events.go

package ebpftracer

import (
	"github.com/castai/kvisor/pkg/ebpftracer/events"
	"github.com/cilium/ebpf"
)

type argMeta struct {
	Name string `json:"name"`
	Type string `json:"type"`
}

type definition struct {
	ID           events.ID
	id32Bit      events.ID
	name         string
	docPath      string // Relative to the 'doc/events' directory
	internal     bool
	syscall      bool
	dependencies dependencies
	sets         []string
	params       []argMeta
}

type EventProbe struct {
	handle   handle
	required bool // tracee fails if probe can't be attached
}

type dependencies struct {
	ids                  []events.ID
	kSymbols             []KSymbol
	probes               []EventProbe
	skipDefaultTailCalls bool
	tailCalls            []TailCall
	//capabilities         capabilities
}

//type capabilities struct {
//	base []cap.Value // always effective
//	ebpf []cap.Value // effective when using eBPF
//}

const (
	TailVfsWrite  uint32 = iota // Index of a function to be used in a bpf tailcall.
	TailVfsWritev               // Matches defined values in ebpf code for prog_array map.
	TailSendBin
	TailSendBinTP
	TailKernelWrite
	TailSchedProcessExecEventSubmit
	TailVfsRead
	TailVfsReadv
	TailExecBinprm1
	TailExecBinprm2
	TailHiddenKernelModuleProc
	TailHiddenKernelModuleKset
	TailHiddenKernelModuleModTree
	TailHiddenKernelModuleNewModOnly
	MaxTail
)

type TailCall struct {
	ebpfMap  *ebpf.Map
	ebpfProg *ebpf.Program
	indexes  []uint32
}

type KSymbol struct {
	symbol   string
	required bool // tracee fails if symbol is not found
}

// This function is used to auto generate the event parser classes. DO NOT RENAME IT!
// Also, only use simple strings for defining the params, as the generator walks the AST to
// extract information.
func newEventsDefinitionSet(objs *tracerObjects) map[events.ID]definition {
	return map[events.ID]definition{
		//
		// Begin of Syscalls
		//
		events.Read: {
			ID:      events.Read,
			id32Bit: events.Sys32read,
			name:    "read",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_read_write"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "void*", Name: "buf"},
				{Type: "size_t", Name: "count"},
			},
		},
		events.Write: {
			ID:      events.Write,
			id32Bit: events.Sys32write,
			name:    "write",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_read_write"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "void*", Name: "buf"},
				{Type: "size_t", Name: "count"},
			},
		},
		events.Open: {
			ID:      events.Open,
			id32Bit: events.Sys32open,
			name:    "open",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "int", Name: "flags"},
				{Type: "mode_t", Name: "mode"},
			},
		},
		events.Close: {
			ID:      events.Close,
			id32Bit: events.Sys32close,
			name:    "close",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
			},
		},
		events.Stat: {
			ID:      events.Stat,
			id32Bit: events.Sys32stat,
			name:    "stat",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "struct stat*", Name: "statbuf"},
			},
		},
		events.Fstat: {
			ID:      events.Fstat,
			id32Bit: events.Sys32fstat,
			name:    "fstat",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "struct stat*", Name: "statbuf"},
			},
		},
		events.Lstat: {
			ID:      events.Lstat,
			id32Bit: events.Sys32lstat,
			name:    "lstat",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "struct stat*", Name: "statbuf"},
			},
		},
		events.Poll: {
			ID:      events.Poll,
			id32Bit: events.Sys32poll,
			name:    "poll",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_mux_io"},
			params: []argMeta{
				{Type: "struct pollfd*", Name: "fds"},
				{Type: "unsigned int", Name: "nfds"},
				{Type: "int", Name: "timeout"},
			},
		},
		events.Lseek: {
			ID:      events.Lseek,
			id32Bit: events.Sys32lseek,
			name:    "lseek",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_read_write"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "off_t", Name: "offset"},
				{Type: "unsigned int", Name: "whence"},
			},
		},
		events.Mmap: {
			ID:      events.Mmap,
			id32Bit: events.Sys32mmap,
			name:    "mmap",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_mem"},
			params: []argMeta{
				{Type: "void*", Name: "addr"},
				{Type: "size_t", Name: "length"},
				{Type: "int", Name: "prot"},
				{Type: "int", Name: "flags"},
				{Type: "int", Name: "fd"},
				{Type: "off_t", Name: "off"},
			},
		},
		events.Mprotect: {
			ID:      events.Mprotect,
			id32Bit: events.Sys32mprotect,
			name:    "mprotect",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_mem"},
			params: []argMeta{
				{Type: "void*", Name: "addr"},
				{Type: "size_t", Name: "len"},
				{Type: "int", Name: "prot"},
			},
		},
		events.Munmap: {
			ID:      events.Munmap,
			id32Bit: events.Sys32munmap,
			name:    "munmap",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_mem"},
			params: []argMeta{
				{Type: "void*", Name: "addr"},
				{Type: "size_t", Name: "length"},
			},
		},
		events.Brk: {
			ID:      events.Brk,
			id32Bit: events.Sys32brk,
			name:    "brk",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_mem"},
			params: []argMeta{
				{Type: "void*", Name: "addr"},
			},
		},
		events.RtSigaction: {
			ID:      events.RtSigaction,
			id32Bit: events.Sys32rt_sigaction,
			name:    "rt_sigaction",
			syscall: true,
			sets:    []string{"syscalls", "signals"},
			params: []argMeta{
				{Type: "int", Name: "signum"},
				{Type: "const struct sigaction*", Name: "act"},
				{Type: "struct sigaction*", Name: "oldact"},
				{Type: "size_t", Name: "sigsetsize"},
			},
		},
		events.RtSigprocmask: {
			ID:      events.RtSigprocmask,
			id32Bit: events.Sys32rt_sigprocmask,
			name:    "rt_sigprocmask",
			syscall: true,
			sets:    []string{"syscalls", "signals"},
			params: []argMeta{
				{Type: "int", Name: "how"},
				{Type: "sigset_t*", Name: "set"},
				{Type: "sigset_t*", Name: "oldset"},
				{Type: "size_t", Name: "sigsetsize"},
			},
		},
		events.RtSigreturn: {
			ID:      events.RtSigreturn,
			id32Bit: events.Sys32rt_sigreturn,
			name:    "rt_sigreturn",
			syscall: true,
			sets:    []string{"syscalls", "signals"},
			params:  []argMeta{},
		},
		events.Ioctl: {
			ID:      events.Ioctl,
			id32Bit: events.Sys32ioctl,
			name:    "ioctl",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_fd_ops"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "unsigned long", Name: "request"},
				{Type: "unsigned long", Name: "arg"},
			},
		},
		events.Pread64: {
			ID:      events.Pread64,
			id32Bit: events.Sys32pread64,
			name:    "pread64",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_read_write"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "void*", Name: "buf"},
				{Type: "size_t", Name: "count"},
				{Type: "off_t", Name: "offset"},
			},
		},
		events.Pwrite64: {
			ID:      events.Pwrite64,
			id32Bit: events.Sys32pwrite64,
			name:    "pwrite64",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_read_write"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "const void*", Name: "buf"},
				{Type: "size_t", Name: "count"},
				{Type: "off_t", Name: "offset"},
			},
		},
		events.Readv: {
			ID:      events.Readv,
			id32Bit: events.Sys32readv,
			name:    "readv",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_read_write"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "const struct iovec*", Name: "iov"},
				{Type: "int", Name: "iovcnt"},
			},
		},
		events.Writev: {
			ID:      events.Writev,
			id32Bit: events.Sys32writev,
			name:    "writev",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_read_write"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "const struct iovec*", Name: "iov"},
				{Type: "int", Name: "iovcnt"},
			},
		},
		events.Access: {
			ID:      events.Access,
			id32Bit: events.Sys32access,
			name:    "access",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "int", Name: "mode"},
			},
		},
		events.Pipe: {
			ID:      events.Pipe,
			id32Bit: events.Sys32pipe,
			name:    "pipe",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_pipe"},
			params: []argMeta{
				{Type: "int[2]", Name: "pipefd"},
			},
		},
		events.Select: {
			ID:      events.Select,
			id32Bit: events.Sys32_newselect,
			name:    "select",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_mux_io"},
			params: []argMeta{
				{Type: "int", Name: "nfds"},
				{Type: "fd_set*", Name: "readfds"},
				{Type: "fd_set*", Name: "writefds"},
				{Type: "fd_set*", Name: "exceptfds"},
				{Type: "struct timeval*", Name: "timeout"},
			},
		},
		events.SchedYield: {
			ID:      events.SchedYield,
			id32Bit: events.Sys32sched_yield,
			name:    "sched_yield",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_sched"},
			params:  []argMeta{},
		},
		events.Mremap: {
			ID:      events.Mremap,
			id32Bit: events.Sys32mremap,
			name:    "mremap",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_mem"},
			params: []argMeta{
				{Type: "void*", Name: "old_address"},
				{Type: "size_t", Name: "old_size"},
				{Type: "size_t", Name: "new_size"},
				{Type: "int", Name: "flags"},
				{Type: "void*", Name: "new_address"},
			},
		},
		events.Msync: {
			ID:      events.Msync,
			id32Bit: events.Sys32msync,
			name:    "msync",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_sync"},
			params: []argMeta{
				{Type: "void*", Name: "addr"},
				{Type: "size_t", Name: "length"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Mincore: {
			ID:      events.Mincore,
			id32Bit: events.Sys32mincore,
			name:    "mincore",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_mem"},
			params: []argMeta{
				{Type: "void*", Name: "addr"},
				{Type: "size_t", Name: "length"},
				{Type: "unsigned char*", Name: "vec"},
			},
		},
		events.Madvise: {
			ID:      events.Madvise,
			id32Bit: events.Sys32madvise,
			name:    "madvise",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_mem"},
			params: []argMeta{
				{Type: "void*", Name: "addr"},
				{Type: "size_t", Name: "length"},
				{Type: "int", Name: "advice"},
			},
		},
		events.Shmget: {
			ID:      events.Shmget,
			id32Bit: events.Sys32shmget,
			name:    "shmget",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_shm"},
			params: []argMeta{
				{Type: "key_t", Name: "key"},
				{Type: "size_t", Name: "size"},
				{Type: "int", Name: "shmflg"},
			},
		},
		events.Shmat: {
			ID:      events.Shmat,
			id32Bit: events.Sys32shmat,
			name:    "shmat",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_shm"},
			params: []argMeta{
				{Type: "int", Name: "shmid"},
				{Type: "const void*", Name: "shmaddr"},
				{Type: "int", Name: "shmflg"},
			},
		},
		events.Shmctl: {
			ID:      events.Shmctl,
			id32Bit: events.Sys32shmctl,
			name:    "shmctl",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_shm"},
			params: []argMeta{
				{Type: "int", Name: "shmid"},
				{Type: "int", Name: "cmd"},
				{Type: "struct shmid_ds*", Name: "buf"},
			},
		},
		events.Dup: {
			ID:      events.Dup,
			id32Bit: events.Sys32dup,
			name:    "dup",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_fd_ops"},
			params: []argMeta{
				{Type: "int", Name: "oldfd"},
			},
		},
		events.Dup2: {
			ID:      events.Dup2,
			id32Bit: events.Sys32dup2,
			name:    "dup2",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_fd_ops"},
			params: []argMeta{
				{Type: "int", Name: "oldfd"},
				{Type: "int", Name: "newfd"},
			},
		},
		events.Pause: {
			ID:      events.Pause,
			id32Bit: events.Sys32pause,
			name:    "pause",
			syscall: true,
			sets:    []string{"syscalls", "signals"},
			params:  []argMeta{},
		},
		events.Nanosleep: {
			ID:      events.Nanosleep,
			id32Bit: events.Sys32nanosleep,
			name:    "nanosleep",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_timer"},
			params: []argMeta{
				{Type: "const struct timespec*", Name: "req"},
				{Type: "struct timespec*", Name: "rem"},
			},
		},
		events.Getitimer: {
			ID:      events.Getitimer,
			id32Bit: events.Sys32getitimer,
			name:    "getitimer",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_timer"},
			params: []argMeta{
				{Type: "int", Name: "which"},
				{Type: "struct itimerval*", Name: "curr_value"},
			},
		},
		events.Alarm: {
			ID:      events.Alarm,
			id32Bit: events.Sys32alarm,
			name:    "alarm",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_timer"},
			params: []argMeta{
				{Type: "unsigned int", Name: "seconds"},
			},
		},
		events.Setitimer: {
			ID:      events.Setitimer,
			id32Bit: events.Sys32setitimer,
			name:    "setitimer",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_timer"},
			params: []argMeta{
				{Type: "int", Name: "which"},
				{Type: "struct itimerval*", Name: "new_value"},
				{Type: "struct itimerval*", Name: "old_value"},
			},
		},
		events.Getpid: {
			ID:      events.Getpid,
			id32Bit: events.Sys32getpid,
			name:    "getpid",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_ids"},
			params:  []argMeta{},
		},
		events.Sendfile: {
			ID:      events.Sendfile,
			id32Bit: events.Sys32sendfile64,
			name:    "sendfile",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_read_write"},
			params: []argMeta{
				{Type: "int", Name: "out_fd"},
				{Type: "int", Name: "in_fd"},
				{Type: "off_t*", Name: "offset"},
				{Type: "size_t", Name: "count"},
			},
		},
		events.Socket: {
			ID:      events.Socket,
			id32Bit: events.Sys32socket,
			name:    "socket",
			syscall: true,
			sets:    []string{"syscalls", "net", "net_sock"},
			params: []argMeta{
				{Type: "int", Name: "domain"},
				{Type: "int", Name: "type"},
				{Type: "int", Name: "protocol"},
			},
		},
		events.Connect: {
			ID:      events.Connect,
			id32Bit: events.Sys32connect,
			name:    "connect",
			syscall: true,
			sets:    []string{"syscalls", "net", "net_sock"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "struct sockaddr*", Name: "addr"},
				{Type: "int", Name: "addrlen"},
			},
		},
		events.Accept: {
			ID:      events.Accept,
			id32Bit: events.Sys32Undefined,
			name:    "accept",
			syscall: true,
			sets:    []string{"syscalls", "net", "net_sock"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "struct sockaddr*", Name: "addr"},
