Preface Note some common problems related to raw tracepoint when writing ebpf/libbpf programs (such as BPF_PROG_TYPE_RAW_TRACEPOINT program). Types of eBPF Programs This article focuses on the eBPF program type called BPF_PROG_TYPE_RAW_TRACEPOINT. What events can be monitored by raw tracepoint The events that raw tracepoint can monitor can be found by looking at the contents of the /sys/kernel/debug/tracing/available_events file. The format of each line in the file is: : For example: sched:sched_switch However, raw tracepoint uses the value of rather than the entire :, as described below. Format of SEC content The SEC format for the raw tracepoint event is: SEC("raw_tracepoint/") // for example: // SEC("raw_tracepoint/sched_switch") or: SEC("raw_tp/") // for example: // SEC("raw_tp/sched_switch") The values are those listed in the available_events file earlier. SEC("raw_tp/xx") and SEC("raw_tracepoint/xx") are actually equivalent, depending on personal preference, which one can be used at will. There are two special cases, which are : Uniformly use sys_enter to represent sys_enter_xxx events under the syscalls category: SEC("raw_tracepoint/sys_enter") Uniformly use sys_exit to represent sys_exit_xxx events under the syscalls category: SEC("raw_tracepoint/sys_exit") That is, you can use the sys_enter and sys_exit events to monitor all system call events. How to determine the parameter type of the raw tracepoint event handler and get the corresponding kernel call parameters Suppose that we want to monitor the fchmodat system call involved in the chmod command via raw tracepoint. Then, how do we determine the type of parameters of the event handler in ebpf, and how do we get the content of the corresponding fchmodat system call parameters? For example, get the name of the file to be operated on and the value of the permission mode to be operated on. The first step is to find the raw tracepoint events that can be