT, MCL_FUTURE, MCL_ONFAULT
Yes>munlockall
Yes<munlockallERRNO res
Yes>capset
Yes<capsetERRNO res, UINT64 cap_inheritable, UINT64 cap_permitted, UINT64 cap_effective
Yes>dup2FD fd
Yes<dup2FD res, FD oldfd, FD newfd
Yes>dup3FD fd
Yes<dup3FD res, FD oldfd, FD newfd, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED
Yes>dupFD fd
Yes<dupFD res, FD oldfd
Yes>bpfINT64 cmd
Yes<bpfFD fd, ENUMFLAGS32 cmd: BPF_MAP_CREATE, BPF_MAP_LOOKUP_ELEM, BPF_MAP_UPDATE_ELEM, BPF_MAP_DELETE_ELEM, BPF_MAP_GET_NEXT_KEY, BPF_PROG_LOAD, BPF_OBJ_PIN, BPF_OBJ_GET, BPF_PROG_ATTACH, BPF_PROG_DETACH, BPF_PROG_TEST_RUN, BPF_PROG_RUN, BPF_PROG_GET_NEXT_ID, BPF_MAP_GET_NEXT_ID, BPF_PROG_GET_FD_BY_ID, BPF_MAP_GET_FD_BY_ID, BPF_OBJ_GET_INFO_BY_FD, BPF_PROG_QUERY, BPF_RAW_TRACEPOINT_OPEN, BPF_BTF_LOAD, BPF_BTF_GET_FD_BY_ID, BPF_TASK_FD_QUERY, BPF_MAP_LOOKUP_AND_DELETE_ELEM, BPF_MAP_FREEZE, BPF_BTF_GET_NEXT_ID, BPF_MAP_LOOKUP_BATCH, BPF_MAP_LOOKUP_AND_DELETE_BATCH, BPF_MAP_UPDATE_BATCH, BPF_MAP_DELETE_BATCH, BPF_LINK_CREATE, BPF_LINK_UPDATE, BPF_LINK_GET_FD_BY_ID, BPF_LINK_GET_NEXT_ID, BPF_ENABLE_STATS, BPF_ITER_CREATE, BPF_LINK_DETACH, BPF_PROG_BIND_MAP
Yes>mlock2
Yes<mlock2ERRNO res, UINT64 addr, UINT64 len, FLAGS32 flags: MLOCK_ONFAULT
Yes>fsconfig
Yes<fsconfigERRNO res, FD fd, ENUMFLAGS32 cmd: FSCONFIG_SET_FLAG, FSCONFIG_SET_STRING, FSCONFIG_SET_BINARY, FSCONFIG_SET_PATH, FSCONFIG_SET_PATH_EMPTY, FSCONFIG_SET_FD, FSCONFIG_CMD_CREATE, FSCONFIG_CMD_RECONFIGURE, CHARBUF key, BYTEBUF value_bytebuf, CHARBUF value_charbuf, INT32 aux
Yes>epoll_createINT32 size
Yes<epoll_createERRNO res
Yes>epoll_create1FLAGS32 flags: EPOLL_CLOEXEC
Yes<epoll_create1ERRNO res
Yes>chown
Yes<chownERRNO res, FSPATH path, UINT32 uid, UINT32 gid
Yes>lchown
Yes<lchownERRNO res, FSPATH path, UINT32 uid, UINT32 gid
Yes>fchown
Yes<fchownERRNO res, FD fd, UINT32 uid, UINT32 gid
Yes>fchownat
Yes<fchownatERRNO res, FD dirfd, FSRELPATH pathname, UINT32 uid, UINT32 gid, FLAGS32 flags: AT_SYMLINK_NOFOLLOW, AT_EMPTY_PATH
Yes>umount
Yes<umountERRNO res, FSPATH name
Yes>accept4INT32 flags
Yes<accept4FD fd, SOCKTUPLE tuple, UINT8 queuepct, UINT32 queuelen, UINT32 queuemax
Yes>umount2FLAGS32 flags: FORCE, DETACH, EXPIRE, NOFOLLOW
Yes<umount2ERRNO res, FSPATH name
Yes>pipe2
Yes<pipe2ERRNO res, FD fd1, FD fd2, UINT64 ino, FLAGS32 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED
Yes>inotify_init1
Yes<inotify_init1FD res, FLAGS16 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED
Yes>eventfd2UINT64 initval
Yes<eventfd2FD res, FLAGS16 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED
Yes>signalfd4FD fd, UINT32 mask
Yes<signalfd4FD res, FLAGS16 flags: O_LARGEFILE, O_DIRECTORY, O_DIRECT, O_TRUNC, O_SYNC, O_NONBLOCK, O_EXCL, O_DSYNC, O_APPEND, O_CREAT, O_RDWR, O_WRONLY, O_RDONLY, O_CLOEXEC, O_NONE, O_TMPFILE, O_F_CREATED
Yes>prctl
Yes<prctlERRNO res, ENUMFLAGS32 option: PR_GET_DUMPABLE, PR_SET_DUMPABLE, PR_GET_KEEPCAPS, PR_SET_KEEPCAPS, PR_SET_NAME, PR_GET_NAME, PR_GET_SECCOMP, PR_SET_SECCOMP, PR_CAPBSET_READ, PR_CAPBSET_DROP, PR_GET_SECUREBITS, PR_SET_SECUREBITS, PR_MCE_KILL, PR_MCE_KILL, PR_SET_MM, PR_SET_CHILD_SUBREAPER, PR_GET_CHILD_SUBREAPER, PR_SET_NO_NEW_PRIVS, PR_GET_NO_NEW_PRIVS, PR_GET_TID_ADDRESS, PR_SET_THP_DISABLE, PR_GET_THP_DISABLE, PR_CAP_AMBIENT, CHARBUF arg2_str, INT64 arg2_int