				{Type: "int*", Name: "addrlen"},
			},
		},
		events.Sendto: {
			ID:      events.Sendto,
			id32Bit: events.Sys32sendto,
			name:    "sendto",
			syscall: true,
			sets:    []string{"syscalls", "net", "net_snd_rcv"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "void*", Name: "buf"},
				{Type: "size_t", Name: "len"},
				{Type: "int", Name: "flags"},
				{Type: "struct sockaddr*", Name: "dest_addr"},
				{Type: "int", Name: "addrlen"},
			},
		},
		events.Recvfrom: {
			ID:      events.Recvfrom,
			id32Bit: events.Sys32recvfrom,
			name:    "recvfrom",
			syscall: true,
			sets:    []string{"syscalls", "net", "net_snd_rcv"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "void*", Name: "buf"},
				{Type: "size_t", Name: "len"},
				{Type: "int", Name: "flags"},
				{Type: "struct sockaddr*", Name: "src_addr"},
				{Type: "int*", Name: "addrlen"},
			},
		},
		events.Sendmsg: {
			ID:      events.Sendmsg,
			id32Bit: events.Sys32sendmsg,
			name:    "sendmsg",
			syscall: true,
			sets:    []string{"syscalls", "net", "net_snd_rcv"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "struct msghdr*", Name: "msg"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Recvmsg: {
			ID:      events.Recvmsg,
			id32Bit: events.Sys32recvmsg,
			name:    "recvmsg",
			syscall: true,
			sets:    []string{"syscalls", "net", "net_snd_rcv"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "struct msghdr*", Name: "msg"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Shutdown: {
			ID:      events.Shutdown,
			id32Bit: events.Sys32shutdown,
			name:    "shutdown",
			syscall: true,
			sets:    []string{"syscalls", "net", "net_sock"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "int", Name: "how"},
			},
		},
		events.Bind: {
			ID:      events.Bind,
			id32Bit: events.Sys32bind,
			name:    "bind",
			syscall: true,
			sets:    []string{"syscalls", "net", "net_sock"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "struct sockaddr*", Name: "addr"},
				{Type: "int", Name: "addrlen"},
			},
		},
		events.Listen: {
			ID:      events.Listen,
			id32Bit: events.Sys32listen,
			name:    "listen",
			syscall: true,
			sets:    []string{"syscalls", "net", "net_sock"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "int", Name: "backlog"},
			},
		},
		events.Getsockname: {
			ID:      events.Getsockname,
			id32Bit: events.Sys32getsockname,
			name:    "getsockname",
			syscall: true,
			sets:    []string{"syscalls", "net", "net_sock"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "struct sockaddr*", Name: "addr"},
				{Type: "int*", Name: "addrlen"},
			},
		},
		events.Getpeername: {
			ID:      events.Getpeername,
			id32Bit: events.Sys32getpeername,
			name:    "getpeername",
			syscall: true,
			sets:    []string{"syscalls", "net", "net_sock"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "struct sockaddr*", Name: "addr"},
				{Type: "int*", Name: "addrlen"},
			},
		},
		events.Socketpair: {
			ID:      events.Socketpair,
			id32Bit: events.Sys32socketpair,
			name:    "socketpair",
			syscall: true,
			sets:    []string{"syscalls", "net", "net_sock"},
			params: []argMeta{
				{Type: "int", Name: "domain"},
				{Type: "int", Name: "type"},
				{Type: "int", Name: "protocol"},
				{Type: "int[2]", Name: "sv"},
			},
		},
		events.Setsockopt: {
			ID:      events.Setsockopt,
			id32Bit: events.Sys32setsockopt,
			name:    "setsockopt",
			syscall: true,
			sets:    []string{"syscalls", "net", "net_sock"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "int", Name: "level"},
				{Type: "int", Name: "optname"},
				{Type: "const void*", Name: "optval"},
				{Type: "int", Name: "optlen"},
			},
		},
		events.Getsockopt: {
			ID:      events.Getsockopt,
			id32Bit: events.Sys32getsockopt,
			name:    "getsockopt",
			syscall: true,
			sets:    []string{"syscalls", "net", "net_sock"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "int", Name: "level"},
				{Type: "int", Name: "optname"},
				{Type: "void*", Name: "optval"},
				{Type: "int*", Name: "optlen"},
			},
		},
		events.Clone: {
			ID:      events.Clone,
			id32Bit: events.Sys32clone,
			name:    "clone",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_life"},
			params: []argMeta{
				{Type: "unsigned long", Name: "flags"},
				{Type: "void*", Name: "stack"},
				{Type: "int*", Name: "parent_tid"},
				{Type: "int*", Name: "child_tid"},
				{Type: "unsigned long", Name: "tls"},
			},
		},
		events.Fork: {
			ID:      events.Fork,
			id32Bit: events.Sys32fork,
			name:    "fork",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_life"},
			params:  []argMeta{},
		},
		events.Vfork: {
			ID:      events.Vfork,
			id32Bit: events.Sys32vfork,
			name:    "vfork",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_life"},
			params:  []argMeta{},
		},
		events.Execve: {
			ID:      events.Execve,
			id32Bit: events.Sys32execve,
			name:    "execve",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_life"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "const char*const*", Name: "argv"},
				{Type: "const char*const*", Name: "envp"},
			},
			dependencies: dependencies{
				tailCalls: []TailCall{
					{objs.SysEnterInitTail, objs.SysEnterInit, []uint32{uint32(events.Execve)}},
					{objs.SysEnterSubmitTail, objs.SysEnterSubmit, []uint32{uint32(events.Execve)}},
					{objs.SysEnterTails, objs.SyscallExecve, []uint32{uint32(events.Execve)}},
					{objs.SysExitInitTail, objs.SysExitInit, []uint32{uint32(events.Execve)}},
					{objs.SysExitSubmitTail, objs.SysExitSubmit, []uint32{uint32(events.Execve)}},
				},
			},
		},
		events.Exit: {
			ID:      events.Exit,
			id32Bit: events.Sys32exit,
			name:    "exit",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_life"},
			params: []argMeta{
				{Type: "int", Name: "status"},
			},
		},
		events.Wait4: {
			ID:      events.Wait4,
			id32Bit: events.Sys32wait4,
			name:    "wait4",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_life"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
				{Type: "int*", Name: "wstatus"},
				{Type: "int", Name: "options"},
				{Type: "struct rusage*", Name: "rusage"},
			},
		},
		events.Kill: {
			ID:      events.Kill,
			id32Bit: events.Sys32kill,
			name:    "kill",
			syscall: true,
			sets:    []string{"syscalls", "signals"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
				{Type: "int", Name: "sig"},
			},
		},
		events.Uname: {
			ID:      events.Uname,
			id32Bit: events.Sys32uname,
			name:    "uname",
			syscall: true,
			sets:    []string{"syscalls", "system"},
			params: []argMeta{
				{Type: "struct utsname*", Name: "buf"},
			},
		},
		events.Semget: {
			ID:      events.Semget,
			id32Bit: events.Sys32semget,
			name:    "semget",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_sem"},
			params: []argMeta{
				{Type: "key_t", Name: "key"},
				{Type: "int", Name: "nsems"},
				{Type: "int", Name: "semflg"},
			},
		},
		events.Semop: {
			ID:      events.Semop,
			id32Bit: events.Sys32Undefined,
			name:    "semop",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_sem"},
			params: []argMeta{
				{Type: "int", Name: "semid"},
				{Type: "struct sembuf*", Name: "sops"},
				{Type: "size_t", Name: "nsops"},
			},
		},
		events.Semctl: {
			ID:      events.Semctl,
			id32Bit: events.Sys32semctl,
			name:    "semctl",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_sem"},
			params: []argMeta{
				{Type: "int", Name: "semid"},
				{Type: "int", Name: "semnum"},
				{Type: "int", Name: "cmd"},
				{Type: "unsigned long", Name: "arg"},
			},
		},
		events.Shmdt: {
			ID:      events.Shmdt,
			id32Bit: events.Sys32shmdt,
			name:    "shmdt",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_shm"},
			params: []argMeta{
				{Type: "const void*", Name: "shmaddr"},
			},
		},
		events.Msgget: {
			ID:      events.Msgget,
			id32Bit: events.Sys32msgget,
			name:    "msgget",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_msgq"},
			params: []argMeta{
				{Type: "key_t", Name: "key"},
				{Type: "int", Name: "msgflg"},
			},
		},
		events.Msgsnd: {
			ID:      events.Msgsnd,
			id32Bit: events.Sys32msgsnd,
			name:    "msgsnd",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_msgq"},
			params: []argMeta{
				{Type: "int", Name: "msqid"},
				{Type: "struct msgbuf*", Name: "msgp"},
				{Type: "size_t", Name: "msgsz"},
				{Type: "int", Name: "msgflg"},
			},
		},
		events.Msgrcv: {
			ID:      events.Msgrcv,
			id32Bit: events.Sys32msgrcv,
			name:    "msgrcv",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_msgq"},
			params: []argMeta{
				{Type: "int", Name: "msqid"},
				{Type: "struct msgbuf*", Name: "msgp"},
				{Type: "size_t", Name: "msgsz"},
				{Type: "long", Name: "msgtyp"},
				{Type: "int", Name: "msgflg"},
			},
		},
		events.Msgctl: {
			ID:      events.Msgctl,
			id32Bit: events.Sys32msgctl,
			name:    "msgctl",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_msgq"},
			params: []argMeta{
				{Type: "int", Name: "msqid"},
				{Type: "int", Name: "cmd"},
				{Type: "struct msqid_ds*", Name: "buf"},
			},
		},
		events.Fcntl: {
			ID:      events.Fcntl,
			id32Bit: events.Sys32fcntl,
			name:    "fcntl",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_fd_ops"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "int", Name: "cmd"},
				{Type: "unsigned long", Name: "arg"},
			},
		},
		events.Flock: {
			ID:      events.Flock,
			id32Bit: events.Sys32flock,
			name:    "flock",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_fd_ops"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "int", Name: "operation"},
			},
		},
		events.Fsync: {
			ID:      events.Fsync,
			id32Bit: events.Sys32fsync,
			name:    "fsync",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_sync"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
			},
		},
		events.Fdatasync: {
			ID:      events.Fdatasync,
			id32Bit: events.Sys32fdatasync,
			name:    "fdatasync",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_sync"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
			},
		},
		events.Truncate: {
			ID:      events.Truncate,
			id32Bit: events.Sys32truncate,
			name:    "truncate",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "const char*", Name: "path"},
				{Type: "off_t", Name: "length"},
			},
		},
		events.Ftruncate: {
			ID:      events.Ftruncate,
			id32Bit: events.Sys32ftruncate,
			name:    "ftruncate",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "off_t", Name: "length"},
			},
		},
		events.Getdents: {
			ID:      events.Getdents,
			id32Bit: events.Sys32getdents,
			name:    "getdents",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_dir_ops"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "struct linux_dirent*", Name: "dirp"},
				{Type: "unsigned int", Name: "count"},
			},
		},
		events.Getcwd: {
			ID:      events.Getcwd,
			id32Bit: events.Sys32getcwd,
			name:    "getcwd",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_dir_ops"},
			params: []argMeta{
				{Type: "char*", Name: "buf"},
				{Type: "size_t", Name: "size"},
			},
		},
		events.Chdir: {
			ID:      events.Chdir,
			id32Bit: events.Sys32chdir,
			name:    "chdir",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_dir_ops"},
			params: []argMeta{
				{Type: "const char*", Name: "path"},
			},
		},
		events.Fchdir: {
			ID:      events.Fchdir,
			id32Bit: events.Sys32fchdir,
			name:    "fchdir",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_dir_ops"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
			},
		},
		events.Rename: {
			ID:      events.Rename,
			id32Bit: events.Sys32rename,
			name:    "rename",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "const char*", Name: "oldpath"},
				{Type: "const char*", Name: "newpath"},
			},
		},
		events.Mkdir: {
			ID:      events.Mkdir,
			id32Bit: events.Sys32mkdir,
			name:    "mkdir",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_dir_ops"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "mode_t", Name: "mode"},
			},
		},
		events.Rmdir: {
			ID:      events.Rmdir,
			id32Bit: events.Sys32rmdir,
			name:    "rmdir",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_dir_ops"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
			},
		},
		events.Creat: {
			ID:      events.Creat,
			id32Bit: events.Sys32creat,
			name:    "creat",
			syscall: true,
			sets:    []string{"default", "syscalls", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "mode_t", Name: "mode"},
			},
		},
		events.Link: {
			ID:      events.Link,
			id32Bit: events.Sys32link,
			name:    "link",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_link_ops"},
			params: []argMeta{
				{Type: "const char*", Name: "oldpath"},
				{Type: "const char*", Name: "newpath"},
			},
		},
		events.Unlink: {
			ID:      events.Unlink,
			id32Bit: events.Sys32unlink,
			name:    "unlink",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_link_ops"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
			},
		},
		events.Symlink: {
			ID:      events.Symlink,
			id32Bit: events.Sys32symlink,
			name:    "symlink",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_link_ops"},
			params: []argMeta{
				{Type: "const char*", Name: "target"},
				{Type: "const char*", Name: "linkpath"},
			},
		},
		events.Readlink: {
			ID:      events.Readlink,
			id32Bit: events.Sys32readlink,
			name:    "readlink",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_link_ops"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "char*", Name: "buf"},
				{Type: "size_t", Name: "bufsiz"},
			},
		},
		events.Chmod: {
			ID:      events.Chmod,
			id32Bit: events.Sys32chmod,
			name:    "chmod",
			syscall: true,
			sets:    []string{"default", "syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "mode_t", Name: "mode"},
			},
		},
		events.Fchmod: {
			ID:      events.Fchmod,
			id32Bit: events.Sys32fchmod,
			name:    "fchmod",
			syscall: true,
			sets:    []string{"default", "syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "mode_t", Name: "mode"},
			},
		},
		events.Chown: {
			ID:      events.Chown,
