title: How to trace just system call events with ftrace without showing any other functions in the Linux kernel?
body: <p>For example, to monitor all <code>mkdir</code> calls made, the best I could come up with was:</p>
  
  <pre><code>#!/bin/sh
  set -eux
  
  d=debug/tracing
  
  mkdir -p debug
  if ! mountpoint -q debug; then
    mount -t debugfs nodev debug
  fi
  
  # Stop tracing.
  echo 0 &gt; "${d}/tracing_on"
  
  # Clear previous traces.
  echo &gt; "${d}/trace"
  
  # Enable tracing mkdir
  echo sys_enter_mkdir &gt; "${d}/set_event"
  
  # Set tracer type.
  echo function &gt; "${d}/current_tracer"
  
  # Filter only sys_mkdir as a workaround.
  echo SyS_mkdir &gt; "${d}/set_ftrace_filter"
  
  # Start tracing.
  echo 1 &gt; "${d}/tracing_on"
  
  # Generate two mkdir calls.
  rm -rf /tmp/a
  rm -rf /tmp/b
  mkdir /tmp/a
  mkdir /tmp/b
  
  # View the trace.
  cat "${d}/trace"
  
  # Stop tracing.
  echo 0 &gt; "${d}/tracing_on"
  
  umount debug
  </code></pre>
  
  <p>And then after running with <code>sudo</code> it gives:</p>
  
  <pre><code># tracer: function
  #
  # entries-in-buffer/entries-written: 4/4   #P:16
  #
  #                              _-----=&gt; irqs-off
  #                             / _----=&gt; need-resched
  #                            | / _---=&gt; hardirq/softirq
  #                            || / _--=&gt; preempt-depth
  #                            ||| /     delay
  #           TASK-PID   CPU#  ||||    TIMESTAMP  FUNCTION
  #              | |       |   ||||       |         |
             mkdir-31254 [015] .... 2010985.576760: sys_mkdir(pathname: 7ffc54b32c77, mode: 1ff)
             mkdir-31254 [015] .... 2010985.576763: SyS_mkdir &lt;-tracesys_phase2
             mkdir-31255 [007] .... 2010985.578363: sys_mkdir(pathname: 7fff02d90c77, mode: 1ff)
             mkdir-31255 [007] .... 2010985.578365: SyS_mkdir &lt;-tracesys_phase2
  </code></pre>
  
  <p>My problem with this is that it output two lines for each syscall: </p>
  
  <ul>
  <li><code>sys_mkdir</code> which is the event that I want</li>
  <li><code>SyS_mkdir</code> which is the filtered function workaround, which I don't want to see</li>
  </ul>
  
  <p>If I instead try to do:</p>
  
  <pre><code>echo &gt; "${d}/set_ftrace_filter"
  </code></pre>
  
  <p>or don't touch that file at at all, then it shows a ton of functions and makes it hard to fint the syscall at all.</p>
  
  <p>If there a nicer way to disable regular functions, and keep just syscall events?</p>
  
  <p>I could use just <code>SyS_mkdir</code> and disable the syscall event I guess, but it feels cleaner if I could use the more specific event? Also:</p>
  
  <ul>
  <li>the event shows arguments, which is nicer.</li>
  <li>syscall function names change across kernel versions. E.g., it is already <code>__x64_sys_mkdir</code> instead of <code>SyS_mkdir</code> on Linux v4.18.</li>
  </ul>
  
  <p>Related:</p>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/21889563/how-to-trace-the-write-system-call-in-the-linux-kernel">How to trace the write system call in the Linux kernel?</a></li>
  </ul>
  
  <p>Tested on Ubuntu 18.04, Linux kernel 4.15.</p>