1. A method for monitoring system calls in an operating system, the operating system comprising one or more system functions, and further comprising one or more access descriptors for calling respective ones of the one or more system functions, the method comprising: loading a collector application driver providing one or more dispatch functions corresponding to respective ones of the one or more system functions; allocating a page of pinned kernel memory; creating a metadata block in the page of pinned kernel memory, wherein the metadata block comprises a copy of the one or more access descriptors corresponding to respective ones of the one or more system functions; copying the one or more dispatch functions provided by the driver into the page of pinned kernel memory, wherein the one or more dispatch functions are operable to access the metadata block; and altering the one or more access descriptors for calling respective ones of the one or more system functions to instead point to respective ones of the one or more dispatch functions copied into the page of pinned kernel memory; wherein the one or more dispatch functions are operable to call respective ones of the one or more system functions using a copy of the one or more access descriptors in the metadata block corresponding to a respective one of the one or more system functions; and wherein said loading a collector application driver, allocating a page of pinned kernel memory, creating a metadata block, copying the one or more dispatch functions, and/or altering the one or more access descriptors comprise operations performed using at least one programmed computer processor circuit.