			id32Bit: events.Sys32chown32,
			name:    "chown",
			syscall: true,
			sets:    []string{"default", "syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "uid_t", Name: "owner"},
				{Type: "gid_t", Name: "group"},
			},
		},
		events.Fchown: {
			ID:      events.Fchown,
			id32Bit: events.Sys32fchown32,
			name:    "fchown",
			syscall: true,
			sets:    []string{"default", "syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "uid_t", Name: "owner"},
				{Type: "gid_t", Name: "group"},
			},
		},
		events.Lchown: {
			ID:      events.Lchown,
			id32Bit: events.Sys32lchown32,
			name:    "lchown",
			syscall: true,
			sets:    []string{"default", "syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "uid_t", Name: "owner"},
				{Type: "gid_t", Name: "group"},
			},
		},
		events.Umask: {
			ID:      events.Umask,
			id32Bit: events.Sys32umask,
			name:    "umask",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "mode_t", Name: "mask"},
			},
		},
		events.Gettimeofday: {
			ID:      events.Gettimeofday,
			id32Bit: events.Sys32gettimeofday,
			name:    "gettimeofday",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_tod"},
			params: []argMeta{
				{Type: "struct timeval*", Name: "tv"},
				{Type: "struct timezone*", Name: "tz"},
			},
		},
		events.Getrlimit: {
			ID:      events.Getrlimit,
			id32Bit: events.Sys32ugetrlimit,
			name:    "getrlimit",
			syscall: true,
			sets:    []string{"syscalls", "proc"},
			params: []argMeta{
				{Type: "int", Name: "resource"},
				{Type: "struct rlimit*", Name: "rlim"},
			},
		},
		events.Getrusage: {
			ID:      events.Getrusage,
			id32Bit: events.Sys32getrusage,
			name:    "getrusage",
			syscall: true,
			sets:    []string{"syscalls", "proc"},
			params: []argMeta{
				{Type: "int", Name: "who"},
				{Type: "struct rusage*", Name: "usage"},
			},
		},
		events.Sysinfo: {
			ID:      events.Sysinfo,
			id32Bit: events.Sys32sysinfo,
			name:    "sysinfo",
			syscall: true,
			sets:    []string{"syscalls", "system"},
			params: []argMeta{
				{Type: "struct sysinfo*", Name: "info"},
			},
		},
		events.Times: {
			ID:      events.Times,
			id32Bit: events.Sys32times,
			name:    "times",
			syscall: true,
			sets:    []string{"syscalls", "proc"},
			params: []argMeta{
				{Type: "struct tms*", Name: "buf"},
			},
		},
		events.Ptrace: {
			ID:      events.Ptrace,
			id32Bit: events.Sys32ptrace,
			name:    "ptrace",
			syscall: true,
			sets:    []string{"default", "syscalls", "proc"},
			params: []argMeta{
				{Type: "long", Name: "request"},
				{Type: "pid_t", Name: "pid"},
				{Type: "void*", Name: "addr"},
				{Type: "void*", Name: "data"},
			},
		},
		events.Getuid: {
			ID:      events.Getuid,
			id32Bit: events.Sys32getuid32,
			name:    "getuid",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_ids"},
			params:  []argMeta{},
		},
		events.Syslog: {
			ID:      events.Syslog,
			id32Bit: events.Sys32syslog,
			name:    "syslog",
			syscall: true,
			sets:    []string{"syscalls", "system"},
			params: []argMeta{
				{Type: "int", Name: "type"},
				{Type: "char*", Name: "bufp"},
				{Type: "int", Name: "len"},
			},
		},
		events.Getgid: {
			ID:      events.Getgid,
			id32Bit: events.Sys32getgid32,
			name:    "getgid",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_ids"},
			params:  []argMeta{},
		},
		events.Setuid: {
			ID:      events.Setuid,
			id32Bit: events.Sys32setuid32,
			name:    "setuid",
			syscall: true,
			sets:    []string{"default", "syscalls", "proc", "proc_ids"},
			params: []argMeta{
				{Type: "uid_t", Name: "uid"},
			},
		},
		events.Setgid: {
			ID:      events.Setgid,
			id32Bit: events.Sys32setgid32,
			name:    "setgid",
			syscall: true,
			sets:    []string{"default", "syscalls", "proc", "proc_ids"},
			params: []argMeta{
				{Type: "gid_t", Name: "gid"},
			},
		},
		events.Geteuid: {
			ID:      events.Geteuid,
			id32Bit: events.Sys32geteuid32,
			name:    "geteuid",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_ids"},
			params:  []argMeta{},
		},
		events.Getegid: {
			ID:      events.Getegid,
			id32Bit: events.Sys32getegid32,
			name:    "getegid",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_ids"},
			params:  []argMeta{},
		},
		events.Setpgid: {
			ID:      events.Setpgid,
			id32Bit: events.Sys32setpgid,
			name:    "setpgid",
			syscall: true,
			sets:    []string{"default", "syscalls", "proc", "proc_ids"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
				{Type: "pid_t", Name: "pgid"},
			},
		},
		events.Getppid: {
			ID:      events.Getppid,
			id32Bit: events.Sys32getppid,
			name:    "getppid",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_ids"},
			params:  []argMeta{},
		},
		events.Getpgrp: {
			ID:      events.Getpgrp,
			id32Bit: events.Sys32getpgrp,
			name:    "getpgrp",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_ids"},
			params:  []argMeta{},
		},
		events.Setsid: {
			ID:      events.Setsid,
			id32Bit: events.Sys32setsid,
			name:    "setsid",
			syscall: true,
			sets:    []string{"default", "syscalls", "proc", "proc_ids"},
			params:  []argMeta{},
		},
		events.Setreuid: {
			ID:      events.Setreuid,
			id32Bit: events.Sys32setreuid32,
			name:    "setreuid",
			syscall: true,
			sets:    []string{"default", "syscalls", "proc", "proc_ids"},
			params: []argMeta{
				{Type: "uid_t", Name: "ruid"},
				{Type: "uid_t", Name: "euid"},
			},
		},
		events.Setregid: {
			ID:      events.Setregid,
			id32Bit: events.Sys32setregid32,
			name:    "setregid",
			syscall: true,
			sets:    []string{"default", "syscalls", "proc", "proc_ids"},
			params: []argMeta{
				{Type: "gid_t", Name: "rgid"},
				{Type: "gid_t", Name: "egid"},
			},
		},
		events.Getgroups: {
			ID:      events.Getgroups,
			id32Bit: events.Sys32getgroups32,
			name:    "getgroups",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_ids"},
			params: []argMeta{
				{Type: "int", Name: "size"},
				{Type: "gid_t*", Name: "list"},
			},
		},
		events.Setgroups: {
			ID:      events.Setgroups,
			id32Bit: events.Sys32setgroups32,
			name:    "setgroups",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_ids"},
			params: []argMeta{
				{Type: "int", Name: "size"},
				{Type: "gid_t*", Name: "list"},
			},
		},
		events.Setresuid: {
			ID:      events.Setresuid,
			id32Bit: events.Sys32setresuid32,
			name:    "setresuid",
			syscall: true,
			sets:    []string{"default", "syscalls", "proc", "proc_ids"},
			params: []argMeta{
				{Type: "uid_t", Name: "ruid"},
				{Type: "uid_t", Name: "euid"},
				{Type: "uid_t", Name: "suid"},
			},
		},
		events.Getresuid: {
			ID:      events.Getresuid,
			id32Bit: events.Sys32getresuid32,
			name:    "getresuid",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_ids"},
			params: []argMeta{
				{Type: "uid_t*", Name: "ruid"},
				{Type: "uid_t*", Name: "euid"},
				{Type: "uid_t*", Name: "suid"},
			},
		},
		events.Setresgid: {
			ID:      events.Setresgid,
			id32Bit: events.Sys32setresgid32,
			name:    "setresgid",
			syscall: true,
			sets:    []string{"default", "syscalls", "proc", "proc_ids"},
			params: []argMeta{
				{Type: "gid_t", Name: "rgid"},
				{Type: "gid_t", Name: "egid"},
				{Type: "gid_t", Name: "sgid"},
			},
		},
		events.Getresgid: {
			ID:      events.Getresgid,
			id32Bit: events.Sys32getresgid32,
			name:    "getresgid",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_ids"},
			params: []argMeta{
				{Type: "gid_t*", Name: "rgid"},
				{Type: "gid_t*", Name: "egid"},
				{Type: "gid_t*", Name: "sgid"},
			},
		},
		events.Getpgid: {
			ID:      events.Getpgid,
			id32Bit: events.Sys32getpgid,
			name:    "getpgid",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_ids"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
			},
		},
		events.Setfsuid: {
			ID:      events.Setfsuid,
			id32Bit: events.Sys32setfsuid32,
			name:    "setfsuid",
			syscall: true,
			sets:    []string{"default", "syscalls", "proc", "proc_ids"},
			params: []argMeta{
				{Type: "uid_t", Name: "fsuid"},
			},
		},
		events.Setfsgid: {
			ID:      events.Setfsgid,
			id32Bit: events.Sys32setfsgid32,
			name:    "setfsgid",
			syscall: true,
			sets:    []string{"default", "syscalls", "proc", "proc_ids"},
			params: []argMeta{
				{Type: "gid_t", Name: "fsgid"},
			},
		},
		events.Getsid: {
			ID:      events.Getsid,
			id32Bit: events.Sys32getsid,
			name:    "getsid",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_ids"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
			},
		},
		events.Capget: {
			ID:      events.Capget,
			id32Bit: events.Sys32capget,
			name:    "capget",
			syscall: true,
			sets:    []string{"syscalls", "proc"},
			params: []argMeta{
				{Type: "cap_user_header_t", Name: "hdrp"},
				{Type: "cap_user_data_t", Name: "datap"},
			},
		},
		events.Capset: {
			ID:      events.Capset,
			id32Bit: events.Sys32capset,
			name:    "capset",
			syscall: true,
			sets:    []string{"syscalls", "proc"},
			params: []argMeta{
				{Type: "cap_user_header_t", Name: "hdrp"},
				{Type: "const cap_user_data_t", Name: "datap"},
			},
		},
		events.RtSigpending: {
			ID:      events.RtSigpending,
			id32Bit: events.Sys32rt_sigpending,
			name:    "rt_sigpending",
			syscall: true,
			sets:    []string{"syscalls", "signals"},
			params: []argMeta{
				{Type: "sigset_t*", Name: "set"},
				{Type: "size_t", Name: "sigsetsize"},
			},
		},
		events.RtSigtimedwait: {
			ID:      events.RtSigtimedwait,
			id32Bit: events.Sys32rt_sigtimedwait_time64,
			name:    "rt_sigtimedwait",
			syscall: true,
			sets:    []string{"syscalls", "signals"},
			params: []argMeta{
				{Type: "const sigset_t*", Name: "set"},
				{Type: "siginfo_t*", Name: "info"},
				{Type: "const struct timespec*", Name: "timeout"},
				{Type: "size_t", Name: "sigsetsize"},
			},
		},
		events.RtSigqueueinfo: {
			ID:      events.RtSigqueueinfo,
			id32Bit: events.Sys32rt_sigqueueinfo,
			name:    "rt_sigqueueinfo",
			syscall: true,
			sets:    []string{"syscalls", "signals"},
			params: []argMeta{
				{Type: "pid_t", Name: "tgid"},
				{Type: "int", Name: "sig"},
				{Type: "siginfo_t*", Name: "info"},
			},
		},
		events.RtSigsuspend: {
			ID:      events.RtSigsuspend,
			id32Bit: events.Sys32rt_sigsuspend,
			name:    "rt_sigsuspend",
			syscall: true,
			sets:    []string{"syscalls", "signals"},
			params: []argMeta{
				{Type: "sigset_t*", Name: "mask"},
				{Type: "size_t", Name: "sigsetsize"},
			},
		},
		events.Sigaltstack: {
			ID:      events.Sigaltstack,
			id32Bit: events.Sys32sigaltstack,
			name:    "sigaltstack",
			syscall: true,
			sets:    []string{"syscalls", "signals"},
			params: []argMeta{
				{Type: "const stack_t*", Name: "ss"},
				{Type: "stack_t*", Name: "old_ss"},
			},
		},
		events.Utime: {
			ID:      events.Utime,
			id32Bit: events.Sys32utime,
			name:    "utime",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "const char*", Name: "filename"},
				{Type: "const struct utimbuf*", Name: "times"},
			},
		},
		events.Mknod: {
			ID:      events.Mknod,
			id32Bit: events.Sys32mknod,
			name:    "mknod",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "mode_t", Name: "mode"},
				{Type: "dev_t", Name: "dev"},
			},
		},
		events.Uselib: {
			ID:      events.Uselib,
			id32Bit: events.Sys32uselib,
			name:    "uselib",
			syscall: true,
			sets:    []string{"syscalls", "proc"},
			params: []argMeta{
				{Type: "const char*", Name: "library"},
			},
		},
		events.Personality: {
			ID:      events.Personality,
			id32Bit: events.Sys32personality,
			name:    "personality",
			syscall: true,
			sets:    []string{"syscalls", "system"},
			params: []argMeta{
				{Type: "unsigned long", Name: "persona"},
			},
		},
		events.Ustat: {
			ID:      events.Ustat,
			id32Bit: events.Sys32ustat,
			name:    "ustat",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_info"},
			params: []argMeta{
				{Type: "dev_t", Name: "dev"},
				{Type: "struct ustat*", Name: "ubuf"},
			},
		},
		events.Statfs: {
			ID:      events.Statfs,
			id32Bit: events.Sys32statfs,
			name:    "statfs",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_info"},
			params: []argMeta{
				{Type: "const char*", Name: "path"},
				{Type: "struct statfs*", Name: "buf"},
			},
		},
		events.Fstatfs: {
			ID:      events.Fstatfs,
			id32Bit: events.Sys32fstatfs,
			name:    "fstatfs",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_info"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "struct statfs*", Name: "buf"},
			},
		},
		events.Sysfs: {
			ID:      events.Sysfs,
			id32Bit: events.Sys32sysfs,
			name:    "sysfs",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_info"},
			params: []argMeta{
				{Type: "int", Name: "option"},
			},
		},
		events.Getpriority: {
			ID:      events.Getpriority,
			id32Bit: events.Sys32getpriority,
			name:    "getpriority",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_sched"},
			params: []argMeta{
				{Type: "int", Name: "which"},
				{Type: "int", Name: "who"},
			},
		},
		events.Setpriority: {
			ID:      events.Setpriority,
			id32Bit: events.Sys32setpriority,
			name:    "setpriority",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_sched"},
			params: []argMeta{
				{Type: "int", Name: "which"},
				{Type: "int", Name: "who"},
				{Type: "int", Name: "prio"},
			},
		},
		events.SchedSetparam: {
			ID:      events.SchedSetparam,
			id32Bit: events.Sys32sched_setparam,
			name:    "sched_setparam",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_sched"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
				{Type: "struct sched_param*", Name: "param"},
			},
		},
		events.SchedGetparam: {
			ID:      events.SchedGetparam,
			id32Bit: events.Sys32sched_getparam,
			name:    "sched_getparam",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_sched"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
				{Type: "struct sched_param*", Name: "param"},
			},
		},
		events.SchedSetscheduler: {
			ID:      events.SchedSetscheduler,
			id32Bit: events.Sys32sched_setscheduler,
			name:    "sched_setscheduler",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_sched"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