Yes>memfd_create
Yes<memfd_createFD fd, CHARBUF name, FLAGS32 flags: MFD_CLOEXEC, MFD_ALLOW_SEALING, MFD_HUGETLB
Yes>pidfd_getfd
Yes<pidfd_getfdFD fd, FD pid_fd, FD target_fd, UINT32 flags
Yes>pidfd_open
Yes<pidfd_openFD fd, PID pid, FLAGS32 flags: PIDFD_NONBLOCK
Yes>init_module
Yes<init_moduleERRNO res, BYTEBUF img, UINT64 length, CHARBUF uargs
Yes>finit_module
Yes<finit_moduleERRNO res, FD fd, CHARBUF uargs, FLAGS32 flags: MODULE_INIT_IGNORE_MODVERSIONS, MODULE_INIT_IGNORE_VERMAGIC, MODULE_INIT_COMPRESSED_FILE
Yes>mknod
Yes<mknodERRNO res, FSPATH path, MODE mode, UINT32 dev
Yes>mknodat
Yes<mknodatERRNO res, FD dirfd, FSRELPATH path, MODE mode, UINT32 dev
Yes>newfstatat
Yes<newfstatatERRNO res, FD dirfd, FSRELPATH path, FLAGS32 flags: AT_EMPTY_PATH, AT_NO_AUTOMOUNT, AT_SYMLINK_NOFOLLOW
Yes>process_vm_readv
Yes<process_vm_readvINT64 res, PID pid, BYTEBUF data
Yes>process_vm_writev
Yes<process_vm_writevINT64 res, PID pid, BYTEBUF data
Yes>delete_module
Yes<delete_moduleERRNO res, CHARBUF name, FLAGS32 flags: O_NONBLOCK, O_TRUNC
Yes>lsm_get_self_attrSYSCALLID ID, UINT16 nativeID
Yes<lsm_get_self_attrSYSCALLID ID
Yes>listmountSYSCALLID ID, UINT16 nativeID
Yes<listmountSYSCALLID ID
Yes>vm86SYSCALLID ID, UINT16 nativeID
Yes<vm86SYSCALLID ID
Yes>pciconfig_readSYSCALLID ID, UINT16 nativeID
Yes<pciconfig_readSYSCALLID ID
Yes>rtasSYSCALLID ID, UINT16 nativeID
Yes<rtasSYSCALLID ID
Yes>pciconfig_writeSYSCALLID ID, UINT16 nativeID
Yes<pciconfig_writeSYSCALLID ID
Yes>swapcontextSYSCALLID ID, UINT16 nativeID
Yes<swapcontextSYSCALLID ID
Yes>spu_runSYSCALLID ID, UINT16 nativeID
Yes<spu_runSYSCALLID ID
Yes>oldfstatSYSCALLID ID, UINT16 nativeID
Yes<oldfstatSYSCALLID ID
Yes>sync_file_range2SYSCALLID ID, UINT16 nativeID
Yes<sync_file_range2SYSCALLID ID
Yes>spu_createSYSCALLID ID, UINT16 nativeID
Yes<spu_createSYSCALLID ID
Yes>oldlstatSYSCALLID ID, UINT16 nativeID
Yes<oldlstatSYSCALLID ID
Yes>oldstatSYSCALLID ID, UINT16 nativeID
Yes<oldstatSYSCALLID ID
Yes>riscv_flush_icacheSYSCALLID ID, UINT16 nativeID
Yes<riscv_flush_icacheSYSCALLID ID
Yes>cachestatSYSCALLID ID, UINT16 nativeID
Yes<cachestatSYSCALLID ID
Yes>sigreturnSYSCALLID ID, UINT16 nativeID
Yes<sigreturnSYSCALLID ID
Yes>s390_runtime_instrSYSCALLID ID, UINT16 nativeID
Yes<s390_runtime_instrSYSCALLID ID
Yes>idleSYSCALLID ID, UINT16 nativeID
Yes<idleSYSCALLID ID
Yes>s390_sthyiSYSCALLID ID, UINT16 nativeID
Yes<s390_sthyiSYSCALLID ID
Yes>sigactionSYSCALLID ID, UINT16 nativeID
Yes<sigactionSYSCALLID ID
Yes>s390_pci_mmio_readSYSCALLID ID, UINT16 nativeID
Yes<s390_pci_mmio_readSYSCALLID ID
Yes>timerfdSYSCALLID ID, UINT16 nativeID
Yes<timerfdSYSCALLID ID
Yes>fanotify_markSYSCALLID ID, UINT16 nativeID
Yes<fanotify_markSYSCALLID ID
Yes>close_rangeSYSCALLID ID, UINT16 nativeID
Yes<close_rangeSYSCALLID ID
Yes>process_madviseSYSCALLID ID, UINT16 nativeID
Yes<process_madviseSYSCALLID ID
Yes>sync_file_rangeSYSCALLID ID, UINT16 nativeID
