global /* register event */ GROUP_REGEVT, HOOKID_REGSYSEVT, HOOKID_REGUSREVT, /* syscall */ GROUP_SYSCALL, HOOKID_SYSCALL_ENTRY, HOOKID_SYSCALL_RETURN, /* process creation */ GROUP_PROCESS, HOOKID_PROCESS_SNAPSHOT, HOOKID_PROCESS_FORK, HOOKID_PROCESS_EXECVE, /* io scheduler */ GROUP_IOSCHED, HOOKID_IOSCHED_ADD_REQ, HOOKID_IOSCHED_NEXT_REQ, HOOKID_IOSCHED_COMPLETE_REQ, /* task dispatching */ GROUP_TASK, HOOKID_TASK_CTXSWITCH, HOOKID_TASK_CPUIDLE, /* scsi */ GROUP_SCSI, HOOKID_SCSI_IOENTRY, HOOKID_SCSI_IO_TO_LLD, HOOKID_SCSI_IODONE_BY_LLD, HOOKID_SCSI_IOCOMP_BY_MIDLEVEL, /* page fault */ GROUP_PAGEFAULT, HOOKID_PAGEFAULT, /* network device */ GROUP_NETDEV, HOOKID_NETDEV_RECEIVE, HOOKID_NETDEV_TRANSMIT, /* io related syscall (not including AIO related calls) */ GROUP_IOSYSCALL, HOOKID_IOSYSCALL_OPEN_ENTRY, HOOKID_IOSYSCALL_OPEN_RETURN, HOOKID_IOSYSCALL_CLOSE_ENTRY, HOOKID_IOSYSCALL_CLOSE_RETURN, HOOKID_IOSYSCALL_READ_ENTRY, HOOKID_IOSYSCALL_READ_RETURN, HOOKID_IOSYSCALL_WRITE_ENTRY, HOOKID_IOSYSCALL_WRITE_RETURN, HOOKID_IOSYSCALL_READV_ENTRY, HOOKID_IOSYSCALL_READV_RETURN, HOOKID_IOSYSCALL_WRITEV_ENTRY, HOOKID_IOSYSCALL_WRITEV_RETURN, HOOKID_IOSYSCALL_PREAD64_ENTRY, HOOKID_IOSYSCALL_PREAD64_RETURN, HOOKID_IOSYSCALL_PWRITE64_ENTRY, HOOKID_IOSYSCALL_PWRITE64_RETURN, HOOKID_IOSYSCALL_READAHEAD_ENTRY, HOOKID_IOSYSCALL_READAHEAD_RETURN, HOOKID_IOSYSCALL_SENDFILE_ENTRY, HOOKID_IOSYSCALL_SENDFILE_RETURN, HOOKID_IOSYSCALL_SENDFILE64_ENTRY, HOOKID_IOSYSCALL_SENDFILE64_RETURN, HOOKID_IOSYSCALL_LSEEK_ENTRY, HOOKID_IOSYSCALL_LSEEK_RETURN, HOOKID_IOSYSCALL_LLSEEK_ENTRY, HOOKID_IOSYSCALL_LLSEEK_RETURN, HOOKID_IOSYSCALL_SYNC_ENTRY, HOOKID_IOSYSCALL_SYNC_RETURN, HOOKID_IOSYSCALL_FSYNC_ENTRY, HOOKID_IOSYSCALL_FSYNC_RETURN, HOOKID_IOSYSCALL_FDATASYNC_ENTRY, HOOKID_IOSYSCALL_FDATASYNC_RETURN, HOOKID_IOSYSCALL_FLOCK_ENTRY, HOOKID_IOSYSCALL_FLOCK_RETURN, /* AIO related calls */ GROUP_AIO, HOOKID_AIO_IO_SETUP_ENTRY, HOOKID_AIO_IO_SETUP_RETURN, HOOKID_AIO_IO_SUBMIT_ENTRY, HOOKID_AIO_IO_SUBMIT_RETURN, HOOKID_AIO_IO_SUBMIT_ONE_ENTRY, HOOKID_AIO_IO_SUBMIT_ONE_RETURN, HOOKID_AIO_IO_GETEVENTS_ENTRY, HOOKID_AIO_IO_GETEVENTS_RETURN, HOOKID_AIO_IO_DESTROY_ENTRY, HOOKID_AIO_IO_DESTROY_RETURN, HOOKID_AIO_IO_CANCEL_ENTRY, HOOKID_AIO_IO_CANCEL_RETURN, /* signal */ GROUP_SIGNAL, HOOKID_SIGNAL_SEND_ENTRY, HOOKID_SIGNAL_SEND_RETURN, HOOKID_SIGNAL_SYSKILL_ENTRY, HOOKID_SIGNAL_SYSKILL_RETURN, HOOKID_SIGNAL_SYSTGKILL_ENTRY, HOOKID_SIGNAL_SYSTGKILL_RETURN, HOOKID_SIGNAL_SYSTKILL_ENTRY, HOOKID_SIGNAL_SYSTKILL_RETURN, HOOKID_SIGNAL_PENDING_ENTRY, HOOKID_SIGNAL_PENDING_RETURN, HOOKID_SIGNAL_DOACTION_ENTRY, HOOKID_SIGNAL_DOACTION_RETURN, HOOKID_SIGNAL_PROC_MASK_ENTRY, HOOKID_SIGNAL_PROC_MASK_RETURN, HOOKID_SIGNAL_FLUSH_ENTRY, /* CPU