				{Type: "int", Name: "policy"},
				{Type: "struct sched_param*", Name: "param"},
			},
		},
		events.SchedGetscheduler: {
			ID:      events.SchedGetscheduler,
			id32Bit: events.Sys32sched_getscheduler,
			name:    "sched_getscheduler",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_sched"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
			},
		},
		events.SchedGetPriorityMax: {
			ID:      events.SchedGetPriorityMax,
			id32Bit: events.Sys32sched_get_priority_max,
			name:    "sched_get_priority_max",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_sched"},
			params: []argMeta{
				{Type: "int", Name: "policy"},
			},
		},
		events.SchedGetPriorityMin: {
			ID:      events.SchedGetPriorityMin,
			id32Bit: events.Sys32sched_get_priority_min,
			name:    "sched_get_priority_min",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_sched"},
			params: []argMeta{
				{Type: "int", Name: "policy"},
			},
		},
		events.SchedRrGetInterval: {
			ID:      events.SchedRrGetInterval,
			id32Bit: events.Sys32sched_rr_get_interval_time64,
			name:    "sched_rr_get_interval",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_sched"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
				{Type: "struct timespec*", Name: "tp"},
			},
		},
		events.Mlock: {
			ID:      events.Mlock,
			id32Bit: events.Sys32mlock,
			name:    "mlock",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_mem"},
			params: []argMeta{
				{Type: "const void*", Name: "addr"},
				{Type: "size_t", Name: "len"},
			},
		},
		events.Munlock: {
			ID:      events.Munlock,
			id32Bit: events.Sys32munlock,
			name:    "munlock",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_mem"},
			params: []argMeta{
				{Type: "const void*", Name: "addr"},
				{Type: "size_t", Name: "len"},
			},
		},
		events.Mlockall: {
			ID:      events.Mlockall,
			id32Bit: events.Sys32mlockall,
			name:    "mlockall",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_mem"},
			params: []argMeta{
				{Type: "int", Name: "flags"},
			},
		},
		events.Munlockall: {
			ID:      events.Munlockall,
			id32Bit: events.Sys32munlockall,
			name:    "munlockall",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_mem"},
			params:  []argMeta{},
		},
		events.Vhangup: {
			ID:      events.Vhangup,
			id32Bit: events.Sys32vhangup,
			name:    "vhangup",
			syscall: true,
			sets:    []string{"syscalls", "system"},
			params:  []argMeta{},
		},
		events.ModifyLdt: {
			ID:      events.ModifyLdt,
			id32Bit: events.Sys32modify_ldt,
			name:    "modify_ldt",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_mem"},
			params: []argMeta{
				{Type: "int", Name: "func"},
				{Type: "void*", Name: "ptr"},
				{Type: "unsigned long", Name: "bytecount"},
			},
		},
		events.PivotRoot: {
			ID:      events.PivotRoot,
			id32Bit: events.Sys32pivot_root,
			name:    "pivot_root",
			syscall: true,
			sets:    []string{"syscalls", "fs"},
			params: []argMeta{
				{Type: "const char*", Name: "new_root"},
				{Type: "const char*", Name: "put_old"},
			},
		},
		events.Sysctl: {
			ID:      events.Sysctl,
			id32Bit: events.Sys32_sysctl,
			name:    "sysctl",
			syscall: true,
			sets:    []string{"syscalls", "system"},
			params: []argMeta{
				{Type: "struct __sysctl_args*", Name: "args"},
			},
		},
		events.Prctl: {
			ID:      events.Prctl,
			id32Bit: events.Sys32prctl,
			name:    "prctl",
			syscall: true,
			sets:    []string{"syscalls", "proc"},
			params: []argMeta{
				{Type: "int", Name: "option"},
				{Type: "unsigned long", Name: "arg2"},
				{Type: "unsigned long", Name: "arg3"},
				{Type: "unsigned long", Name: "arg4"},
				{Type: "unsigned long", Name: "arg5"},
			},
		},
		events.ArchPrctl: {
			ID:      events.ArchPrctl,
			id32Bit: events.Sys32arch_prctl,
			name:    "arch_prctl",
			syscall: true,
			sets:    []string{"syscalls", "proc"},
			params: []argMeta{
				{Type: "int", Name: "option"},
				{Type: "unsigned long", Name: "addr"},
			},
		},
		events.Adjtimex: {
			ID:      events.Adjtimex,
			id32Bit: events.Sys32adjtimex,
			name:    "adjtimex",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_clock"},
			params: []argMeta{
				{Type: "struct timex*", Name: "buf"},
			},
		},
		events.Setrlimit: {
			ID:      events.Setrlimit,
			id32Bit: events.Sys32setrlimit,
			name:    "setrlimit",
			syscall: true,
			sets:    []string{"syscalls", "proc"},
			params: []argMeta{
				{Type: "int", Name: "resource"},
				{Type: "const struct rlimit*", Name: "rlim"},
			},
		},
		events.Chroot: {
			ID:      events.Chroot,
			id32Bit: events.Sys32chroot,
			name:    "chroot",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_dir_ops"},
			params: []argMeta{
				{Type: "const char*", Name: "path"},
			},
		},
		events.Sync: {
			ID:      events.Sync,
			id32Bit: events.Sys32sync,
			name:    "sync",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_sync"},
			params:  []argMeta{},
		},
		events.Acct: {
			ID:      events.Acct,
			id32Bit: events.Sys32acct,
			name:    "acct",
			syscall: true,
			sets:    []string{"syscalls", "system"},
			params: []argMeta{
				{Type: "const char*", Name: "filename"},
			},
		},
		events.Settimeofday: {
			ID:      events.Settimeofday,
			id32Bit: events.Sys32settimeofday,
			name:    "settimeofday",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_tod"},
			params: []argMeta{
				{Type: "const struct timeval*", Name: "tv"},
				{Type: "const struct timezone*", Name: "tz"},
			},
		},
		events.Mount: {
			ID:      events.Mount,
			id32Bit: events.Sys32mount,
			name:    "mount",
			syscall: true,
			sets:    []string{"syscalls", "fs"},
			params: []argMeta{
				{Type: "const char*", Name: "source"},
				{Type: "const char*", Name: "target"},
				{Type: "const char*", Name: "filesystemtype"},
				{Type: "unsigned long", Name: "mountflags"},
				{Type: "const void*", Name: "data"},
			},
		},
		events.Umount2: {
			ID:      events.Umount2,
			id32Bit: events.Sys32umount2,
			name:    "umount2",
			syscall: true,
			sets:    []string{"syscalls", "fs"},
			params: []argMeta{
				{Type: "const char*", Name: "target"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Swapon: {
			ID:      events.Swapon,
			id32Bit: events.Sys32swapon,
			name:    "swapon",
			syscall: true,
			sets:    []string{"syscalls", "fs"},
			params: []argMeta{
				{Type: "const char*", Name: "path"},
				{Type: "int", Name: "swapflags"},
			},
		},
		events.Swapoff: {
			ID:      events.Swapoff,
			id32Bit: events.Sys32swapoff,
			name:    "swapoff",
			syscall: true,
			sets:    []string{"syscalls", "fs"},
			params: []argMeta{
				{Type: "const char*", Name: "path"},
			},
		},
		events.Reboot: {
			ID:      events.Reboot,
			id32Bit: events.Sys32reboot,
			name:    "reboot",
			syscall: true,
			sets:    []string{"syscalls", "system"},
			params: []argMeta{
				{Type: "int", Name: "magic"},
				{Type: "int", Name: "magic2"},
				{Type: "int", Name: "cmd"},
				{Type: "void*", Name: "arg"},
			},
		},
		events.Sethostname: {
			ID:      events.Sethostname,
			id32Bit: events.Sys32sethostname,
			name:    "sethostname",
			syscall: true,
			sets:    []string{"syscalls", "net"},
			params: []argMeta{
				{Type: "const char*", Name: "name"},
				{Type: "size_t", Name: "len"},
			},
		},
		events.Setdomainname: {
			ID:      events.Setdomainname,
			id32Bit: events.Sys32setdomainname,
			name:    "setdomainname",
			syscall: true,
			sets:    []string{"syscalls", "net"},
			params: []argMeta{
				{Type: "const char*", Name: "name"},
				{Type: "size_t", Name: "len"},
			},
		},
		events.Iopl: {
			ID:      events.Iopl,
			id32Bit: events.Sys32iopl,
			name:    "iopl",
			syscall: true,
			sets:    []string{"syscalls", "system"},
			params: []argMeta{
				{Type: "int", Name: "level"},
			},
		},
		events.Ioperm: {
			ID:      events.Ioperm,
			id32Bit: events.Sys32ioperm,
			name:    "ioperm",
			syscall: true,
			sets:    []string{"syscalls", "system"},
			params: []argMeta{
				{Type: "unsigned long", Name: "from"},
				{Type: "unsigned long", Name: "num"},
				{Type: "int", Name: "turn_on"},
			},
		},
		events.CreateModule: {
			ID:      events.CreateModule,
			id32Bit: events.Sys32create_module,
			name:    "create_module",
			syscall: true,
			sets:    []string{"syscalls", "system", "system_module"},
			params:  []argMeta{},
		},
		events.InitModule: {
			ID:      events.InitModule,
			id32Bit: events.Sys32init_module,
			name:    "init_module",
			syscall: true,
			sets:    []string{"default", "syscalls", "system", "system_module"},
			params: []argMeta{
				{Type: "void*", Name: "module_image"},
				{Type: "unsigned long", Name: "len"},
				{Type: "const char*", Name: "param_values"},
			},
		},
		events.DeleteModule: {
			ID:      events.DeleteModule,
			id32Bit: events.Sys32delete_module,
			name:    "delete_module",
			syscall: true,
			sets:    []string{"syscalls", "system", "system_module"},
			params: []argMeta{
				{Type: "const char*", Name: "name"},
				{Type: "int", Name: "flags"},
			},
		},
		events.GetKernelSyms: {
			ID:      events.GetKernelSyms,
			id32Bit: events.Sys32get_kernel_syms,
			name:    "get_kernel_syms",
			syscall: true,
			sets:    []string{"syscalls", "system", "system_module"},
			params:  []argMeta{},
		},
		events.QueryModule: {
			ID:      events.QueryModule,
			id32Bit: events.Sys32query_module,
			name:    "query_module",
			syscall: true,
			sets:    []string{"syscalls", "system", "system_module"},
			params:  []argMeta{},
		},
		events.Quotactl: {
			ID:      events.Quotactl,
			id32Bit: events.Sys32quotactl,
			name:    "quotactl",
			syscall: true,
			sets:    []string{"syscalls", "system"},
			params: []argMeta{
				{Type: "int", Name: "cmd"},
				{Type: "const char*", Name: "special"},
				{Type: "int", Name: "id"},
				{Type: "void*", Name: "addr"},
			},
		},
		events.Nfsservctl: {
			ID:      events.Nfsservctl,
			id32Bit: events.Sys32nfsservctl,
			name:    "nfsservctl",
			syscall: true,
			sets:    []string{"syscalls", "fs"},
			params:  []argMeta{},
		},
		events.Getpmsg: {
			ID:      events.Getpmsg,
			id32Bit: events.Sys32getpmsg,
			name:    "getpmsg",
			syscall: true,
			sets:    []string{"syscalls"},
			params:  []argMeta{},
		},
		events.Putpmsg: {
			ID:      events.Putpmsg,
			id32Bit: events.Sys32putpmsg,
			name:    "putpmsg",
			syscall: true,
			sets:    []string{"syscalls"},
			params:  []argMeta{},
		},
		events.Afs: {
			ID:      events.Afs,
			id32Bit: events.Sys32Undefined,
			name:    "afs",
			syscall: true,
			sets:    []string{"syscalls"},
			params:  []argMeta{},
		},
		events.Tuxcall: {
			ID:      events.Tuxcall,
			id32Bit: events.Sys32Undefined,
			name:    "tuxcall",
			syscall: true,
			sets:    []string{"syscalls"},
			params:  []argMeta{},
		},
		events.Security: {
			ID:      events.Security,
			id32Bit: events.Sys32Undefined,
			name:    "security",
			syscall: true,
			sets:    []string{"syscalls"},
			params:  []argMeta{},
		},
		events.Gettid: {
			ID:      events.Gettid,
			id32Bit: events.Sys32gettid,
			name:    "gettid",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_ids"},
			params:  []argMeta{},
		},
		events.Readahead: {
			ID:      events.Readahead,
			id32Bit: events.Sys32readahead,
			name:    "readahead",
			syscall: true,
			sets:    []string{"syscalls", "fs"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "off_t", Name: "offset"},
				{Type: "size_t", Name: "count"},
			},
		},
		events.Setxattr: {
			ID:      events.Setxattr,
			id32Bit: events.Sys32setxattr,
			name:    "setxattr",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "const char*", Name: "path"},
				{Type: "const char*", Name: "name"},
				{Type: "const void*", Name: "value"},
				{Type: "size_t", Name: "size"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Lsetxattr: {
			ID:      events.Lsetxattr,
			id32Bit: events.Sys32lsetxattr,
			name:    "lsetxattr",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "const char*", Name: "path"},
				{Type: "const char*", Name: "name"},
				{Type: "const void*", Name: "value"},
				{Type: "size_t", Name: "size"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Fsetxattr: {
			ID:      events.Fsetxattr,
			id32Bit: events.Sys32fsetxattr,
			name:    "fsetxattr",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "const char*", Name: "name"},
				{Type: "const void*", Name: "value"},
				{Type: "size_t", Name: "size"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Getxattr: {
			ID:      events.Getxattr,
			id32Bit: events.Sys32getxattr,
			name:    "getxattr",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "const char*", Name: "path"},
				{Type: "const char*", Name: "name"},
				{Type: "void*", Name: "value"},
				{Type: "size_t", Name: "size"},
			},
		},
		events.Lgetxattr: {
			ID:      events.Lgetxattr,
			id32Bit: events.Sys32lgetxattr,
			name:    "lgetxattr",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "const char*", Name: "path"},
				{Type: "const char*", Name: "name"},
				{Type: "void*", Name: "value"},
				{Type: "size_t", Name: "size"},
			},
		},
		events.Fgetxattr: {
			ID:      events.Fgetxattr,
			id32Bit: events.Sys32fgetxattr,
			name:    "fgetxattr",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "const char*", Name: "name"},
				{Type: "void*", Name: "value"},
				{Type: "size_t", Name: "size"},
			},
		},
		events.Listxattr: {
			ID:      events.Listxattr,
			id32Bit: events.Sys32listxattr,
			name:    "listxattr",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "const char*", Name: "path"},
				{Type: "char*", Name: "list"},
				{Type: "size_t", Name: "size"},
			},
		},
		events.Llistxattr: {
			ID:      events.Llistxattr,
			id32Bit: events.Sys32llistxattr,
			name:    "llistxattr",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "const char*", Name: "path"},
				{Type: "char*", Name: "list"},
				{Type: "size_t", Name: "size"},
			},
		},
		events.Flistxattr: {
			ID:      events.Flistxattr,
			id32Bit: events.Sys32flistxattr,
			name:    "flistxattr",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "char*", Name: "list"},
