probe::syscall_any.return
Prev | Chapter 36. Syscall Any Tapset | Next

## Name

probe::syscall_any.return — Record exit from a syscall

## Synopsis

    syscall_any.return

## Values

`name`

  name of the syscall

`retval`

  return value of the syscall

`syscall_nr`

  number of the syscall

## Context

The process performing the syscall

## Description

The syscall_any.return probe point is designed to be a low overhead that monitors all the syscalls returns via a kernel tracepoint. Because of the breadth of syscalls it monitors it provides no information about the syscall arguments, argstr string representation of those arguments, or a string interpretation of the return value (retval).

This requires kernel 3.5+ and newer which have the kernel.trace(“sys_exit”) probe point.

Prev | Up | Next
probe::syscall_any | Home | Chapter 37. CVE Livepatching Tapset