Frequency */ GROUP_CPUFREQ, HOOKID_SWITCH_CPUFREQ, /*NFS*/ GROUP_NFS, HOOKID_NFS_FOP_LLSEEK_ENTRY, HOOKID_NFS_FOP_LLSEEK_RETURN, HOOKID_NFS_FOP_READ_ENTRY, HOOKID_NFS_FOP_READ_RETURN, HOOKID_NFS_FOP_WRITE_ENTRY, HOOKID_NFS_FOP_WRITE_RETURN, HOOKID_NFS_FOP_AIOREAD_ENTRY, HOOKID_NFS_FOP_AIOREAD_RETURN, HOOKID_NFS_FOP_AIOWRITE_ENTRY, HOOKID_NFS_FOP_AIOWRITE_RETURN, HOOKID_NFS_FOP_MMAP_ENTRY, HOOKID_NFS_FOP_MMAP_RETURN, HOOKID_NFS_FOP_OPEN_ENTRY, HOOKID_NFS_FOP_OPEN_RETURN, HOOKID_NFS_FOP_FLUSH_ENTRY, HOOKID_NFS_FOP_FLUSH_RETURN, HOOKID_NFS_FOP_RELEASE_ENTRY, HOOKID_NFS_FOP_RELEASE_RETURN, HOOKID_NFS_FOP_FSYNC_ENTRY, HOOKID_NFS_FOP_FSYNC_RETURN, HOOKID_NFS_FOP_LOCK_ENTRY, HOOKID_NFS_FOP_LOCK_RETURN, HOOKID_NFS_FOP_SENDFILE_ENTRY, HOOKID_NFS_FOP_SENDFILE_RETURN, HOOKID_NFS_FOP_CHECKFLAGS_ENTRY, HOOKID_NFS_FOP_CHECKFLAGS_RETURN, HOOKID_NFS_AOP_READPAGE_ENTRY, HOOKID_NFS_AOP_READPAGE_RETURN, HOOKID_NFS_AOP_READPAGES_ENTRY, HOOKID_NFS_AOP_READPAGES_RETURN, HOOKID_NFS_AOP_WRITEPAGES_ENTRY, HOOKID_NFS_AOP_WRITEPAGES_RETURN, HOOKID_NFS_AOP_WRITEPAGE_ENTRY, HOOKID_NFS_AOP_WRITEPAGE_RETURN, HOOKID_NFS_AOP_RELEASEPAGE_ENTRY, HOOKID_NFS_AOP_RELEASEPAGE_RETURN, HOOKID_NFS_AOP_SETPAGEDIRTY_ENTRY, HOOKID_NFS_AOP_SETPAGEDIRTY_RETURN, HOOKID_NFS_AOP_PREPAREWRITE_ENTRY, HOOKID_NFS_AOP_PREPAREWRITE_RETURN, HOOKID_NFS_AOP_COMMITWRITE_ENTRY, HOOKID_NFS_AOP_COMMITWRITE_RETURN, HOOKID_NFS_PROC_LOOKUP_ENTRY, HOOKID_NFS_PROC_LOOKUP_RETURN, HOOKID_NFS_PROC_READ_ENTRY, HOOKID_NFS_PROC_READ_RETURN, HOOKID_NFS_PROC_WRITE_ENTRY, HOOKID_NFS_PROC_WRITE_RETURN, HOOKID_NFS_PROC_COMMIT_ENTRY, HOOKID_NFS_PROC_COMMIT_RETURN, HOOKID_NFS_PROC_READSETUP_ENTRY, HOOKID_NFS_PROC_WRITESETUP_ENTRY, HOOKID_NFS_PROC_COMMITSETUP_ENTRY, HOOKID_NFS_PROC_READDONE_ENTRY, HOOKID_NFS_PROC_READDONE_RETURN, HOOKID_NFS_PROC_WRITEDONE_ENTRY, HOOKID_NFS_PROC_WRITEDONE_RETURN, HOOKID_NFS_PROC_COMMITDONE_ENTRY, HOOKID_NFS_PROC_COMMITDONE_RETURN, HOOKID_NFS_PROC_OPEN_ENTRY, HOOKID_NFS_PROC_OPEN_RETURN, HOOKID_NFS_PROC_RELEASE_ENTRY, HOOKID_NFS_PROC_RELEASE_RETURN, HOOKID_NFS_PROC_CREATE_ENTRY, HOOKID_NFS_PROC_CREATE_RETURN, HOOKID_NFS_PROC_RENAME_ENTRY, HOOKID_NFS_PROC_RENAME_RETURN, HOOKID_NFS_PROC_REMOVE_ENTRY, HOOKID_NFS_PROC_REMOVE_RETURN, /*NFSD*/ GROUP_NFSD, HOOKID_NFSD_DISPATCH_ENTRY, HOOKID_NFSD_DISPATCH_RETURN, HOOKID_NFSD_OPEN_ENTRY, HOOKID_NFSD_OPEN_RETURN, HOOKID_NFSD_READ_ENTRY, HOOKID_NFSD_READ_RETURN, HOOKID_NFSD_WRITE_ENTRY, HOOKID_NFSD_WRITE_RETURN, HOOKID_NFSD_LOOKUP_ENTRY, HOOKID_NFSD_LOOKUP_RETURN, HOOKID_NFSD_COMMIT_ENTRY, HOOKID_NFSD_COMMIT_RETURN, HOOKID_NFSD_CREATE_ENTRY, HOOKID_NFSD_CREATE_RETURN, HOOKID_NFSD_CREATEV3_ENTRY, HOOKID_NFSD_CREATEV3_RETURN, HOOKID_NFSD_UNLINK_ENTRY, HOOKID_NFSD_UNLINK_RETURN, HOOKID_NFSD_RENAME_ENTRY, HOOKID_NFSD_RENAME_RETURN, HOOKID_NFSD_CLOSE_ENTRY, HOOKID_NFSD_CLOSE_RETURN, HOOKID_NFSD_PROC_LOOKUP_ENTRY, HOOKID_NFSD_PROC_LOOKUP_RETURN, HOOKID_NFSD_PROC_READ_ENTRY, HOOKID_NFSD_PROC_READ_RETURN, HOOKID_NFSD_PROC_WRITE_ENTRY, HOOKID_NFSD_PROC_WRITE_RETURN, HOOKID_NFSD_PROC_COMMIT_ENTRY, HOOKID_NFSD_PROC_COMMIT_RETURN, HOOKID_NFSD_PROC_COMPOUND_ENTRY, HOOKID_NFSD_PROC_COMPOUND_RETURN, HOOKID_NFSD_PROC_REMOVE_ENTRY, HOOKID_NFSD_PROC_REMOVE_RETURN, HOOKID_NFSD_PROC_RENAME_ENTRY, HOOKID_NFSD_PROC_RENAME_RETURN, HOOKID_NFSD_PROC_CREATE_ENTRY, HOOKID_NFSD_PROC_CREATE_RETURN %{ /* used in embedded c codes */ /* Group ID Definitions */ int _GROUP_REGEVT = 1; int _GROUP_SYSCALL = 2; int _GROUP_PROCESS = 3; int _GROUP_IOSCHED = 4; int _GROUP_TASK = 5; int _GROUP_SCSI = 6; int _GROUP_PAGEFAULT = 7; int _GROUP_NETDEV = 8; int _GROUP_IOSYSCALL = 9; int _GROUP_AIO = 10; int _GROUP_SIGNAL = 11; int _GROUP_CPUFREQ = 15; int _GROUP_NFS = 16; int _GROUP_NFSD = 17; /* hookIDs defined inside each group */ int _HOOKID_REGSYSEVT = 1; int _HOOKID_REGUSREVT = 2; int _HOOKID_SYSCALL_ENTRY = 1; int _HOOKID_SYSCALL_RETURN = 2; int _HOOKID_PROCESS_SNAPSHOT = 1; int _HOOKID_PROCESS_EXECVE = 2; int _HOOKID_PROCESS_FORK = 3; int _HOOKID_IOSCHED_ADD_REQ = 1; int _HOOKID_IOSCHED_NEXT_REQ = 2; int _HOOKID_IOSCHED_COMPLETE_REQ = 3; int _HOOKID_TASK_CTXSWITCH = 1; int _HOOKID_TASK_CPUIDLE = 2; int _HOOKID_SCSI_IOENTRY = 1; int _HOOKID_SCSI_IO_TO_LLD = 2; int _HOOKID_SCSI_IODONE_BY_LLD = 3; int _HOOKID_SCSI_IOCOMP_BY_MIDLEVEL = 4; int _HOOKID_PAGEFAULT = 1; int _HOOKID_NETDEV_RECEIVE = 1; int _HOOKID_NETDEV_TRANSMIT = 2; int _HOOKID_IOSYSCALL_OPEN_ENTRY = 1; int _HOOKID_IOSYSCALL_OPEN_RETURN = 2; int _HOOKID_IOSYSCALL_CLOSE_ENTRY = 3; int _HOOKID_IOSYSCALL_CLOSE_RETURN = 4; int _HOOKID_IOSYSCALL_READ_ENTRY = 5; int _HOOKID_IOSYSCALL_READ_RETURN = 6; int _HOOKID_IOSYSCALL_WRITE_ENTRY = 7; int _HOOKID_IOSYSCALL_WRITE_RETURN = 8; int _HOOKID_IOSYSCALL_READV_ENTRY = 9; int _HOOKID_IOSYSCALL_READV_RETURN = 10; int _HOOKID_IOSYSCALL_WRITEV_ENTRY = 11; int _HOOKID_IOSYSCALL_WRITEV_RETURN = 