				{Type: "size_t", Name: "size"},
			},
		},
		events.Removexattr: {
			ID:      events.Removexattr,
			id32Bit: events.Sys32removexattr,
			name:    "removexattr",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "const char*", Name: "path"},
				{Type: "const char*", Name: "name"},
			},
		},
		events.Lremovexattr: {
			ID:      events.Lremovexattr,
			id32Bit: events.Sys32lremovexattr,
			name:    "lremovexattr",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "const char*", Name: "path"},
				{Type: "const char*", Name: "name"},
			},
		},
		events.Fremovexattr: {
			ID:      events.Fremovexattr,
			id32Bit: events.Sys32fremovexattr,
			name:    "fremovexattr",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "const char*", Name: "name"},
			},
		},
		events.Tkill: {
			ID:      events.Tkill,
			id32Bit: events.Sys32tkill,
			name:    "tkill",
			syscall: true,
			sets:    []string{"syscalls", "signals"},
			params: []argMeta{
				{Type: "int", Name: "tid"},
				{Type: "int", Name: "sig"},
			},
		},
		events.Time: {
			ID:      events.Time,
			id32Bit: events.Sys32time,
			name:    "time",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_tod"},
			params: []argMeta{
				{Type: "time_t*", Name: "tloc"},
			},
		},
		events.Futex: {
			ID:      events.Futex,
			id32Bit: events.Sys32futex_time64,
			name:    "futex",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_futex"},
			params: []argMeta{
				{Type: "int*", Name: "uaddr"},
				{Type: "int", Name: "futex_op"},
				{Type: "int", Name: "val"},
				{Type: "const struct timespec*", Name: "timeout"},
				{Type: "int*", Name: "uaddr2"},
				{Type: "int", Name: "val3"},
			},
		},
		events.SchedSetaffinity: {
			ID:      events.SchedSetaffinity,
			id32Bit: events.Sys32sched_setaffinity,
			name:    "sched_setaffinity",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_sched"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
				{Type: "size_t", Name: "cpusetsize"},
				{Type: "unsigned long*", Name: "mask"},
			},
		},
		events.SchedGetaffinity: {
			ID:      events.SchedGetaffinity,
			id32Bit: events.Sys32sched_getaffinity,
			name:    "sched_getaffinity",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_sched"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
				{Type: "size_t", Name: "cpusetsize"},
				{Type: "unsigned long*", Name: "mask"},
			},
		},
		events.SetThreadArea: {
			ID:      events.SetThreadArea,
			id32Bit: events.Sys32set_thread_area,
			name:    "set_thread_area",
			syscall: true,
			sets:    []string{"syscalls", "proc"},
			params: []argMeta{
				{Type: "struct user_desc*", Name: "u_info"},
			},
		},
		events.IoSetup: {
			ID:      events.IoSetup,
			id32Bit: events.Sys32io_setup,
			name:    "io_setup",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_async_io"},
			params: []argMeta{
				{Type: "unsigned int", Name: "nr_events"},
				{Type: "io_context_t*", Name: "ctx_idp"},
			},
		},
		events.IoDestroy: {
			ID:      events.IoDestroy,
			id32Bit: events.Sys32io_destroy,
			name:    "io_destroy",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_async_io"},
			params: []argMeta{
				{Type: "io_context_t", Name: "ctx_id"},
			},
		},
		events.IoGetevents: {
			ID:      events.IoGetevents,
			id32Bit: events.Sys32io_getevents,
			name:    "io_getevents",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_async_io"},
			params: []argMeta{
				{Type: "io_context_t", Name: "ctx_id"},
				{Type: "long", Name: "min_nr"},
				{Type: "long", Name: "nr"},
				{Type: "struct io_event*", Name: "events"},
				{Type: "struct timespec*", Name: "timeout"},
			},
		},
		events.IoSubmit: {
			ID:      events.IoSubmit,
			id32Bit: events.Sys32io_submit,
			name:    "io_submit",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_async_io"},
			params: []argMeta{
				{Type: "io_context_t", Name: "ctx_id"},
				{Type: "long", Name: "nr"},
				{Type: "struct iocb**", Name: "iocbpp"},
			},
		},
		events.IoCancel: {
			ID:      events.IoCancel,
			id32Bit: events.Sys32io_cancel,
			name:    "io_cancel",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_async_io"},
			params: []argMeta{
				{Type: "io_context_t", Name: "ctx_id"},
				{Type: "struct iocb*", Name: "iocb"},
				{Type: "struct io_event*", Name: "result"},
			},
		},
		events.GetThreadArea: {
			ID:      events.GetThreadArea,
			id32Bit: events.Sys32get_thread_area,
			name:    "get_thread_area",
			syscall: true,
			sets:    []string{"syscalls", "proc"},
			params: []argMeta{
				{Type: "struct user_desc*", Name: "u_info"},
			},
		},
		events.LookupDcookie: {
			ID:      events.LookupDcookie,
			id32Bit: events.Sys32lookup_dcookie,
			name:    "lookup_dcookie",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_dir_ops"},
			params: []argMeta{
				{Type: "u64", Name: "cookie"},
				{Type: "char*", Name: "buffer"},
				{Type: "size_t", Name: "len"},
			},
		},
		events.EpollCreate: {
			ID:      events.EpollCreate,
			id32Bit: events.Sys32epoll_create,
			name:    "epoll_create",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_mux_io"},
			params: []argMeta{
				{Type: "int", Name: "size"},
			},
		},
		events.EpollCtlOld: {
			ID:      events.EpollCtlOld,
			id32Bit: events.Sys32Undefined,
			name:    "epoll_ctl_old",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_mux_io"},
			params:  []argMeta{},
		},
		events.EpollWaitOld: {
			ID:      events.EpollWaitOld,
			id32Bit: events.Sys32Undefined,
			name:    "epoll_wait_old",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_mux_io"},
			params:  []argMeta{},
		},
		events.RemapFilePages: {
			ID:      events.RemapFilePages,
			id32Bit: events.Sys32remap_file_pages,
			name:    "remap_file_pages",
			syscall: true,
			sets:    []string{"syscalls"},
			params: []argMeta{
				{Type: "void*", Name: "addr"},
				{Type: "size_t", Name: "size"},
				{Type: "int", Name: "prot"},
				{Type: "size_t", Name: "pgoff"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Getdents64: {
			ID:      events.Getdents64,
			id32Bit: events.Sys32getdents64,
			name:    "getdents64",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_dir_ops"},
			params: []argMeta{
				{Type: "unsigned int", Name: "fd"},
				{Type: "struct linux_dirent64*", Name: "dirp"},
				{Type: "unsigned int", Name: "count"},
			},
		},
		events.SetTidAddress: {
			ID:      events.SetTidAddress,
			id32Bit: events.Sys32set_tid_address,
			name:    "set_tid_address",
			syscall: true,
			sets:    []string{"syscalls", "proc"},
			params: []argMeta{
				{Type: "int*", Name: "tidptr"},
			},
		},
		events.RestartSyscall: {
			ID:      events.RestartSyscall,
			id32Bit: events.Sys32restart_syscall,
			name:    "restart_syscall",
			syscall: true,
			sets:    []string{"syscalls", "signals"},
			params:  []argMeta{},
		},
		events.Semtimedop: {
			ID:      events.Semtimedop,
			id32Bit: events.Sys32semtimedop_time64,
			name:    "semtimedop",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_sem"},
			params: []argMeta{
				{Type: "int", Name: "semid"},
				{Type: "struct sembuf*", Name: "sops"},
				{Type: "size_t", Name: "nsops"},
				{Type: "const struct timespec*", Name: "timeout"},
			},
		},
		events.Fadvise64: {
			ID:      events.Fadvise64,
			id32Bit: events.Sys32fadvise64,
			name:    "fadvise64",
			syscall: true,
			sets:    []string{"syscalls", "fs"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "off_t", Name: "offset"},
				{Type: "size_t", Name: "len"},
				{Type: "int", Name: "advice"},
			},
		},
		events.TimerCreate: {
			ID:      events.TimerCreate,
			id32Bit: events.Sys32timer_create,
			name:    "timer_create",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_timer"},
			params: []argMeta{
				{Type: "const clockid_t", Name: "clockid"},
				{Type: "struct sigevent*", Name: "sevp"},
				{Type: "timer_t*", Name: "timer_id"},
			},
		},
		events.TimerSettime: {
			ID:      events.TimerSettime,
			id32Bit: events.Sys32timer_settime64,
			name:    "timer_settime",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_timer"},
			params: []argMeta{
				{Type: "timer_t", Name: "timer_id"},
				{Type: "int", Name: "flags"},
				{Type: "const struct itimerspec*", Name: "new_value"},
				{Type: "struct itimerspec*", Name: "old_value"},
			},
		},
		events.TimerGettime: {
			ID:      events.TimerGettime,
			id32Bit: events.Sys32timer_gettime64,
			name:    "timer_gettime",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_timer"},
			params: []argMeta{
				{Type: "timer_t", Name: "timer_id"},
				{Type: "struct itimerspec*", Name: "curr_value"},
			},
		},
		events.TimerGetoverrun: {
			ID:      events.TimerGetoverrun,
			id32Bit: events.Sys32timer_getoverrun,
			name:    "timer_getoverrun",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_timer"},
			params: []argMeta{
				{Type: "timer_t", Name: "timer_id"},
			},
		},
		events.TimerDelete: {
			ID:      events.TimerDelete,
			id32Bit: events.Sys32timer_delete,
			name:    "timer_delete",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_timer"},
			params: []argMeta{
				{Type: "timer_t", Name: "timer_id"},
			},
		},
		events.ClockSettime: {
			ID:      events.ClockSettime,
			id32Bit: events.Sys32clock_settime64,
			name:    "clock_settime",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_clock"},
			params: []argMeta{
				{Type: "const clockid_t", Name: "clockid"},
				{Type: "const struct timespec*", Name: "tp"},
			},
		},
		events.ClockGettime: {
			ID:      events.ClockGettime,
			id32Bit: events.Sys32clock_gettime64,
			name:    "clock_gettime",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_clock"},
			params: []argMeta{
				{Type: "const clockid_t", Name: "clockid"},
				{Type: "struct timespec*", Name: "tp"},
			},
		},
		events.ClockGetres: {
			ID:      events.ClockGetres,
			id32Bit: events.Sys32clock_getres_time64,
			name:    "clock_getres",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_clock"},
			params: []argMeta{
				{Type: "const clockid_t", Name: "clockid"},
				{Type: "struct timespec*", Name: "res"},
			},
		},
		events.ClockNanosleep: {
			ID:      events.ClockNanosleep,
			id32Bit: events.Sys32clock_nanosleep_time64,
			name:    "clock_nanosleep",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_clock"},
			params: []argMeta{
				{Type: "const clockid_t", Name: "clockid"},
				{Type: "int", Name: "flags"},
				{Type: "const struct timespec*", Name: "request"},
				{Type: "struct timespec*", Name: "remain"},
			},
		},
		events.ExitGroup: {
			ID:      events.ExitGroup,
			id32Bit: events.Sys32exit_group,
			name:    "exit_group",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_life"},
			params: []argMeta{
				{Type: "int", Name: "status"},
			},
		},
		events.EpollWait: {
			ID:      events.EpollWait,
			id32Bit: events.Sys32epoll_wait,
			name:    "epoll_wait",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_mux_io"},
			params: []argMeta{
				{Type: "int", Name: "epfd"},
				{Type: "struct epoll_event*", Name: "events"},
				{Type: "int", Name: "maxevents"},
				{Type: "int", Name: "timeout"},
			},
		},
		events.EpollCtl: {
			ID:      events.EpollCtl,
			id32Bit: events.Sys32epoll_ctl,
			name:    "epoll_ctl",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_mux_io"},
			params: []argMeta{
				{Type: "int", Name: "epfd"},
				{Type: "int", Name: "op"},
				{Type: "int", Name: "fd"},
				{Type: "struct epoll_event*", Name: "event"},
			},
		},
		events.Tgkill: {
			ID:      events.Tgkill,
			id32Bit: events.Sys32tgkill,
			name:    "tgkill",
			syscall: true,
			sets:    []string{"syscalls", "signals"},
			params: []argMeta{
				{Type: "int", Name: "tgid"},
				{Type: "int", Name: "tid"},
				{Type: "int", Name: "sig"},
			},
		},
		events.Utimes: {
			ID:      events.Utimes,
			id32Bit: events.Sys32utimes,
			name:    "utimes",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "char*", Name: "filename"},
				{Type: "struct timeval*", Name: "times"},
			},
		},
		events.Vserver: {
			ID:      events.Vserver,
			id32Bit: events.Sys32vserver,
			name:    "vserver",
			syscall: true,
			sets:    []string{"syscalls"},
			params:  []argMeta{},
		},
		events.Mbind: {
			ID:      events.Mbind,
			id32Bit: events.Sys32mbind,
			name:    "mbind",
			syscall: true,
			sets:    []string{"syscalls", "system", "system_numa"},
			params: []argMeta{
				{Type: "void*", Name: "addr"},
				{Type: "unsigned long", Name: "len"},
				{Type: "int", Name: "mode"},
				{Type: "const unsigned long*", Name: "nodemask"},
				{Type: "unsigned long", Name: "maxnode"},
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.SetMempolicy: {
			ID:      events.SetMempolicy,
			id32Bit: events.Sys32set_mempolicy,
			name:    "set_mempolicy",
			syscall: true,
			sets:    []string{"syscalls", "system", "system_numa"},
			params: []argMeta{
				{Type: "int", Name: "mode"},
				{Type: "const unsigned long*", Name: "nodemask"},
				{Type: "unsigned long", Name: "maxnode"},
			},
		},
		events.GetMempolicy: {
			ID:      events.GetMempolicy,
			id32Bit: events.Sys32get_mempolicy,
			name:    "get_mempolicy",
			syscall: true,
			sets:    []string{"syscalls", "system", "system_numa"},
			params: []argMeta{
				{Type: "int*", Name: "mode"},
				{Type: "unsigned long*", Name: "nodemask"},
				{Type: "unsigned long", Name: "maxnode"},
				{Type: "void*", Name: "addr"},
				{Type: "unsigned long", Name: "flags"},
			},
		},
		events.MqOpen: {
			ID:      events.MqOpen,
			id32Bit: events.Sys32mq_open,
			name:    "mq_open",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_msgq"},
			params: []argMeta{
				{Type: "const char*", Name: "name"},
				{Type: "int", Name: "oflag"},
				{Type: "mode_t", Name: "mode"},
				{Type: "struct mq_attr*", Name: "attr"},
			},
		},
		events.MqUnlink: {
			ID:      events.MqUnlink,
			id32Bit: events.Sys32mq_unlink,
			name:    "mq_unlink",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_msgq"},
			params: []argMeta{
				{Type: "const char*", Name: "name"},
			},
		},
		events.MqTimedsend: {
			ID:      events.MqTimedsend,
			id32Bit: events.Sys32mq_timedsend_time64,