Yes<sync_file_rangeSYSCALLID ID
Yes>get_mempolicySYSCALLID ID, UINT16 nativeID
Yes<get_mempolicySYSCALLID ID
Yes>query_moduleSYSCALLID ID, UINT16 nativeID
Yes<query_moduleSYSCALLID ID
Yes>_sysctlSYSCALLID ID, UINT16 nativeID
Yes<_sysctlSYSCALLID ID
Yes>nfsservctlSYSCALLID ID, UINT16 nativeID
Yes<nfsservctlSYSCALLID ID
Yes>futex_waitvSYSCALLID ID, UINT16 nativeID
Yes<futex_waitvSYSCALLID ID
Yes>readaheadSYSCALLID ID, UINT16 nativeID
Yes<readaheadSYSCALLID ID
Yes>set_mempolicy_home_nodeSYSCALLID ID, UINT16 nativeID
Yes<set_mempolicy_home_nodeSYSCALLID ID
Yes>teeSYSCALLID ID, UINT16 nativeID
Yes<teeSYSCALLID ID
Yes>vmspliceSYSCALLID ID, UINT16 nativeID
Yes<vmspliceSYSCALLID ID
Yes>msggetSYSCALLID ID, UINT16 nativeID
Yes<msggetSYSCALLID ID
Yes>io_geteventsSYSCALLID ID, UINT16 nativeID
Yes<io_geteventsSYSCALLID ID
Yes>timerfd_settimeSYSCALLID ID, UINT16 nativeID
Yes<timerfd_settimeSYSCALLID ID
Yes>rseqSYSCALLID ID, UINT16 nativeID
Yes<rseqSYSCALLID ID
Yes>set_thread_areaSYSCALLID ID, UINT16 nativeID
Yes<set_thread_areaSYSCALLID ID
Yes>fremovexattrSYSCALLID ID, UINT16 nativeID
Yes<fremovexattrSYSCALLID ID
Yes>removexattrSYSCALLID ID, UINT16 nativeID
Yes<removexattrSYSCALLID ID
Yes>s390_pci_mmio_writeSYSCALLID ID, UINT16 nativeID
Yes<s390_pci_mmio_writeSYSCALLID ID
Yes>flistxattrSYSCALLID ID, UINT16 nativeID
Yes<flistxattrSYSCALLID ID
Yes>sched_get_priority_minSYSCALLID ID, UINT16 nativeID
Yes<sched_get_priority_minSYSCALLID ID
Yes>remap_file_pagesSYSCALLID ID, UINT16 nativeID
Yes<remap_file_pagesSYSCALLID ID
Yes>mbindSYSCALLID ID, UINT16 nativeID
Yes<mbindSYSCALLID ID
Yes>getxattrSYSCALLID ID, UINT16 nativeID
Yes<getxattrSYSCALLID ID
Yes>gettidSYSCALLID ID, UINT16 nativeID
Yes<gettidSYSCALLID ID
Yes>shmatSYSCALLID ID, UINT16 nativeID
Yes<shmatSYSCALLID ID
Yes>setfsgidSYSCALLID ID, UINT16 nativeID
Yes<setfsgidSYSCALLID ID
Yes>get_kernel_symsSYSCALLID ID, UINT16 nativeID
Yes<get_kernel_symsSYSCALLID ID
Yes>setgroupsSYSCALLID ID, UINT16 nativeID
Yes<setgroupsSYSCALLID ID
Yes>getpmsgSYSCALLID ID, UINT16 nativeID
Yes<getpmsgSYSCALLID ID
Yes>rt_sigactionSYSCALLID ID, UINT16 nativeID
Yes<rt_sigactionSYSCALLID ID
Yes>getgroupsSYSCALLID ID, UINT16 nativeID
Yes<getgroupsSYSCALLID ID
Yes>io_cancelSYSCALLID ID, UINT16 nativeID
Yes<io_cancelSYSCALLID ID
Yes>setreuidSYSCALLID ID, UINT16 nativeID
Yes<setreuidSYSCALLID ID
Yes>capgetSYSCALLID ID, UINT16 nativeID
Yes<capgetSYSCALLID ID
Yes>madviseSYSCALLID ID, UINT16 nativeID
Yes<madviseSYSCALLID ID
Yes>lsm_list_modulesSYSCALLID ID, UINT16 nativeID
Yes<lsm_list_modulesSYSCALLID ID
Yes>setdomainnameSYSCALLID ID, UINT16 nativeID
Yes<setdomainnameSYSCALLID ID
Yes>rt_sigsuspendSYSCALLID ID, UINT16 nativeID
Yes<rt_sigsuspendSYSCALLID ID
Yes>pciconfig_iobaseSYSCALLID ID, UINT16 nativeID
Yes<pciconfig_iobaseSYSCALLID ID
Yes>rt_sigqueueinfoSYSCALLID ID, UINT16 nativeID
Yes<rt_sigqueueinfoSYSCALLID ID
Yes>preadv2SYSCALLID ID, UINT16 nativeID
Yes<preadv2SYSCALLID ID
Yes>io_destroySYSCALLID ID, UINT16 nativeID
Yes<io_destroySYSCALLID ID
Yes>name_to_handle_atSYSCALLID ID, UINT16 nativeID