12; int _HOOKID_IOSYSCALL_PREAD64_ENTRY = 13; int _HOOKID_IOSYSCALL_PREAD64_RETURN = 14; int _HOOKID_IOSYSCALL_PWRITE64_ENTRY = 15; int _HOOKID_IOSYSCALL_PWRITE64_RETURN = 16; int _HOOKID_IOSYSCALL_READAHEAD_ENTRY = 17; int _HOOKID_IOSYSCALL_READAHEAD_RETURN = 18; int _HOOKID_IOSYSCALL_SENDFILE_ENTRY = 19; int _HOOKID_IOSYSCALL_SENDFILE_RETURN = 20; int _HOOKID_IOSYSCALL_LSEEK_ENTRY = 21; int _HOOKID_IOSYSCALL_LSEEK_RETURN = 22; int _HOOKID_IOSYSCALL_LLSEEK_ENTRY = 23; int _HOOKID_IOSYSCALL_LLSEEK_RETURN = 24; int _HOOKID_IOSYSCALL_SYNC_ENTRY = 25; int _HOOKID_IOSYSCALL_SYNC_RETURN = 26; int _HOOKID_IOSYSCALL_FSYNC_ENTRY = 27; int _HOOKID_IOSYSCALL_FSYNC_RETURN = 28; int _HOOKID_IOSYSCALL_FDATASYNC_ENTRY = 29; int _HOOKID_IOSYSCALL_FDATASYNC_RETURN = 30; int _HOOKID_IOSYSCALL_FLOCK_ENTRY = 31; int _HOOKID_IOSYSCALL_FLOCK_RETURN = 32; int _HOOKID_AIO_IO_SETUP_ENTRY = 1; int _HOOKID_AIO_IO_SETUP_RETURN = 2; int _HOOKID_AIO_IO_SUBMIT_ENTRY = 3; int _HOOKID_AIO_IO_SUBMIT_RETURN = 4; int _HOOKID_AIO_IO_SUBMIT_ONE_ENTRY = 5; int _HOOKID_AIO_IO_SUBMIT_ONE_RETURN = 6; int _HOOKID_AIO_IO_GETEVENTS_ENTRY = 7; int _HOOKID_AIO_IO_GETEVENTS_RETURN = 8; int _HOOKID_AIO_IO_DESTROY_ENTRY = 9; int _HOOKID_AIO_IO_DESTROY_RETURN = 10; int _HOOKID_AIO_IO_CANCEL_ENTRY = 11; int _HOOKID_AIO_IO_CANCEL_RETURN = 12; int _HOOKID_SIGNAL_SEND_ENTRY = 1; int _HOOKID_SIGNAL_SEND_RETURN = 2; int _HOOKID_SIGNAL_SYSKILL_ENTRY = 3; int _HOOKID_SIGNAL_SYSKILL_RETURN = 4; int _HOOKID_SIGNAL_SYSTGKILL_ENTRY= 5; int _HOOKID_SIGNAL_SYSTGKILL_RETURN = 6; int _HOOKID_SIGNAL_SYSTKILL_ENTRY = 7; int _HOOKID_SIGNAL_SYSTKILL_RETURN = 8; int _HOOKID_SIGNAL_PENDING_ENTRY = 9; int _HOOKID_SIGNAL_PENDING_RETURN = 10; int _HOOKID_SIGNAL_DOACTION_ENTRY = 11; int _HOOKID_SIGNAL_DOACTION_RETURN = 12; int _HOOKID_SIGNAL_PROC_MASK_ENTRY = 13; int _HOOKID_SIGNAL_PROC_MASK_RETURN = 14; int _HOOKID_SIGNAL_FLUSH_ENTRY = 15; int _HOOKID_SWITCH_CPUFREQ = 1; int _HOOKID_NFS_FOP_LLSEEK_ENTRY= 1; int _HOOKID_NFS_FOP_LLSEEK_RETURN= 2; int _HOOKID_NFS_FOP_READ_ENTRY= 3; int _HOOKID_NFS_FOP_READ_RETURN= 4; int _HOOKID_NFS_FOP_WRITE_ENTRY= 5; int _HOOKID_NFS_FOP_WRITE_RETURN= 6; int _HOOKID_NFS_FOP_AIOREAD_ENTRY= 7; int _HOOKID_NFS_FOP_AIOREAD_RETURN= 8; int _HOOKID_NFS_FOP_AIOWRITE_ENTRY= 9; int _HOOKID_NFS_FOP_AIOWRITE_RETURN= 10; int _HOOKID_NFS_FOP_MMAP_ENTRY= 11; int _HOOKID_NFS_FOP_MMAP_RETURN= 12; int _HOOKID_NFS_FOP_OPEN_ENTRY= 13; int _HOOKID_NFS_FOP_OPEN_RETURN= 14; int _HOOKID_NFS_FOP_FLUSH_ENTRY= 15; int _HOOKID_NFS_FOP_FLUSH_RETURN= 