			name:    "mq_timedsend",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_msgq"},
			params: []argMeta{
				{Type: "mqd_t", Name: "mqdes"},
				{Type: "const char*", Name: "msg_ptr"},
				{Type: "size_t", Name: "msg_len"},
				{Type: "unsigned int", Name: "msg_prio"},
				{Type: "const struct timespec*", Name: "abs_timeout"},
			},
		},
		events.MqTimedreceive: {
			ID:      events.MqTimedreceive,
			id32Bit: events.Sys32mq_timedreceive_time64,
			name:    "mq_timedreceive",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_msgq"},
			params: []argMeta{
				{Type: "mqd_t", Name: "mqdes"},
				{Type: "char*", Name: "msg_ptr"},
				{Type: "size_t", Name: "msg_len"},
				{Type: "unsigned int*", Name: "msg_prio"},
				{Type: "const struct timespec*", Name: "abs_timeout"},
			},
		},
		events.MqNotify: {
			ID:      events.MqNotify,
			id32Bit: events.Sys32mq_notify,
			name:    "mq_notify",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_msgq"},
			params: []argMeta{
				{Type: "mqd_t", Name: "mqdes"},
				{Type: "const struct sigevent*", Name: "sevp"},
			},
		},
		events.MqGetsetattr: {
			ID:      events.MqGetsetattr,
			id32Bit: events.Sys32mq_getsetattr,
			name:    "mq_getsetattr",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_msgq"},
			params: []argMeta{
				{Type: "mqd_t", Name: "mqdes"},
				{Type: "const struct mq_attr*", Name: "newattr"},
				{Type: "struct mq_attr*", Name: "oldattr"},
			},
		},
		events.KexecLoad: {
			ID:      events.KexecLoad,
			id32Bit: events.Sys32kexec_load,
			name:    "kexec_load",
			syscall: true,
			sets:    []string{"syscalls", "system"},
			params: []argMeta{
				{Type: "unsigned long", Name: "entry"},
				{Type: "unsigned long", Name: "nr_segments"},
				{Type: "struct kexec_segment*", Name: "segments"},
				{Type: "unsigned long", Name: "flags"},
			},
		},
		events.Waitid: {
			ID:      events.Waitid,
			id32Bit: events.Sys32waitid,
			name:    "waitid",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_life"},
			params: []argMeta{
				{Type: "int", Name: "idtype"},
				{Type: "pid_t", Name: "id"},
				{Type: "struct siginfo*", Name: "infop"},
				{Type: "int", Name: "options"},
				{Type: "struct rusage*", Name: "rusage"},
			},
		},
		events.AddKey: {
			ID:      events.AddKey,
			id32Bit: events.Sys32add_key,
			name:    "add_key",
			syscall: true,
			sets:    []string{"syscalls", "system", "system_keys"},
			params: []argMeta{
				{Type: "const char*", Name: "type"},
				{Type: "const char*", Name: "description"},
				{Type: "const void*", Name: "payload"},
				{Type: "size_t", Name: "plen"},
				{Type: "key_serial_t", Name: "keyring"},
			},
		},
		events.RequestKey: {
			ID:      events.RequestKey,
			id32Bit: events.Sys32request_key,
			name:    "request_key",
			syscall: true,
			sets:    []string{"syscalls", "system", "system_keys"},
			params: []argMeta{
				{Type: "const char*", Name: "type"},
				{Type: "const char*", Name: "description"},
				{Type: "const char*", Name: "callout_info"},
				{Type: "key_serial_t", Name: "dest_keyring"},
			},
		},
		events.Keyctl: {
			ID:      events.Keyctl,
			id32Bit: events.Sys32keyctl,
			name:    "keyctl",
			syscall: true,
			sets:    []string{"syscalls", "system", "system_keys"},
			params: []argMeta{
				{Type: "int", Name: "operation"},
				{Type: "unsigned long", Name: "arg2"},
				{Type: "unsigned long", Name: "arg3"},
				{Type: "unsigned long", Name: "arg4"},
				{Type: "unsigned long", Name: "arg5"},
			},
		},
		events.IoprioSet: {
			ID:      events.IoprioSet,
			id32Bit: events.Sys32ioprio_set,
			name:    "ioprio_set",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_sched"},
			params: []argMeta{
				{Type: "int", Name: "which"},
				{Type: "int", Name: "who"},
				{Type: "int", Name: "ioprio"},
			},
		},
		events.IoprioGet: {
			ID:      events.IoprioGet,
			id32Bit: events.Sys32ioprio_get,
			name:    "ioprio_get",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_sched"},
			params: []argMeta{
				{Type: "int", Name: "which"},
				{Type: "int", Name: "who"},
			},
		},
		events.InotifyInit: {
			ID:      events.InotifyInit,
			id32Bit: events.Sys32inotify_init,
			name:    "inotify_init",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_monitor"},
			params:  []argMeta{},
		},
		events.InotifyAddWatch: {
			ID:      events.InotifyAddWatch,
			id32Bit: events.Sys32inotify_add_watch,
			name:    "inotify_add_watch",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_monitor"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "const char*", Name: "pathname"},
				{Type: "u32", Name: "mask"},
			},
		},
		events.InotifyRmWatch: {
			ID:      events.InotifyRmWatch,
			id32Bit: events.Sys32inotify_rm_watch,
			name:    "inotify_rm_watch",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_monitor"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "int", Name: "wd"},
			},
		},
		events.MigratePages: {
			ID:      events.MigratePages,
			id32Bit: events.Sys32migrate_pages,
			name:    "migrate_pages",
			syscall: true,
			sets:    []string{"syscalls", "system", "system_numa"},
			params: []argMeta{
				{Type: "int", Name: "pid"},
				{Type: "unsigned long", Name: "maxnode"},
				{Type: "const unsigned long*", Name: "old_nodes"},
				{Type: "const unsigned long*", Name: "new_nodes"},
			},
		},
		events.Openat: {
			ID:      events.Openat,
			id32Bit: events.Sys32openat,
			name:    "openat",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "int", Name: "dirfd"},
				{Type: "const char*", Name: "pathname"},
				{Type: "int", Name: "flags"},
				{Type: "mode_t", Name: "mode"},
			},
		},
		events.Mkdirat: {
			ID:      events.Mkdirat,
			id32Bit: events.Sys32mkdirat,
			name:    "mkdirat",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_dir_ops"},
			params: []argMeta{
				{Type: "int", Name: "dirfd"},
				{Type: "const char*", Name: "pathname"},
				{Type: "mode_t", Name: "mode"},
			},
		},
		events.Mknodat: {
			ID:      events.Mknodat,
			id32Bit: events.Sys32mknodat,
			name:    "mknodat",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "int", Name: "dirfd"},
				{Type: "const char*", Name: "pathname"},
				{Type: "mode_t", Name: "mode"},
				{Type: "dev_t", Name: "dev"},
			},
		},
		events.Fchownat: {
			ID:      events.Fchownat,
			id32Bit: events.Sys32fchownat,
			name:    "fchownat",
			syscall: true,
			sets:    []string{"default", "syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "int", Name: "dirfd"},
				{Type: "const char*", Name: "pathname"},
				{Type: "uid_t", Name: "owner"},
				{Type: "gid_t", Name: "group"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Futimesat: {
			ID:      events.Futimesat,
			id32Bit: events.Sys32futimesat,
			name:    "futimesat",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "int", Name: "dirfd"},
				{Type: "const char*", Name: "pathname"},
				{Type: "struct timeval*", Name: "times"},
			},
		},
		events.Newfstatat: {
			ID:      events.Newfstatat,
			id32Bit: events.Sys32fstatat64,
			name:    "newfstatat",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "int", Name: "dirfd"},
				{Type: "const char*", Name: "pathname"},
				{Type: "struct stat*", Name: "statbuf"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Unlinkat: {
			ID:      events.Unlinkat,
			id32Bit: events.Sys32unlinkat,
			name:    "unlinkat",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_link_ops"},
			params: []argMeta{
				{Type: "int", Name: "dirfd"},
				{Type: "const char*", Name: "pathname"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Renameat: {
			ID:      events.Renameat,
			id32Bit: events.Sys32renameat,
			name:    "renameat",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "int", Name: "olddirfd"},
				{Type: "const char*", Name: "oldpath"},
				{Type: "int", Name: "newdirfd"},
				{Type: "const char*", Name: "newpath"},
			},
		},
		events.Linkat: {
			ID:      events.Linkat,
			id32Bit: events.Sys32linkat,
			name:    "linkat",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_link_ops"},
			params: []argMeta{
				{Type: "int", Name: "olddirfd"},
				{Type: "const char*", Name: "oldpath"},
				{Type: "int", Name: "newdirfd"},
				{Type: "const char*", Name: "newpath"},
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.Symlinkat: {
			ID:      events.Symlinkat,
			id32Bit: events.Sys32symlinkat,
			name:    "symlinkat",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_link_ops"},
			params: []argMeta{
				{Type: "const char*", Name: "target"},
				{Type: "int", Name: "newdirfd"},
				{Type: "const char*", Name: "linkpath"},
			},
		},
		events.Readlinkat: {
			ID:      events.Readlinkat,
			id32Bit: events.Sys32readlinkat,
			name:    "readlinkat",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_link_ops"},
			params: []argMeta{
				{Type: "int", Name: "dirfd"},
				{Type: "const char*", Name: "pathname"},
				{Type: "char*", Name: "buf"},
				{Type: "int", Name: "bufsiz"},
			},
		},
		events.Fchmodat: {
			ID:      events.Fchmodat,
			id32Bit: events.Sys32fchmodat,
			name:    "fchmodat",
			syscall: true,
			sets:    []string{"default", "syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "int", Name: "dirfd"},
				{Type: "const char*", Name: "pathname"},
				{Type: "mode_t", Name: "mode"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Faccessat: {
			ID:      events.Faccessat,
			id32Bit: events.Sys32faccessat,
			name:    "faccessat",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "int", Name: "dirfd"},
				{Type: "const char*", Name: "pathname"},
				{Type: "int", Name: "mode"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Pselect6: {
			ID:      events.Pselect6,
			id32Bit: events.Sys32pselect6_time64,
			name:    "pselect6",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_mux_io"},
			params: []argMeta{
				{Type: "int", Name: "nfds"},
				{Type: "fd_set*", Name: "readfds"},
				{Type: "fd_set*", Name: "writefds"},
				{Type: "fd_set*", Name: "exceptfds"},
				{Type: "struct timespec*", Name: "timeout"},
				{Type: "void*", Name: "sigmask"},
			},
		},
		events.Ppoll: {
			ID:      events.Ppoll,
			id32Bit: events.Sys32ppoll_time64,
			name:    "ppoll",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_mux_io"},
			params: []argMeta{
				{Type: "struct pollfd*", Name: "fds"},
				{Type: "unsigned int", Name: "nfds"},
				{Type: "struct timespec*", Name: "tmo_p"},
				{Type: "const sigset_t*", Name: "sigmask"},
				{Type: "size_t", Name: "sigsetsize"},
			},
		},
		events.Unshare: {
			ID:      events.Unshare,
			id32Bit: events.Sys32unshare,
			name:    "unshare",
			syscall: true,
			sets:    []string{"syscalls", "proc"},
			params: []argMeta{
				{Type: "int", Name: "flags"},
			},
		},
		events.SetRobustList: {
			ID:      events.SetRobustList,
			id32Bit: events.Sys32set_robust_list,
			name:    "set_robust_list",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_futex"},
			params: []argMeta{
				{Type: "struct robust_list_head*", Name: "head"},
				{Type: "size_t", Name: "len"},
			},
		},
		events.GetRobustList: {
			ID:      events.GetRobustList,
			id32Bit: events.Sys32get_robust_list,
			name:    "get_robust_list",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_futex"},
			params: []argMeta{
				{Type: "int", Name: "pid"},
				{Type: "struct robust_list_head**", Name: "head_ptr"},
				{Type: "size_t*", Name: "len_ptr"},
			},
		},
		events.Splice: {
			ID:      events.Splice,
			id32Bit: events.Sys32splice,
			name:    "splice",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_pipe"},
			params: []argMeta{
				{Type: "int", Name: "fd_in"},
				{Type: "off_t*", Name: "off_in"},
				{Type: "int", Name: "fd_out"},
				{Type: "off_t*", Name: "off_out"},
				{Type: "size_t", Name: "len"},
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.Tee: {
			ID:      events.Tee,
			id32Bit: events.Sys32tee,
			name:    "tee",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_pipe"},
			params: []argMeta{
				{Type: "int", Name: "fd_in"},
				{Type: "int", Name: "fd_out"},
				{Type: "size_t", Name: "len"},
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.SyncFileRange: {
			ID:      events.SyncFileRange,
			id32Bit: events.Sys32sync_file_range,
			name:    "sync_file_range",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_sync"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "off_t", Name: "offset"},
				{Type: "off_t", Name: "nbytes"},
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.Vmsplice: {
			ID:      events.Vmsplice,
			id32Bit: events.Sys32vmsplice,
			name:    "vmsplice",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_pipe"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "const struct iovec*", Name: "iov"},
				{Type: "unsigned long", Name: "nr_segs"},
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.MovePages: {
			ID:      events.MovePages,
			id32Bit: events.Sys32move_pages,
			name:    "move_pages",
			syscall: true,
			sets:    []string{"syscalls", "system", "system_numa"},
			params: []argMeta{
				{Type: "int", Name: "pid"},
				{Type: "unsigned long", Name: "count"},
				{Type: "const void**", Name: "pages"},
				{Type: "const int*", Name: "nodes"},
				{Type: "int*", Name: "status"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Utimensat: {
			ID:      events.Utimensat,
			id32Bit: events.Sys32utimensat_time64,
			name:    "utimensat",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "int", Name: "dirfd"},
				{Type: "const char*", Name: "pathname"},
				{Type: "struct timespec*", Name: "times"},
				{Type: "int", Name: "flags"},
			},
		},
		events.EpollPwait: {
			ID:      events.EpollPwait,
			id32Bit: events.Sys32epoll_pwait,
			name:    "epoll_pwait",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_mux_io"},
			params: []argMeta{
				{Type: "int", Name: "epfd"},
				{Type: "struct epoll_event*", Name: "events"},
				{Type: "int", Name: "maxevents"},
				{Type: "int", Name: "timeout"},
				{Type: "const sigset_t*", Name: "sigmask"},
				{Type: "size_t", Name: "sigsetsize"},
			},
		},
		events.Signalfd: {
			ID:      events.Signalfd,
			id32Bit: events.Sys32signalfd,
			name:    "signalfd",
			syscall: true,