Yes<name_to_handle_atSYSCALLID ID
Yes>setxattrSYSCALLID ID, UINT16 nativeID
Yes<setxattrSYSCALLID ID
Yes>faccessat2SYSCALLID ID, UINT16 nativeID
Yes<faccessat2SYSCALLID ID
Yes>rt_sigtimedwaitSYSCALLID ID, UINT16 nativeID
Yes<rt_sigtimedwaitSYSCALLID ID
Yes>timer_gettimeSYSCALLID ID, UINT16 nativeID
Yes<timer_gettimeSYSCALLID ID
Yes>switch_endianSYSCALLID ID, UINT16 nativeID
Yes<switch_endianSYSCALLID ID
Yes>s390_guarded_storageSYSCALLID ID, UINT16 nativeID
Yes<s390_guarded_storageSYSCALLID ID
Yes>timer_createSYSCALLID ID, UINT16 nativeID
Yes<timer_createSYSCALLID ID
Yes>swaponSYSCALLID ID, UINT16 nativeID
Yes<swaponSYSCALLID ID
Yes>rt_sigprocmaskSYSCALLID ID, UINT16 nativeID
Yes<rt_sigprocmaskSYSCALLID ID
Yes>faccessatSYSCALLID ID, UINT16 nativeID
Yes<faccessatSYSCALLID ID
Yes>lremovexattrSYSCALLID ID, UINT16 nativeID
Yes<lremovexattrSYSCALLID ID
Yes>multiplexerSYSCALLID ID, UINT16 nativeID
Yes<multiplexerSYSCALLID ID
Yes>sched_setschedulerSYSCALLID ID, UINT16 nativeID
Yes<sched_setschedulerSYSCALLID ID
Yes>rebootSYSCALLID ID, UINT16 nativeID
Yes<rebootSYSCALLID ID
Yes>getsidSYSCALLID ID, UINT16 nativeID
Yes<getsidSYSCALLID ID
Yes>futex_wakeSYSCALLID ID, UINT16 nativeID
Yes<futex_wakeSYSCALLID ID
Yes>settimeofdaySYSCALLID ID, UINT16 nativeID
Yes<settimeofdaySYSCALLID ID
Yes>getrusageSYSCALLID ID, UINT16 nativeID
Yes<getrusageSYSCALLID ID
Yes>setitimerSYSCALLID ID, UINT16 nativeID
Yes<setitimerSYSCALLID ID
Yes>lsm_set_self_attrSYSCALLID ID, UINT16 nativeID
Yes<lsm_set_self_attrSYSCALLID ID
Yes>setregidSYSCALLID ID, UINT16 nativeID
Yes<setregidSYSCALLID ID
Yes>vhangupSYSCALLID ID, UINT16 nativeID
Yes<vhangupSYSCALLID ID
Yes>get_thread_areaSYSCALLID ID, UINT16 nativeID
Yes<get_thread_areaSYSCALLID ID
Yes>alarmSYSCALLID ID, UINT16 nativeID
Yes<alarmSYSCALLID ID
Yes>wait4SYSCALLID ID, UINT16 nativeID
Yes<wait4SYSCALLID ID
Yes>sched_setattrSYSCALLID ID, UINT16 nativeID
Yes<sched_setattrSYSCALLID ID
Yes>utimesSYSCALLID ID, UINT16 nativeID
Yes<utimesSYSCALLID ID
Yes>timesSYSCALLID ID, UINT16 nativeID
Yes<timesSYSCALLID ID
Yes>truncateSYSCALLID ID, UINT16 nativeID
Yes<truncateSYSCALLID ID
Yes>sched_getparamSYSCALLID ID, UINT16 nativeID
Yes<sched_getparamSYSCALLID ID
Yes>sched_getschedulerSYSCALLID ID, UINT16 nativeID
Yes<sched_getschedulerSYSCALLID ID
Yes>umaskSYSCALLID ID, UINT16 nativeID
Yes<umaskSYSCALLID ID
Yes>rt_sigpendingSYSCALLID ID, UINT16 nativeID
Yes<rt_sigpendingSYSCALLID ID
Yes>pkey_allocSYSCALLID ID, UINT16 nativeID
Yes<pkey_allocSYSCALLID ID
Yes>io_pgeteventsSYSCALLID ID, UINT16 nativeID
Yes<io_pgeteventsSYSCALLID ID
Yes>set_tid_addressSYSCALLID ID, UINT16 nativeID
Yes<set_tid_addressSYSCALLID ID
Yes>uselibSYSCALLID ID, UINT16 nativeID
Yes<uselibSYSCALLID ID
Yes>sigsuspendSYSCALLID ID, UINT16 nativeID
Yes<sigsuspendSYSCALLID ID
Yes>setfsuidSYSCALLID ID, UINT16 nativeID
Yes<setfsuidSYSCALLID ID
Yes>readdirSYSCALLID ID, UINT16 nativeID
Yes<readdirSYSCALLID ID
Yes>clock_gettimeSYSCALLID ID, UINT16 nativeID
Yes<clock_gettimeSYSCALLID ID
Yes>gettimeofdaySYSCALLID ID, UINT16 nativeID
Yes<gettimeofdaySYSCALLID ID
Yes>restart_syscallSYSCALLID ID, UINT16 nativeID