16; int _HOOKID_NFS_FOP_RELEASE_ENTRY= 17; int _HOOKID_NFS_FOP_RELEASE_RETURN= 18; int _HOOKID_NFS_FOP_FSYNC_ENTRY= 19; int _HOOKID_NFS_FOP_FSYNC_RETURN= 20; int _HOOKID_NFS_FOP_LOCK_ENTRY= 21; int _HOOKID_NFS_FOP_LOCK_RETURN= 22; int _HOOKID_NFS_FOP_SENDFILE_ENTRY= 23; int _HOOKID_NFS_FOP_SENDFILE_RETURN= 24; int _HOOKID_NFS_FOP_CHECKFLAGS_ENTRY= 25; int _HOOKID_NFS_FOP_CHECKFLAGS_RETURN= 26; int _HOOKID_NFS_AOP_READPAGE_ENTRY= 27; int _HOOKID_NFS_AOP_READPAGE_RETURN= 28; int _HOOKID_NFS_AOP_READPAGES_ENTRY= 29; int _HOOKID_NFS_AOP_READPAGES_RETURN= 30; int _HOOKID_NFS_AOP_WRITEPAGE_ENTRY= 31; int _HOOKID_NFS_AOP_WRITEPAGE_RETURN= 32; int _HOOKID_NFS_AOP_WRITEPAGES_ENTRY= 33; int _HOOKID_NFS_AOP_WRITEPAGES_RETURN= 34; int _HOOKID_NFS_AOP_RELEASEPAGE_ENTRY= 35; int _HOOKID_NFS_AOP_RELEASEPAGE_RETURN= 36; int _HOOKID_NFS_AOP_SETPAGEDIRTY_ENTRY= 37; int _HOOKID_NFS_AOP_SETPAGEDIRTY_RETURN= 38; int _HOOKID_NFS_AOP_PREPAREWRITE_ENTRY= 39; int _HOOKID_NFS_AOP_PREPAREWRITE_RETURN= 40; int _HOOKID_NFS_AOP_COMMITWRITE_ENTRY= 41; int _HOOKID_NFS_AOP_COMMITWRITE_RETURN= 42; int _HOOKID_NFS_PROC_LOOKUP_ENTRY = 43; int _HOOKID_NFS_PROC_LOOKUP_RETURN= 44; int _HOOKID_NFS_PROC_READ_ENTRY= 45; int _HOOKID_NFS_PROC_READ_RETURN= 46; int _HOOKID_NFS_PROC_WRITE_ENTRY= 47; int _HOOKID_NFS_PROC_WRITE_RETURN= 48; int _HOOKID_NFS_PROC_COMMIT_ENTRY= 49; int _HOOKID_NFS_PROC_COMMIT_RETURN= 50; int _HOOKID_NFS_PROC_READSETUP_ENTRY= 51; int _HOOKID_NFS_PROC_WRITESETUP_ENTRY= 52; int _HOOKID_NFS_PROC_COMMITSETUP_ENTRY= 53; int _HOOKID_NFS_PROC_READDONE_ENTRY= 54; int _HOOKID_NFS_PROC_READDONE_RETURN= 55; int _HOOKID_NFS_PROC_WRITEDONE_ENTRY= 56; int _HOOKID_NFS_PROC_WRITEDONE_RETURN= 57; int _HOOKID_NFS_PROC_COMMITDONE_ENTRY= 58; int _HOOKID_NFS_PROC_COMMITDONE_RETURN= 59; int _HOOKID_NFS_PROC_OPEN_ENTRY= 60; int _HOOKID_NFS_PROC_OPEN_RETURN= 61; int _HOOKID_NFS_PROC_RELEASE_ENTRY= 62; int _HOOKID_NFS_PROC_RELEASE_RETURN= 63; int _HOOKID_NFS_PROC_CREATE_ENTRY= 64; int _HOOKID_NFS_PROC_CREATE_RETURN= 65; int _HOOKID_NFS_PROC_RENAME_ENTRY= 66; int _HOOKID_NFS_PROC_RENAME_RETURN= 67; int _HOOKID_NFS_PROC_REMOVE_ENTRY= 68; int _HOOKID_NFS_PROC_REMOVE_RETURN= 69; int _HOOKID_NFSD_DISPATCH_ENTRY= 1; int _HOOKID_NFSD_DISPATCH_RETURN= 2; int _HOOKID_NFSD_OPEN_ENTRY= 3; int _HOOKID_NFSD_OPEN_RETURN= 4; int _HOOKID_NFSD_READ_ENTRY= 5; int _HOOKID_NFSD_READ_RETURN= 6; int _HOOKID_NFSD_WRITE_ENTRY= 7; int _HOOKID_NFSD_WRITE_RETURN= 8; int _HOOKID_NFSD_LOOKUP_ENTRY= 9; int _HOOKID_NFSD_LOOKUP_RETURN= 10; int _HOOKID_NFSD_COMMIT_ENTRY= 11; int _HOOKID_NFSD_COMMIT_RETURN= 12; int _HOOKID_NFSD_CREATE_ENTRY= 13; int _HOOKID_NFSD_CREATE_RETURN= 14; int _HOOKID_NFSD_CREATEV3_ENTRY= 15; int _HOOKID_NFSD_CREATEV3_RETURN= 16; int _HOOKID_NFSD_UNLINK_ENTRY= 17; int _HOOKID_NFSD_UNLINK_RETURN= 18; int _HOOKID_NFSD_RENAME_ENTRY= 19; int _HOOKID_NFSD_RENAME_RETURN= 20; int _HOOKID_NFSD_CLOSE_ENTRY= 21; int _HOOKID_NFSD_CLOSE_RETURN = 22; int _HOOKID_NFSD_PROC_LOOKUP_ENTRY = 23; int _HOOKID_NFSD_PROC_LOOKUP_RETURN= 24; int _HOOKID_NFSD_PROC_READ_ENTRY= 25; int _HOOKID_NFSD_PROC_READ_RETURN= 26; int _HOOKID_NFSD_PROC_WRITE_ENTRY= 27; int _HOOKID_NFSD_PROC_WRITE_RETURN= 28; int _HOOKID_NFSD_PROC_COMMIT_ENTRY= 29; int _HOOKID_NFSD_PROC_COMMIT_RETURN= 30; int _HOOKID_NFSD_PROC_COMPOUND_ENTRY= 31; int _HOOKID_NFSD_PROC_COMPOUND_RETURN= 32; int _HOOKID_NFSD_PROC_REMOVE_ENTRY= 33; int _HOOKID_NFSD_PROC_REMOVE_RETURN= 34; int _HOOKID_NFSD_PROC_RENAME_ENTRY= 35; int _HOOKID_NFSD_PROC_RENAME_RETURN= 36; int _HOOKID_NFSD_PROC_CREATE_ENTRY= 37; int _HOOKID_NFSD_PROC_CREATE_RETURN= 38; %} function hookid_init() { GROUP_REGEVT = 1 HOOKID_REGSYSEVT = 1 HOOKID_REGUSREVT = 2 GROUP_SYSCALL = 2 HOOKID_SYSCALL_ENTRY = 1 HOOKID_SYSCALL_RETURN = 2 GROUP_PROCESS = 3 HOOKID_PROCESS_SNAPSHOT = 1 HOOKID_PROCESS_EXECVE = 2 HOOKID_PROCESS_FORK = 3 GROUP_IOSCHED = 4 HOOKID_IOSCHED_ADD_REQ = 1 HOOKID_IOSCHED_NEXT_REQ = 2 HOOKID_IOSCHED_COMPLETE_REQ = 3 GROUP_TASK = 5 HOOKID_TASK_CTXSWITCH = 1 HOOKID_TASK_CPUIDLE = 2 GROUP_SCSI = 6 HOOKID_SCSI_IOENTRY = 1 HOOKID_SCSI_IO_TO_LLD = 2 HOOKID_SCSI_IODONE_BY_LLD = 3 HOOKID_SCSI_IOCOMP_BY_MIDLEVEL = 4 GROUP_PAGEFAULT = 7 HOOKID_PAGEFAULT = 1 GROUP_NETDEV = 8 HOOKID_NETDEV_RECEIVE = 1 HOOKID_NETDEV_TRANSMIT = 2 GROUP_IOSYSCALL = 9 HOOKID_IOSYSCALL_OPEN_ENTRY = 1 HOOKID_IOSYSCALL_OPEN_RETURN = 2 HOOKID_IOSYSCALL_CLOSE_ENTRY = 3 HOOKID_IOSYSCALL_CLOSE_RETURN = 4 HOOKID_IOSYSCALL_READ_ENTRY = 5 HOOKID_IOSYSCALL_READ_RETURN = 6 HOOKID_IOSYSCALL_WRITE_ENTRY = 7 HOOKID_IOSYSCALL_WRITE_RETURN = 8 HOOKID_IOSYSCALL_READV_ENTRY = 9 HOOKID_IOSYSCALL_READV_RETURN = 10 HOOKID_IOSYSCALL_WRITEV_ENTRY = 11 HOOKID_IOSYSCALL_WRITEV_RETURN = 12 HOOKID_IOSYSCALL_PREAD64_ENTRY = 13 HOOKID_IOSYSCALL_PREAD64_RETURN = 14 HOOKID_IOSYSCALL_PWRITE64_ENTRY = 15 HOOKID_IOSYSCALL_PWRITE64_RETURN = 16 HOOKID_IOSYSCALL_READAHEAD_ENTRY = 17 HOOKID_IOSYSCALL_READAHEAD_RETURN = 18 HOOKID_IOSYSCALL_SENDFILE_ENTRY = 19 HOOKID_IOSYSCALL_SENDFILE_RETURN = 20 HOOKID_IOSYSCALL_LSEEK_ENTRY = 21 HOOKID_IOSYSCALL_LSEEK_RETURN = 22 