			sets:    []string{"syscalls", "signals"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "sigset_t*", Name: "mask"},
				{Type: "int", Name: "flags"},
			},
		},
		events.TimerfdCreate: {
			ID:      events.TimerfdCreate,
			id32Bit: events.Sys32timerfd_create,
			name:    "timerfd_create",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_timer"},
			params: []argMeta{
				{Type: "int", Name: "clockid"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Eventfd: {
			ID:      events.Eventfd,
			id32Bit: events.Sys32eventfd,
			name:    "eventfd",
			syscall: true,
			sets:    []string{"syscalls", "signals"},
			params: []argMeta{
				{Type: "unsigned int", Name: "initval"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Fallocate: {
			ID:      events.Fallocate,
			id32Bit: events.Sys32fallocate,
			name:    "fallocate",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "int", Name: "mode"},
				{Type: "off_t", Name: "offset"},
				{Type: "off_t", Name: "len"},
			},
		},
		events.TimerfdSettime: {
			ID:      events.TimerfdSettime,
			id32Bit: events.Sys32timerfd_settime64,
			name:    "timerfd_settime",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_timer"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "int", Name: "flags"},
				{Type: "const struct itimerspec*", Name: "new_value"},
				{Type: "struct itimerspec*", Name: "old_value"},
			},
		},
		events.TimerfdGettime: {
			ID:      events.TimerfdGettime,
			id32Bit: events.Sys32timerfd_gettime64,
			name:    "timerfd_gettime",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_timer"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "struct itimerspec*", Name: "curr_value"},
			},
		},
		events.Accept4: {
			ID:      events.Accept4,
			id32Bit: events.Sys32accept4,
			name:    "accept4",
			syscall: true,
			sets:    []string{"syscalls", "net", "net_sock"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "struct sockaddr*", Name: "addr"},
				{Type: "int*", Name: "addrlen"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Signalfd4: {
			ID:      events.Signalfd4,
			id32Bit: events.Sys32signalfd4,
			name:    "signalfd4",
			syscall: true,
			sets:    []string{"syscalls", "signals"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "const sigset_t*", Name: "mask"},
				{Type: "size_t", Name: "sizemask"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Eventfd2: {
			ID:      events.Eventfd2,
			id32Bit: events.Sys32eventfd2,
			name:    "eventfd2",
			syscall: true,
			sets:    []string{"syscalls", "signals"},
			params: []argMeta{
				{Type: "unsigned int", Name: "initval"},
				{Type: "int", Name: "flags"},
			},
		},
		events.EpollCreate1: {
			ID:      events.EpollCreate1,
			id32Bit: events.Sys32epoll_create1,
			name:    "epoll_create1",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_mux_io"},
			params: []argMeta{
				{Type: "int", Name: "flags"},
			},
		},
		events.Dup3: {
			ID:      events.Dup3,
			id32Bit: events.Sys32dup3,
			name:    "dup3",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_fd_ops"},
			params: []argMeta{
				{Type: "int", Name: "oldfd"},
				{Type: "int", Name: "newfd"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Pipe2: {
			ID:      events.Pipe2,
			id32Bit: events.Sys32pipe2,
			name:    "pipe2",
			syscall: true,
			sets:    []string{"syscalls", "ipc", "ipc_pipe"},
			params: []argMeta{
				{Type: "int[2]", Name: "pipefd"},
				{Type: "int", Name: "flags"},
			},
		},
		events.InotifyInit1: {
			ID:      events.InotifyInit1,
			id32Bit: events.Sys32inotify_init1,
			name:    "inotify_init1",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_monitor"},
			params: []argMeta{
				{Type: "int", Name: "flags"},
			},
		},
		events.Preadv: {
			ID:      events.Preadv,
			id32Bit: events.Sys32preadv,
			name:    "preadv",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_read_write"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "const struct iovec*", Name: "iov"},
				{Type: "unsigned long", Name: "iovcnt"},
				{Type: "unsigned long", Name: "pos_l"},
				{Type: "unsigned long", Name: "pos_h"},
			},
		},
		events.Pwritev: {
			ID:      events.Pwritev,
			id32Bit: events.Sys32pwritev,
			name:    "pwritev",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_read_write"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "const struct iovec*", Name: "iov"},
				{Type: "unsigned long", Name: "iovcnt"},
				{Type: "unsigned long", Name: "pos_l"},
				{Type: "unsigned long", Name: "pos_h"},
			},
		},
		events.RtTgsigqueueinfo: {
			ID:      events.RtTgsigqueueinfo,
			id32Bit: events.Sys32rt_tgsigqueueinfo,
			name:    "rt_tgsigqueueinfo",
			syscall: true,
			sets:    []string{"syscalls", "signals"},
			params: []argMeta{
				{Type: "pid_t", Name: "tgid"},
				{Type: "pid_t", Name: "tid"},
				{Type: "int", Name: "sig"},
				{Type: "siginfo_t*", Name: "info"},
			},
		},
		events.PerfEventOpen: {
			ID:      events.PerfEventOpen,
			id32Bit: events.Sys32perf_event_open,
			name:    "perf_event_open",
			syscall: true,
			sets:    []string{"syscalls", "system"},
			params: []argMeta{
				{Type: "struct perf_event_attr*", Name: "attr"},
				{Type: "pid_t", Name: "pid"},
				{Type: "int", Name: "cpu"},
				{Type: "int", Name: "group_fd"},
				{Type: "unsigned long", Name: "flags"},
			},
		},
		events.Recvmmsg: {
			ID:      events.Recvmmsg,
			id32Bit: events.Sys32recvmmsg_time64,
			name:    "recvmmsg",
			syscall: true,
			sets:    []string{"syscalls", "net", "net_snd_rcv"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "struct mmsghdr*", Name: "msgvec"},
				{Type: "unsigned int", Name: "vlen"},
				{Type: "int", Name: "flags"},
				{Type: "struct timespec*", Name: "timeout"},
			},
		},
		events.FanotifyInit: {
			ID:      events.FanotifyInit,
			id32Bit: events.Sys32fanotify_init,
			name:    "fanotify_init",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_monitor"},
			params: []argMeta{
				{Type: "unsigned int", Name: "flags"},
				{Type: "unsigned int", Name: "event_f_flags"},
			},
		},
		events.FanotifyMark: {
			ID:      events.FanotifyMark,
			id32Bit: events.Sys32fanotify_mark,
			name:    "fanotify_mark",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_monitor"},
			params: []argMeta{
				{Type: "int", Name: "fanotify_fd"},
				{Type: "unsigned int", Name: "flags"},
				{Type: "u64", Name: "mask"},
				{Type: "int", Name: "dirfd"},
				{Type: "const char*", Name: "pathname"},
			},
		},
		events.Prlimit64: {
			ID:      events.Prlimit64,
			id32Bit: events.Sys32prlimit64,
			name:    "prlimit64",
			syscall: true,
			sets:    []string{"syscalls", "proc"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
				{Type: "int", Name: "resource"},
				{Type: "const struct rlimit64*", Name: "new_limit"},
				{Type: "struct rlimit64*", Name: "old_limit"},
			},
		},
		events.NameToHandleAt: {
			ID:      events.NameToHandleAt,
			id32Bit: events.Sys32name_to_handle_at,
			name:    "name_to_handle_at",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "int", Name: "dirfd"},
				{Type: "const char*", Name: "pathname"},
				{Type: "struct file_handle*", Name: "handle"},
				{Type: "int*", Name: "mount_id"},
				{Type: "int", Name: "flags"},
			},
		},
		events.OpenByHandleAt: {
			ID:      events.OpenByHandleAt,
			id32Bit: events.Sys32open_by_handle_at,
			name:    "open_by_handle_at",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "int", Name: "mount_fd"},
				{Type: "struct file_handle*", Name: "handle"},
				{Type: "int", Name: "flags"},
			},
		},
		events.ClockAdjtime: {
			ID:      events.ClockAdjtime,
			id32Bit: events.Sys32clock_adjtime,
			name:    "clock_adjtime",
			syscall: true,
			sets:    []string{"syscalls", "time", "time_clock"},
			params: []argMeta{
				{Type: "const clockid_t", Name: "clk_id"},
				{Type: "struct timex*", Name: "buf"},
			},
		},
		events.Syncfs: {
			ID:      events.Syncfs,
			id32Bit: events.Sys32syncfs,
			name:    "syncfs",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_sync"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
			},
		},
		events.Sendmmsg: {
			ID:      events.Sendmmsg,
			id32Bit: events.Sys32sendmmsg,
			name:    "sendmmsg",
			syscall: true,
			sets:    []string{"syscalls", "net", "net_snd_rcv"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "struct mmsghdr*", Name: "msgvec"},
				{Type: "unsigned int", Name: "vlen"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Setns: {
			ID:      events.Setns,
			id32Bit: events.Sys32setns,
			name:    "setns",
			syscall: true,
			sets:    []string{"default", "syscalls", "proc"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "int", Name: "nstype"},
			},
		},
		events.Getcpu: {
			ID:      events.Getcpu,
			id32Bit: events.Sys32getcpu,
			name:    "getcpu",
			syscall: true,
			sets:    []string{"syscalls", "system", "system_numa"},
			params: []argMeta{
				{Type: "unsigned int*", Name: "cpu"},
				{Type: "unsigned int*", Name: "node"},
				{Type: "struct getcpu_cache*", Name: "tcache"},
			},
		},
		events.ProcessVmReadv: {
			ID:      events.ProcessVmReadv,
			id32Bit: events.Sys32process_vm_readv,
			name:    "process_vm_readv",
			syscall: true,
			sets:    []string{"default", "syscalls", "proc"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
				{Type: "const struct iovec*", Name: "local_iov"},
				{Type: "unsigned long", Name: "liovcnt"},
				{Type: "const struct iovec*", Name: "remote_iov"},
				{Type: "unsigned long", Name: "riovcnt"},
				{Type: "unsigned long", Name: "flags"},
			},
		},
		events.ProcessVmWritev: {
			ID:      events.ProcessVmWritev,
			id32Bit: events.Sys32process_vm_writev,
			name:    "process_vm_writev",
			syscall: true,
			sets:    []string{"default", "syscalls", "proc"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
				{Type: "const struct iovec*", Name: "local_iov"},
				{Type: "unsigned long", Name: "liovcnt"},
				{Type: "const struct iovec*", Name: "remote_iov"},
				{Type: "unsigned long", Name: "riovcnt"},
				{Type: "unsigned long", Name: "flags"},
			},
		},
		events.Kcmp: {
			ID:      events.Kcmp,
			id32Bit: events.Sys32kcmp,
			name:    "kcmp",
			syscall: true,
			sets:    []string{"syscalls", "proc"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid1"},
				{Type: "pid_t", Name: "pid2"},
				{Type: "int", Name: "type"},
				{Type: "unsigned long", Name: "idx1"},
				{Type: "unsigned long", Name: "idx2"},
			},
		},
		events.FinitModule: {
			ID:      events.FinitModule,
			id32Bit: events.Sys32finit_module,
			name:    "finit_module",
			syscall: true,
			sets:    []string{"default", "syscalls", "system", "system_module"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "const char*", Name: "param_values"},
				{Type: "int", Name: "flags"},
			},
		},
		events.SchedSetattr: {
			ID:      events.SchedSetattr,
			id32Bit: events.Sys32sched_setattr,
			name:    "sched_setattr",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_sched"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
				{Type: "struct sched_attr*", Name: "attr"},
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.SchedGetattr: {
			ID:      events.SchedGetattr,
			id32Bit: events.Sys32sched_getattr,
			name:    "sched_getattr",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_sched"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
				{Type: "struct sched_attr*", Name: "attr"},
				{Type: "unsigned int", Name: "size"},
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.Renameat2: {
			ID:      events.Renameat2,
			id32Bit: events.Sys32renameat2,
			name:    "renameat2",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "int", Name: "olddirfd"},
				{Type: "const char*", Name: "oldpath"},
				{Type: "int", Name: "newdirfd"},
				{Type: "const char*", Name: "newpath"},
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.Seccomp: {
			ID:      events.Seccomp,
			id32Bit: events.Sys32seccomp,
			name:    "seccomp",
			syscall: true,
			sets:    []string{"syscalls", "proc"},
			params: []argMeta{
				{Type: "unsigned int", Name: "operation"},
				{Type: "unsigned int", Name: "flags"},
				{Type: "const void*", Name: "args"},
			},
		},
		events.Getrandom: {
			ID:      events.Getrandom,
			id32Bit: events.Sys32getrandom,
			name:    "getrandom",
			syscall: true,
			sets:    []string{"syscalls", "fs"},
			params: []argMeta{
				{Type: "void*", Name: "buf"},
				{Type: "size_t", Name: "buflen"},
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.MemfdCreate: {
			ID:      events.MemfdCreate,
			id32Bit: events.Sys32memfd_create,
			name:    "memfd_create",
			syscall: true,
			sets:    []string{"default", "syscalls", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "const char*", Name: "name"},
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.KexecFileLoad: {
			ID:      events.KexecFileLoad,
			id32Bit: events.Sys32Undefined,
			name:    "kexec_file_load",
			syscall: true,
			sets:    []string{"syscalls", "system"},
			params: []argMeta{
				{Type: "int", Name: "kernel_fd"},
				{Type: "int", Name: "initrd_fd"},
				{Type: "unsigned long", Name: "cmdline_len"},
				{Type: "const char*", Name: "cmdline"},
				{Type: "unsigned long", Name: "flags"},
			},
		},
		events.Bpf: {
			ID:      events.Bpf,
			id32Bit: events.Sys32bpf,
			name:    "bpf",
			syscall: true,
			sets:    []string{"syscalls", "system"},
			params: []argMeta{
				{Type: "int", Name: "cmd"},
				{Type: "union bpf_attr*", Name: "attr"},
				{Type: "unsigned int", Name: "size"},
			},
		},
		events.Execveat: {
			ID:      events.Execveat,
			id32Bit: events.Sys32execveat,
			name:    "execveat",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_life"},
			params: []argMeta{
				{Type: "int", Name: "dirfd"},
				{Type: "const char*", Name: "pathname"},
				{Type: "const char*const*", Name: "argv"},
				{Type: "const char*const*", Name: "envp"},
				{Type: "int", Name: "flags"},
			},
			dependencies: dependencies{
				//tailCalls: []TailCall{
				//	{"sys_enter_init_tail", "sys_enter_init", []uint32{uint32(Execveat)}},
				//	{"sys_enter_submit_tail", "sys_enter_submit", []uint32{uint32(Execveat)}},