Yes<restart_syscallSYSCALLID ID
Yes>mq_openSYSCALLID ID, UINT16 nativeID
Yes<mq_openSYSCALLID ID
Yes>lsetxattrSYSCALLID ID, UINT16 nativeID
Yes<lsetxattrSYSCALLID ID
Yes>sysinfoSYSCALLID ID, UINT16 nativeID
Yes<sysinfoSYSCALLID ID
Yes>mremapSYSCALLID ID, UINT16 nativeID
Yes<mremapSYSCALLID ID
Yes>epoll_pwaitSYSCALLID ID, UINT16 nativeID
Yes<epoll_pwaitSYSCALLID ID
Yes>getprioritySYSCALLID ID, UINT16 nativeID
Yes<getprioritySYSCALLID ID
Yes>adjtimexSYSCALLID ID, UINT16 nativeID
Yes<adjtimexSYSCALLID ID
Yes>fdatasyncSYSCALLID ID, UINT16 nativeID
Yes<fdatasyncSYSCALLID ID
Yes>fstatfs64SYSCALLID ID, UINT16 nativeID
Yes<fstatfs64SYSCALLID ID
Yes>sched_getaffinitySYSCALLID ID, UINT16 nativeID
Yes<sched_getaffinitySYSCALLID ID
Yes>pauseSYSCALLID ID, UINT16 nativeID
Yes<pauseSYSCALLID ID
Yes>statfsSYSCALLID ID, UINT16 nativeID
Yes<statfsSYSCALLID ID
Yes>riscv_hwprobeSYSCALLID ID, UINT16 nativeID
Yes<riscv_hwprobeSYSCALLID ID
Yes>epoll_ctlSYSCALLID ID, UINT16 nativeID
Yes<epoll_ctlSYSCALLID ID
Yes>exit_groupSYSCALLID ID, UINT16 nativeID
Yes<exit_groupSYSCALLID ID
Yes>mq_timedsendSYSCALLID ID, UINT16 nativeID
Yes<mq_timedsendSYSCALLID ID
Yes>getppidSYSCALLID ID, UINT16 nativeID
Yes<getppidSYSCALLID ID
Yes>getpidSYSCALLID ID, UINT16 nativeID
Yes<getpidSYSCALLID ID
Yes>lgetxattrSYSCALLID ID, UINT16 nativeID
Yes<lgetxattrSYSCALLID ID
Yes>process_mreleaseSYSCALLID ID, UINT16 nativeID
Yes<process_mreleaseSYSCALLID ID
Yes>kexec_loadSYSCALLID ID, UINT16 nativeID
Yes<kexec_loadSYSCALLID ID
Yes>ioprio_getSYSCALLID ID, UINT16 nativeID
Yes<ioprio_getSYSCALLID ID
Yes>acctSYSCALLID ID, UINT16 nativeID
Yes<acctSYSCALLID ID
Yes>epoll_pwait2SYSCALLID ID, UINT16 nativeID
Yes<epoll_pwait2SYSCALLID ID
Yes>getpgrpSYSCALLID ID, UINT16 nativeID
Yes<getpgrpSYSCALLID ID
Yes>syncSYSCALLID ID, UINT16 nativeID
Yes<syncSYSCALLID ID
Yes>readlinkSYSCALLID ID, UINT16 nativeID
Yes<readlinkSYSCALLID ID
Yes>listxattrSYSCALLID ID, UINT16 nativeID
Yes<listxattrSYSCALLID ID
Yes>sigprocmaskSYSCALLID ID, UINT16 nativeID
Yes<sigprocmaskSYSCALLID ID
Yes>getpgidSYSCALLID ID, UINT16 nativeID
Yes<getpgidSYSCALLID ID
Yes>syslogSYSCALLID ID, UINT16 nativeID
Yes<syslogSYSCALLID ID
Yes>fstatfsSYSCALLID ID, UINT16 nativeID
Yes<fstatfsSYSCALLID ID
Yes>ftruncateSYSCALLID ID, UINT16 nativeID
Yes<ftruncateSYSCALLID ID
Yes>unameSYSCALLID ID, UINT16 nativeID
Yes<unameSYSCALLID ID
Yes>getitimerSYSCALLID ID, UINT16 nativeID
Yes<getitimerSYSCALLID ID
Yes>exitSYSCALLID ID, UINT16 nativeID
Yes<exitSYSCALLID ID
Yes>swapoffSYSCALLID ID, UINT16 nativeID
Yes<swapoffSYSCALLID ID
Yes>fsetxattrSYSCALLID ID, UINT16 nativeID
Yes<fsetxattrSYSCALLID ID
Yes>utimeSYSCALLID ID, UINT16 nativeID
Yes<utimeSYSCALLID ID
Yes>pivot_rootSYSCALLID ID, UINT16 nativeID
Yes<pivot_rootSYSCALLID ID
Yes>ustatSYSCALLID ID, UINT16 nativeID
Yes<ustatSYSCALLID ID
Yes>mq_getsetattrSYSCALLID ID, UINT16 nativeID
Yes<mq_getsetattrSYSCALLID ID
Yes>statmountSYSCALLID ID, UINT16 nativeID
Yes<statmountSYSCALLID ID
Yes>setprioritySYSCALLID ID, UINT16 nativeID
Yes<setprioritySYSCALLID ID
Yes>oldoldunameSYSCALLID ID, UINT16 nativeID