HOOKID_IOSYSCALL_LLSEEK_ENTRY = 23 HOOKID_IOSYSCALL_LLSEEK_RETURN = 24 HOOKID_IOSYSCALL_SYNC_ENTRY = 25 HOOKID_IOSYSCALL_SYNC_RETURN = 26 HOOKID_IOSYSCALL_FSYNC_ENTRY = 27 HOOKID_IOSYSCALL_FSYNC_RETURN = 28 HOOKID_IOSYSCALL_FDATASYNC_ENTRY = 29 HOOKID_IOSYSCALL_FDATASYNC_RETURN = 30 HOOKID_IOSYSCALL_FLOCK_ENTRY = 31 HOOKID_IOSYSCALL_FLOCK_RETURN = 32 GROUP_AIO = 10 HOOKID_AIO_IO_SETUP_ENTRY = 1 HOOKID_AIO_IO_SETUP_RETURN = 2 HOOKID_AIO_IO_SUBMIT_ENTRY = 3 HOOKID_AIO_IO_SUBMIT_RETURN = 4 HOOKID_AIO_IO_SUBMIT_ONE_ENTRY = 5 HOOKID_AIO_IO_SUBMIT_ONE_RETURN = 6 HOOKID_AIO_IO_GETEVENTS_ENTRY = 7 HOOKID_AIO_IO_GETEVENTS_RETURN = 8 HOOKID_AIO_IO_DESTROY_ENTRY = 9 HOOKID_AIO_IO_DESTROY_RETURN = 10 HOOKID_AIO_IO_CANCEL_ENTRY = 11 HOOKID_AIO_IO_CANCEL_RETURN = 12 GROUP_SIGNAL = 11 HOOKID_SIGNAL_SEND_ENTRY = 1 HOOKID_SIGNAL_SEND_RETURN = 2 HOOKID_SIGNAL_SYSKILL_ENTRY = 3 HOOKID_SIGNAL_SYSKILL_RETURN = 4 HOOKID_SIGNAL_SYSTGKILL_ENTRY = 5 HOOKID_SIGNAL_SYSTGKILL_RETURN = 6 HOOKID_SIGNAL_SYSTKILL_ENTRY = 7 HOOKID_SIGNAL_SYSTKILL_RETURN = 8 HOOKID_SIGNAL_PENDING_ENTRY = 9 HOOKID_SIGNAL_PENDING_RETURN = 10 HOOKID_SIGNAL_DOACTION_ENTRY = 11 HOOKID_SIGNAL_DOACTION_RETURN = 12 HOOKID_SIGNAL_PROC_MASK_ENTRY = 13 HOOKID_SIGNAL_PROC_MASK_RETURN = 14 HOOKID_SIGNAL_FLUSH_ENTRY = 15 GROUP_CPUFREQ = 15 HOOKID_SWITCH_CPUFREQ = 2 GROUP_NFS = 16 HOOKID_NFS_FOP_LLSEEK_ENTRY= 1 HOOKID_NFS_FOP_LLSEEK_RETURN= 2 HOOKID_NFS_FOP_READ_ENTRY= 3 HOOKID_NFS_FOP_READ_RETURN= 4 HOOKID_NFS_FOP_WRITE_ENTRY= 5 HOOKID_NFS_FOP_WRITE_RETURN= 6 HOOKID_NFS_FOP_AIOREAD_ENTRY= 7 HOOKID_NFS_FOP_AIOREAD_RETURN= 8 HOOKID_NFS_FOP_AIOWRITE_ENTRY= 9 HOOKID_NFS_FOP_AIOWRITE_RETURN= 10 HOOKID_NFS_FOP_MMAP_ENTRY= 11 HOOKID_NFS_FOP_MMAP_RETURN= 12 HOOKID_NFS_FOP_OPEN_ENTRY= 13 HOOKID_NFS_FOP_OPEN_RETURN= 14 HOOKID_NFS_FOP_FLUSH_ENTRY= 15 HOOKID_NFS_FOP_FLUSH_RETURN= 16 HOOKID_NFS_FOP_RELEASE_ENTRY= 17 HOOKID_NFS_FOP_RELEASE_RETURN= 18 HOOKID_NFS_FOP_FSYNC_ENTRY= 19 HOOKID_NFS_FOP_FSYNC_RETURN= 20 HOOKID_NFS_FOP_LOCK_ENTRY= 21 HOOKID_NFS_FOP_LOCK_RETURN= 22 HOOKID_NFS_FOP_SENDFILE_ENTRY= 23 HOOKID_NFS_FOP_SENDFILE_RETURN= 24 HOOKID_NFS_FOP_CHECKFLAGS_ENTRY= 25 HOOKID_NFS_FOP_CHECKFLAGS_RETURN= 26 HOOKID_NFS_AOP_READPAGE_ENTRY= 27 HOOKID_NFS_AOP_READPAGE_RETURN= 28 HOOKID_NFS_AOP_READPAGES_ENTRY= 29 HOOKID_NFS_AOP_READPAGES_RETURN= 30 HOOKID_NFS_AOP_WRITEPAGE_ENTRY= 31 HOOKID_NFS_AOP_WRITEPAGE_RETURN= 32 HOOKID_NFS_AOP_WRITEPAGES_ENTRY= 33 HOOKID_NFS_AOP_WRITEPAGES_RETURN= 34 HOOKID_NFS_AOP_RELEASEPAGE_ENTRY= 35 HOOKID_NFS_AOP_RELEASEPAGE_RETURN= 