/* Monitor all system calls for a given process ID */ syscall:::entry /pid == $1/ { printf("%s(%d, 0x%x, %4d)", probefunc, arg0, arg1, arg2); } syscall:::return /pid == $1/ { printf("\t\t = %d\n", arg1); }