Yes<oldoldunameSYSCALLID ID
Yes>fsyncSYSCALLID ID, UINT16 nativeID
Yes<fsyncSYSCALLID ID
Yes>pidfd_send_signalSYSCALLID ID, UINT16 nativeID
Yes<pidfd_send_signalSYSCALLID ID
Yes>sched_yieldSYSCALLID ID, UINT16 nativeID
Yes<sched_yieldSYSCALLID ID
Yes>quotactl_fdSYSCALLID ID, UINT16 nativeID
Yes<quotactl_fdSYSCALLID ID
Yes>io_setupSYSCALLID ID, UINT16 nativeID
Yes<io_setupSYSCALLID ID
Yes>llistxattrSYSCALLID ID, UINT16 nativeID
Yes<llistxattrSYSCALLID ID
Yes>mincoreSYSCALLID ID, UINT16 nativeID
Yes<mincoreSYSCALLID ID
Yes>sched_setparamSYSCALLID ID, UINT16 nativeID
Yes<sched_setparamSYSCALLID ID
Yes>timeSYSCALLID ID, UINT16 nativeID
Yes<timeSYSCALLID ID
Yes>msyncSYSCALLID ID, UINT16 nativeID
Yes<msyncSYSCALLID ID
Yes>keyctlSYSCALLID ID, UINT16 nativeID
Yes<keyctlSYSCALLID ID
Yes>personalitySYSCALLID ID, UINT16 nativeID
Yes<personalitySYSCALLID ID
Yes>migrate_pagesSYSCALLID ID, UINT16 nativeID
Yes<migrate_pagesSYSCALLID ID
Yes>io_submitSYSCALLID ID, UINT16 nativeID
Yes<io_submitSYSCALLID ID
Yes>timer_settimeSYSCALLID ID, UINT16 nativeID
Yes<timer_settimeSYSCALLID ID
Yes>clock_nanosleepSYSCALLID ID, UINT16 nativeID
Yes<clock_nanosleepSYSCALLID ID
Yes>ioprio_setSYSCALLID ID, UINT16 nativeID
Yes<ioprio_setSYSCALLID ID
Yes>inotify_add_watchSYSCALLID ID, UINT16 nativeID
Yes<inotify_add_watchSYSCALLID ID
Yes>fchmodat2SYSCALLID ID, UINT16 nativeID
Yes<fchmodat2SYSCALLID ID
Yes>kexec_file_loadSYSCALLID ID, UINT16 nativeID
Yes<kexec_file_loadSYSCALLID ID
Yes>subpage_protSYSCALLID ID, UINT16 nativeID
Yes<subpage_protSYSCALLID ID
Yes>timer_getoverrunSYSCALLID ID, UINT16 nativeID
Yes<timer_getoverrunSYSCALLID ID
Yes>timer_deleteSYSCALLID ID, UINT16 nativeID
Yes<timer_deleteSYSCALLID ID
Yes>clock_getresSYSCALLID ID, UINT16 nativeID
Yes<clock_getresSYSCALLID ID
Yes>futex_waitSYSCALLID ID, UINT16 nativeID
Yes<futex_waitSYSCALLID ID
Yes>semtimedopSYSCALLID ID, UINT16 nativeID
Yes<semtimedopSYSCALLID ID
Yes>mq_unlinkSYSCALLID ID, UINT16 nativeID
Yes<mq_unlinkSYSCALLID ID
Yes>mq_timedreceiveSYSCALLID ID, UINT16 nativeID
Yes<mq_timedreceiveSYSCALLID ID
Yes>fallocateSYSCALLID ID, UINT16 nativeID
Yes<fallocateSYSCALLID ID
Yes>waitidSYSCALLID ID, UINT16 nativeID
Yes<waitidSYSCALLID ID
Yes>add_keySYSCALLID ID, UINT16 nativeID
Yes<add_keySYSCALLID ID
Yes>request_keySYSCALLID ID, UINT16 nativeID
Yes<request_keySYSCALLID ID
Yes>utimensatSYSCALLID ID, UINT16 nativeID
Yes<utimensatSYSCALLID ID
Yes>inotify_rm_watchSYSCALLID ID, UINT16 nativeID
Yes<inotify_rm_watchSYSCALLID ID
Yes>futimesatSYSCALLID ID, UINT16 nativeID
Yes<futimesatSYSCALLID ID
Yes>msgctlSYSCALLID ID, UINT16 nativeID
Yes<msgctlSYSCALLID ID
Yes>sgetmaskSYSCALLID ID, UINT16 nativeID
Yes<sgetmaskSYSCALLID ID
Yes>sysfsSYSCALLID ID, UINT16 nativeID
Yes<sysfsSYSCALLID ID
Yes>rt_sigreturnSYSCALLID ID, UINT16 nativeID
Yes<rt_sigreturnSYSCALLID ID
Yes>readlinkatSYSCALLID ID, UINT16 nativeID
Yes<readlinkatSYSCALLID ID
Yes>pselect6SYSCALLID ID, UINT16 nativeID
Yes<pselect6SYSCALLID ID
Yes>set_robust_listSYSCALLID ID, UINT16 nativeID
Yes<set_robust_listSYSCALLID ID
Yes>get_robust_listSYSCALLID ID, UINT16 nativeID