36 HOOKID_NFS_AOP_SETPAGEDIRTY_ENTRY= 37 HOOKID_NFS_AOP_SETPAGEDIRTY_RETURN= 38 HOOKID_NFS_AOP_PREPAREWRITE_ENTRY= 39 HOOKID_NFS_AOP_PREPAREWRITE_RETURN= 40 HOOKID_NFS_AOP_COMMITWRITE_ENTRY= 41 HOOKID_NFS_AOP_COMMITWRITE_RETURN= 42 HOOKID_NFS_PROC_LOOKUP_ENTRY = 43 HOOKID_NFS_PROC_LOOKUP_RETURN= 44 HOOKID_NFS_PROC_READ_ENTRY= 45 HOOKID_NFS_PROC_READ_RETURN= 46 HOOKID_NFS_PROC_WRITE_ENTRY= 47 HOOKID_NFS_PROC_WRITE_RETURN= 48 HOOKID_NFS_PROC_COMMIT_ENTRY= 49 HOOKID_NFS_PROC_COMMIT_RETURN= 50 HOOKID_NFS_PROC_READSETUP_ENTRY= 51 HOOKID_NFS_PROC_WRITESETUP_ENTRY= 52 HOOKID_NFS_PROC_COMMITSETUP_ENTRY= 53 HOOKID_NFS_PROC_READDONE_ENTRY= 54 HOOKID_NFS_PROC_READDONE_RETURN= 55 HOOKID_NFS_PROC_WRITEDONE_ENTRY= 56 HOOKID_NFS_PROC_WRITEDONE_RETURN= 57 HOOKID_NFS_PROC_COMMITDONE_ENTRY= 58 HOOKID_NFS_PROC_COMMITDONE_RETURN= 59 HOOKID_NFS_PROC_OPEN_ENTRY= 60 HOOKID_NFS_PROC_OPEN_RETURN= 61 HOOKID_NFS_PROC_RELEASE_ENTRY= 62 HOOKID_NFS_PROC_RELEASE_RETURN= 63 HOOKID_NFS_PROC_CREATE_ENTRY= 64 HOOKID_NFS_PROC_CREATE_RETURN= 65 HOOKID_NFS_PROC_RENAME_ENTRY= 66 HOOKID_NFS_PROC_RENAME_RETURN= 67 HOOKID_NFS_PROC_REMOVE_ENTRY= 68 HOOKID_NFS_PROC_REMOVE_RETURN= 69 GROUP_NFSD = 17 HOOKID_NFSD_DISPATCH_ENTRY= 1 HOOKID_NFSD_DISPATCH_RETURN= 2 HOOKID_NFSD_OPEN_ENTRY= 3 HOOKID_NFSD_OPEN_RETURN= 4 HOOKID_NFSD_READ_ENTRY= 5 HOOKID_NFSD_READ_RETURN= 6 HOOKID_NFSD_WRITE_ENTRY= 7 HOOKID_NFSD_WRITE_RETURN= 8 HOOKID_NFSD_LOOKUP_ENTRY= 9 HOOKID_NFSD_LOOKUP_RETURN= 10 HOOKID_NFSD_COMMIT_ENTRY= 11 HOOKID_NFSD_COMMIT_RETURN= 12 HOOKID_NFSD_CREATE_ENTRY= 13 HOOKID_NFSD_CREATE_RETURN= 14 HOOKID_NFSD_CREATEV3_ENTRY= 15 HOOKID_NFSD_CREATEV3_RETURN= 16 HOOKID_NFSD_UNLINK_ENTRY= 17 HOOKID_NFSD_UNLINK_RETURN= 18 HOOKID_NFSD_RENAME_ENTRY= 19 HOOKID_NFSD_RENAME_RETURN= 20 HOOKID_NFSD_CLOSE_ENTRY= 21 HOOKID_NFSD_CLOSE_RETURN = 22 HOOKID_NFSD_PROC_LOOKUP_ENTRY = 23 HOOKID_NFSD_PROC_LOOKUP_RETURN= 24 HOOKID_NFSD_PROC_READ_ENTRY= 25 HOOKID_NFSD_PROC_READ_RETURN= 26 HOOKID_NFSD_PROC_WRITE_ENTRY= 27 HOOKID_NFSD_PROC_WRITE_RETURN= 28 HOOKID_NFSD_PROC_COMMIT_ENTRY= 29 HOOKID_NFSD_PROC_COMMIT_RETURN= 30 HOOKID_NFSD_PROC_COMPOUND_ENTRY= 31 HOOKID_NFSD_PROC_COMPOUND_RETURN= 32 HOOKID_NFSD_PROC_REMOVE_ENTRY= 33 HOOKID_NFSD_PROC_REMOVE_RETURN= 34 HOOKID_NFSD_PROC_RENAME_ENTRY= 35 HOOKID_NFSD_PROC_RENAME_RETURN= 36 HOOKID_NFSD_PROC_CREATE_ENTRY= 37 HOOKID_NFSD_PROC_CREATE_RETURN= 38 } probe begin { hookid_init() lket_trace_init() lket_init_time() register_sys_events() write_events_desc() process_snapshot() } probe end { lket_kill_time() }