Yes<get_robust_listSYSCALLID ID
Yes>getcpuSYSCALLID ID, UINT16 nativeID
Yes<getcpuSYSCALLID ID
Yes>fstatat64SYSCALLID ID, UINT16 nativeID
Yes<fstatat64SYSCALLID ID
Yes>fgetxattrSYSCALLID ID, UINT16 nativeID
Yes<fgetxattrSYSCALLID ID
Yes>perf_event_openSYSCALLID ID, UINT16 nativeID
Yes<perf_event_openSYSCALLID ID
Yes>rt_tgsigqueueinfoSYSCALLID ID, UINT16 nativeID
Yes<rt_tgsigqueueinfoSYSCALLID ID
Yes>mount_setattrSYSCALLID ID, UINT16 nativeID
Yes<mount_setattrSYSCALLID ID
Yes>clock_settimeSYSCALLID ID, UINT16 nativeID
Yes<clock_settimeSYSCALLID ID
Yes>epoll_ctl_oldSYSCALLID ID, UINT16 nativeID
Yes<epoll_ctl_oldSYSCALLID ID
Yes>clock_adjtimeSYSCALLID ID, UINT16 nativeID
Yes<clock_adjtimeSYSCALLID ID
Yes>landlock_create_rulesetSYSCALLID ID, UINT16 nativeID
Yes<landlock_create_rulesetSYSCALLID ID
Yes>syncfsSYSCALLID ID, UINT16 nativeID
Yes<syncfsSYSCALLID ID
Yes>msgsndSYSCALLID ID, UINT16 nativeID
Yes<msgsndSYSCALLID ID
Yes>statfs64SYSCALLID ID, UINT16 nativeID
Yes<statfs64SYSCALLID ID
Yes>ioplSYSCALLID ID, UINT16 nativeID
Yes<ioplSYSCALLID ID
Yes>msgrcvSYSCALLID ID, UINT16 nativeID
Yes<msgrcvSYSCALLID ID
Yes>shmdtSYSCALLID ID, UINT16 nativeID
Yes<shmdtSYSCALLID ID
Yes>timerfd_gettimeSYSCALLID ID, UINT16 nativeID
Yes<timerfd_gettimeSYSCALLID ID
Yes>shmgetSYSCALLID ID, UINT16 nativeID
Yes<shmgetSYSCALLID ID
Yes>sethostnameSYSCALLID ID, UINT16 nativeID
Yes<sethostnameSYSCALLID ID
Yes>mq_notifySYSCALLID ID, UINT16 nativeID
Yes<mq_notifySYSCALLID ID
Yes>shmctlSYSCALLID ID, UINT16 nativeID
Yes<shmctlSYSCALLID ID
Yes>move_pagesSYSCALLID ID, UINT16 nativeID
Yes<move_pagesSYSCALLID ID
Yes>fsmountSYSCALLID ID, UINT16 nativeID
Yes<fsmountSYSCALLID ID
Yes>bdflushSYSCALLID ID, UINT16 nativeID
Yes<bdflushSYSCALLID ID
Yes>fanotify_initSYSCALLID ID, UINT16 nativeID
Yes<fanotify_initSYSCALLID ID
Yes>ipcSYSCALLID ID, UINT16 nativeID
Yes<ipcSYSCALLID ID
Yes>futex_requeueSYSCALLID ID, UINT16 nativeID
Yes<futex_requeueSYSCALLID ID
Yes>socketcallSYSCALLID ID, UINT16 nativeID
Yes<socketcallSYSCALLID ID
Yes>epoll_wait_oldSYSCALLID ID, UINT16 nativeID
Yes<epoll_wait_oldSYSCALLID ID
Yes>arch_prctlSYSCALLID ID, UINT16 nativeID
Yes<arch_prctlSYSCALLID ID
Yes>ssetmaskSYSCALLID ID, UINT16 nativeID
Yes<ssetmaskSYSCALLID ID
Yes>sys_debug_setcontextSYSCALLID ID, UINT16 nativeID
Yes<sys_debug_setcontextSYSCALLID ID
Yes>move_mountSYSCALLID ID, UINT16 nativeID
Yes<move_mountSYSCALLID ID
Yes>sigpendingSYSCALLID ID, UINT16 nativeID
Yes<sigpendingSYSCALLID ID
Yes>lookup_dcookieSYSCALLID ID, UINT16 nativeID
Yes<lookup_dcookieSYSCALLID ID
Yes>oldunameSYSCALLID ID, UINT16 nativeID
Yes<oldunameSYSCALLID ID
Yes>fsopenSYSCALLID ID, UINT16 nativeID
Yes<fsopenSYSCALLID ID
Yes>sched_get_priority_maxSYSCALLID ID, UINT16 nativeID
Yes<sched_get_priority_maxSYSCALLID ID
Yes>signalSYSCALLID ID, UINT16 nativeID
Yes<signalSYSCALLID ID
Yes>niceSYSCALLID ID, UINT16 nativeID
Yes<niceSYSCALLID ID
Yes>map_shadow_stackSYSCALLID ID, UINT16 nativeID
Yes<map_shadow_stackSYSCALLID ID
Yes>modify_ldtSYSCALLID ID, UINT16 nativeID
Yes<modify_ldtSYSCALLID ID
Yes>_newselectSYSCALLID ID, UINT16 nativeID
Yes<_newselectSYSCALLID ID
Yes>stimeSYSCALLID ID, UINT16 nativeID
Yes<stimeSYSCALLID ID
Yes>waitpidSYSCALLID ID, UINT16 nativeID
Yes<waitpidSYSCALLID ID
Yes>sigaltstackSYSCALLID ID, UINT16 nativeID
Yes<sigaltstackSYSCALLID ID
Yes>getrandomSYSCALLID ID, UINT16 nativeID
Yes<getrandomSYSCALLID ID
Yes>fadvise64SYSCALLID ID, UINT16 nativeID
Yes<fadvise64SYSCALLID ID
Yes>fspickSYSCALLID ID, UINT16 nativeID
Yes<fspickSYSCALLID ID
Yes>pwritev2SYSCALLID ID, UINT16 nativeID
Yes<pwritev2SYSCALLID ID
Yes>open_treeSYSCALLID ID, UINT16 nativeID
Yes<open_treeSYSCALLID ID
Yes>create_moduleSYSCALLID ID, UINT16 nativeID
Yes<create_moduleSYSCALLID ID
Yes>sched_setaffinitySYSCALLID ID, UINT16 nativeID
Yes<sched_setaffinitySYSCALLID ID
Yes>sched_rr_get_intervalSYSCALLID ID, UINT16 nativeID
Yes<sched_rr_get_intervalSYSCALLID ID
Yes>memfd_secretSYSCALLID ID, UINT16 nativeID
Yes<memfd_secretSYSCALLID ID
Yes>sched_getattrSYSCALLID ID, UINT16 nativeID
Yes<sched_getattrSYSCALLID ID
Yes>iopermSYSCALLID ID, UINT16 nativeID
Yes<iopermSYSCALLID ID
Yes>pkey_mprotectSYSCALLID ID, UINT16 nativeID
Yes<pkey_mprotectSYSCALLID ID
Yes>membarrierSYSCALLID ID, UINT16 nativeID
Yes<membarrierSYSCALLID ID
Yes>pkey_freeSYSCALLID ID, UINT16 nativeID
Yes<pkey_freeSYSCALLID ID
Yes>landlock_restrict_selfSYSCALLID ID, UINT16 nativeID
Yes<landlock_restrict_selfSYSCALLID ID
Yes>landlock_add_ruleSYSCALLID ID, UINT16 nativeID
Yes<landlock_add_ruleSYSCALLID ID
Yes>kcmpSYSCALLID ID, UINT16 nativeID
Yes<kcmpSYSCALLID ID
Yes>statxSYSCALLID ID, UINT16 nativeID
Yes<statxSYSCALLID ID
Yes>set_mempolicySYSCALLID ID, UINT16 nativeID
Yes<set_mempolicySYSCALLID ID

Tracepoint events

DefaultDirNameParams
Yes>switchPID next, UINT64 pgft_maj, UINT64 pgft_min, UINT32 vm_size, UINT32 vm_rss, UINT32 vm_swap
Yes>procexitERRNO status, ERRNO ret, SIGTYPE sig, UINT8 core, PID reaper_tid
Yes>signaldeliverPID spid, PID dpid, SIGTYPE sig
Yes>page_faultUINT64 addr, UINT64 ip, FLAGS32 error: PROTECTION_VIOLATION, PAGE_NOT_PRESENT, WRITE_ACCESS, READ_ACCESS, USER_FAULT, SUPERVISOR_FAULT, RESERVED_PAGE, INSTRUCTION_FETCH

Plugin events

DefaultDirNameParams
Yes>plugineventUINT32 plugin_id, BYTEBUF event_data

Metaevents

DefaultDirNameParams
Yes>dropUINT32 ratio
Yes<dropUINT32 ratio
Yes>scapeventUINT32 event_type, UINT64 event_data
Yes>procinfoUINT64 cpu_usr, UINT64 cpu_sys
Yes>cpu_hotplugUINT32 cpu, UINT32 action
Yes>k8sCHARBUF json
Yes>tracerINT64 id, CHARBUFARRAY tags, CHARBUF_PAIR_ARRAY args
Yes<tracerINT64 id, CHARBUFARRAY tags, CHARBUF_PAIR_ARRAY args
Yes>mesosCHARBUF json
Yes>notificationCHARBUF id, CHARBUF desc
Yes>infraCHARBUF source, CHARBUF name, CHARBUF description, CHARBUF scope
Yes>containerCHARBUF json
Yes>useraddedUINT32 uid, UINT32 gid, CHARBUF name, CHARBUF home, CHARBUF shell, CHARBUF container_id
Yes>userdeletedUINT32 uid, UINT32 gid, CHARBUF name, CHARBUF home, CHARBUF shell, CHARBUF container_id
Yes>groupaddedUINT32 gid, CHARBUF name, CHARBUF container_id
Yes>groupdeletedUINT32 gid, CHARBUF name, CHARBUF container_id
Yes>asynceventUINT32 plugin_id, CHARBUF name, BYTEBUF data