				//	{"sys_exit_init_tail", "sys_exit_init", []uint32{uint32(Execveat)}},
				//	{"sys_exit_submit_tail", "sys_exit_submit", []uint32{uint32(Execveat)}},
				//	{"sys_enter_tails", "syscall__execveat", []uint32{uint32(Execveat)}},
				//},
				tailCalls: []TailCall{
					{objs.SysEnterInitTail, objs.SysEnterInit, []uint32{uint32(events.Execve)}},
					{objs.SysEnterSubmitTail, objs.SysEnterSubmit, []uint32{uint32(events.Execve)}},
					{objs.SysExitInitTail, objs.SysExitInit, []uint32{uint32(events.Execve)}},
					{objs.SysExitSubmitTail, objs.SysExitSubmit, []uint32{uint32(events.Execve)}},
					{objs.SysEnterTails, objs.SyscallExecveat, []uint32{uint32(events.Execveat)}},
				},
			},
		},
		events.Userfaultfd: {
			ID:      events.Userfaultfd,
			id32Bit: events.Sys32userfaultfd,
			name:    "userfaultfd",
			syscall: true,
			sets:    []string{"syscalls", "system"},
			params: []argMeta{
				{Type: "int", Name: "flags"},
			},
		},
		events.Membarrier: {
			ID:      events.Membarrier,
			id32Bit: events.Sys32membarrier,
			name:    "membarrier",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_mem"},
			params: []argMeta{
				{Type: "int", Name: "cmd"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Mlock2: {
			ID:      events.Mlock2,
			id32Bit: events.Sys32mlock2,
			name:    "mlock2",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_mem"},
			params: []argMeta{
				{Type: "const void*", Name: "addr"},
				{Type: "size_t", Name: "len"},
				{Type: "int", Name: "flags"},
			},
		},
		events.CopyFileRange: {
			ID:      events.CopyFileRange,
			id32Bit: events.Sys32copy_file_range,
			name:    "copy_file_range",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_read_write"},
			params: []argMeta{
				{Type: "int", Name: "fd_in"},
				{Type: "off_t*", Name: "off_in"},
				{Type: "int", Name: "fd_out"},
				{Type: "off_t*", Name: "off_out"},
				{Type: "size_t", Name: "len"},
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.Preadv2: {
			ID:      events.Preadv2,
			id32Bit: events.Sys32preadv2,
			name:    "preadv2",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_read_write"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "const struct iovec*", Name: "iov"},
				{Type: "unsigned long", Name: "iovcnt"},
				{Type: "unsigned long", Name: "pos_l"},
				{Type: "unsigned long", Name: "pos_h"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Pwritev2: {
			ID:      events.Pwritev2,
			id32Bit: events.Sys32pwritev2,
			name:    "pwritev2",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_read_write"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "const struct iovec*", Name: "iov"},
				{Type: "unsigned long", Name: "iovcnt"},
				{Type: "unsigned long", Name: "pos_l"},
				{Type: "unsigned long", Name: "pos_h"},
				{Type: "int", Name: "flags"},
			},
		},
		events.PkeyMprotect: {
			ID:      events.PkeyMprotect,
			id32Bit: events.Sys32pkey_mprotect,
			name:    "pkey_mprotect",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_mem"},
			params: []argMeta{
				{Type: "void*", Name: "addr"},
				{Type: "size_t", Name: "len"},
				{Type: "int", Name: "prot"},
				{Type: "int", Name: "pkey"},
			},
		},
		events.PkeyAlloc: {
			ID:      events.PkeyAlloc,
			id32Bit: events.Sys32pkey_alloc,
			name:    "pkey_alloc",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_mem"},
			params: []argMeta{
				{Type: "unsigned int", Name: "flags"},
				{Type: "unsigned long", Name: "access_rights"},
			},
		},
		events.PkeyFree: {
			ID:      events.PkeyFree,
			id32Bit: events.Sys32pkey_free,
			name:    "pkey_free",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_mem"},
			params: []argMeta{
				{Type: "int", Name: "pkey"},
			},
		},
		events.Statx: {
			ID:      events.Statx,
			id32Bit: events.Sys32statx,
			name:    "statx",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "int", Name: "dirfd"},
				{Type: "const char*", Name: "pathname"},
				{Type: "int", Name: "flags"},
				{Type: "unsigned int", Name: "mask"},
				{Type: "struct statx*", Name: "statxbuf"},
			},
		},
		events.IoPgetevents: {
			ID:      events.IoPgetevents,
			id32Bit: events.Sys32io_pgetevents_time64,
			name:    "io_pgetevents",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_async_io"},
			params: []argMeta{
				{Type: "aio_context_t", Name: "ctx_id"},
				{Type: "long", Name: "min_nr"},
				{Type: "long", Name: "nr"},
				{Type: "struct io_event*", Name: "events"},
				{Type: "struct timespec*", Name: "timeout"},
				{Type: "const struct __aio_sigset*", Name: "usig"},
			},
		},
		events.Rseq: {
			ID:      events.Rseq,
			id32Bit: events.Sys32rseq,
			name:    "rseq",
			syscall: true,
			sets:    []string{"syscalls"},
			params: []argMeta{
				{Type: "struct rseq*", Name: "rseq"},
				{Type: "u32", Name: "rseq_len"},
				{Type: "int", Name: "flags"},
				{Type: "u32", Name: "sig"},
			},
		},
		events.PidfdSendSignal: {
			ID:      events.PidfdSendSignal,
			id32Bit: events.Sys32pidfd_send_signal,
			name:    "pidfd_send_signal",
			syscall: true,
			sets:    []string{"syscalls", "signals"},
			params: []argMeta{
				{Type: "int", Name: "pidfd"},
				{Type: "int", Name: "sig"},
				{Type: "siginfo_t*", Name: "info"},
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.IoUringSetup: {
			ID:      events.IoUringSetup,
			id32Bit: events.Sys32io_uring_setup,
			name:    "io_uring_setup",
			syscall: true,
			sets:    []string{"syscalls"},
			params: []argMeta{
				{Type: "unsigned int", Name: "entries"},
				{Type: "struct io_uring_params*", Name: "p"},
			},
		},
		events.IoUringEnter: {
			ID:      events.IoUringEnter,
			id32Bit: events.Sys32io_uring_enter,
			name:    "io_uring_enter",
			syscall: true,
			sets:    []string{"syscalls"},
			params: []argMeta{
				{Type: "unsigned int", Name: "fd"},
				{Type: "unsigned int", Name: "to_submit"},
				{Type: "unsigned int", Name: "min_complete"},
				{Type: "unsigned int", Name: "flags"},
				{Type: "sigset_t*", Name: "sig"},
			},
		},
		events.IoUringRegister: {
			ID:      events.IoUringRegister,
			id32Bit: events.Sys32io_uring_register,
			name:    "io_uring_register",
			syscall: true,
			sets:    []string{"syscalls"},
			params: []argMeta{
				{Type: "unsigned int", Name: "fd"},
				{Type: "unsigned int", Name: "opcode"},
				{Type: "void*", Name: "arg"},
				{Type: "unsigned int", Name: "nr_args"},
			},
		},
		events.OpenTree: {
			ID:      events.OpenTree,
			id32Bit: events.Sys32open_tree,
			name:    "open_tree",
			syscall: true,
			sets:    []string{"syscalls"},
			params: []argMeta{
				{Type: "int", Name: "dfd"},
				{Type: "const char*", Name: "filename"},
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.MoveMount: {
			ID:      events.MoveMount,
			id32Bit: events.Sys32move_mount,
			name:    "move_mount",
			syscall: true,
			sets:    []string{"default", "syscalls", "fs"},
			params: []argMeta{
				{Type: "int", Name: "from_dfd"},
				{Type: "const char*", Name: "from_path"},
				{Type: "int", Name: "to_dfd"},
				{Type: "const char*", Name: "to_path"},
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.Fsopen: {
			ID:      events.Fsopen,
			id32Bit: events.Sys32fsopen,
			name:    "fsopen",
			syscall: true,
			sets:    []string{"syscalls", "fs"},
			params: []argMeta{
				{Type: "const char*", Name: "fsname"},
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.Fsconfig: {
			ID:      events.Fsconfig,
			id32Bit: events.Sys32fsconfig,
			name:    "fsconfig",
			syscall: true,
			sets:    []string{"syscalls", "fs"},
			params: []argMeta{
				{Type: "int*", Name: "fs_fd"},
				{Type: "unsigned int", Name: "cmd"},
				{Type: "const char*", Name: "key"},
				{Type: "const void*", Name: "value"},
				{Type: "int", Name: "aux"},
			},
		},
		events.Fsmount: {
			ID:      events.Fsmount,
			id32Bit: events.Sys32fsmount,
			name:    "fsmount",
			syscall: true,
			sets:    []string{"syscalls", "fs"},
			params: []argMeta{
				{Type: "int", Name: "fsfd"},
				{Type: "unsigned int", Name: "flags"},
				{Type: "unsigned int", Name: "ms_flags"},
			},
		},
		events.Fspick: {
			ID:      events.Fspick,
			id32Bit: events.Sys32fspick,
			name:    "fspick",
			syscall: true,
			sets:    []string{"syscalls", "fs"},
			params: []argMeta{
				{Type: "int", Name: "dirfd"},
				{Type: "const char*", Name: "pathname"},
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.PidfdOpen: {
			ID:      events.PidfdOpen,
			id32Bit: events.Sys32pidfd_open,
			name:    "pidfd_open",
			syscall: true,
			sets:    []string{"syscalls"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.Clone3: {
			ID:      events.Clone3,
			id32Bit: events.Sys32clone3,
			name:    "clone3",
			syscall: true,
			sets:    []string{"syscalls", "proc", "proc_life"},
			params: []argMeta{
				{Type: "struct clone_args*", Name: "cl_args"},
				{Type: "size_t", Name: "size"},
			},
		},
		events.CloseRange: {
			ID:      events.CloseRange,
			id32Bit: events.Sys32close_range,
			name:    "close_range",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "unsigned int", Name: "first"},
				{Type: "unsigned int", Name: "last"},
			},
		},
		events.Openat2: {
			ID:      events.Openat2,
			id32Bit: events.Sys32openat2,
			name:    "openat2",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "int", Name: "dirfd"},
				{Type: "const char*", Name: "pathname"},
				{Type: "struct open_how*", Name: "how"},
				{Type: "size_t", Name: "size"},
			},
		},
		events.PidfdGetfd: {
			ID:      events.PidfdGetfd,
			id32Bit: events.Sys32pidfd_getfd,
			name:    "pidfd_getfd",
			syscall: true,
			sets:    []string{"syscalls"},
			params: []argMeta{
				{Type: "int", Name: "pidfd"},
				{Type: "int", Name: "targetfd"},
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.Faccessat2: {
			ID:      events.Faccessat2,
			id32Bit: events.Sys32faccessat2,
			name:    "faccessat2",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_file_attr"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "const char*", Name: "path"},
				{Type: "int", Name: "mode"},
				{Type: "int", Name: "flag"},
			},
		},
		events.ProcessMadvise: {
			ID:      events.ProcessMadvise,
			id32Bit: events.Sys32process_madvise,
			name:    "process_madvise",
			syscall: true,
			sets:    []string{"syscalls"},
			params: []argMeta{
				{Type: "int", Name: "pidfd"},
				{Type: "void*", Name: "addr"},
				{Type: "size_t", Name: "length"},
				{Type: "int", Name: "advice"},
				{Type: "unsigned long", Name: "flags"},
			},
		},
		events.EpollPwait2: {
			ID:      events.EpollPwait2,
			id32Bit: events.Sys32epoll_pwait2,
			name:    "epoll_pwait2",
			syscall: true,
			sets:    []string{"syscalls", "fs", "fs_mux_io"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "struct epoll_event*", Name: "events"},
				{Type: "int", Name: "maxevents"},
				{Type: "const struct timespec*", Name: "timeout"},
				{Type: "const sigset_t*", Name: "sigset"},
			},
		},
		events.MountSetatt: {
			ID:      events.MountSetatt,
			id32Bit: events.Sys32mount_setattr,
			name:    "mount_setattr",
			syscall: true,
			sets:    []string{"syscalls", "fs"},
			params: []argMeta{
				{Type: "int", Name: "dfd"},
				{Type: "char*", Name: "path"},
				{Type: "unsigned int", Name: "flags"},
				{Type: "struct mount_attr*", Name: "uattr"},
				{Type: "size_t", Name: "usize"},
			},
		},
		events.QuotactlFd: {
			ID:      events.QuotactlFd,
			id32Bit: events.Sys32quotactl_fd,
			name:    "quotactl_fd",
			syscall: true,
			sets:    []string{"syscalls", "fs"},
			params: []argMeta{
				{Type: "unsigned int", Name: "fd"},
				{Type: "unsigned int", Name: "cmd"},
				{Type: "qid_t", Name: "id"},
				{Type: "void *", Name: "addr"},
			},
		},
		events.LandlockCreateRuleset: {
			ID:      events.LandlockCreateRuleset,
			id32Bit: events.Sys32landlock_create_ruleset,
			name:    "landlock_create_ruleset",
			syscall: true,
			sets:    []string{"syscalls", "proc", "fs"},
			params: []argMeta{
				{Type: "struct landlock_ruleset_attr*", Name: "attr"},
				{Type: "size_t", Name: "size"},
				{Type: "u32", Name: "flags"},
			},
		},
		events.LandlockAddRule: {
			ID:      events.LandlockAddRule,
			id32Bit: events.Sys32landlock_add_rule,
			name:    "landlock_add_rule",
			syscall: true,
			sets:    []string{"syscalls", "proc", "fs"},
			params: []argMeta{
				{Type: "int", Name: "ruleset_fd"},
				{Type: "landlock_rule_type", Name: "rule_type"},
				{Type: "void*", Name: "rule_attr"},
				{Type: "u32", Name: "flags"},
			},
		},
		events.LandloclRestrictSet: {
			ID:      events.LandloclRestrictSet,
			id32Bit: events.Sys32landlock_restrict_self,
			name:    "landlock_restrict_self",
			syscall: true,
			sets:    []string{"syscalls", "proc", "fs"},
			params: []argMeta{
				{Type: "int", Name: "ruleset_fd"},
				{Type: "u32", Name: "flags"},
			},
		},
		events.MemfdSecret: {
			ID:      events.MemfdSecret,
			id32Bit: events.Sys32memfd_secret,
			name:    "memfd_secret",
			syscall: true,
			sets:    []string{"syscalls"},
			params: []argMeta{
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.ProcessMrelease: {
			ID:      events.ProcessMrelease,
			id32Bit: events.Sys32process_mrelease,
			name:    "process_mrelease",
			syscall: true,
			sets:    []string{"syscalls"},
			params: []argMeta{
				{Type: "int", Name: "pidfd"},
				{Type: "unsigned int", Name: "flags"},
			},
		},
		events.Waitpid: {
			ID:      events.Waitpid,
			id32Bit: events.Sys32waitpid,
			name:    "waitpid",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
				{Type: "int*", Name: "status"},
				{Type: "int", Name: "options"},
			},
		},
		events.Oldfstat: {
			ID:      events.Oldfstat,
			id32Bit: events.Sys32oldfstat,
			name:    "oldfstat",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.Break: {
			ID:      events.Break,
			id32Bit: events.Sys32break,
			name:    "break",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.Oldstat: {
			ID:      events.Oldstat,
			id32Bit: events.Sys32oldstat,
			name:    "oldstat",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "char*", Name: "filename"},
				{Type: "struct __old_kernel_stat*", Name: "statbuf"},
			},
		},
		events.Umount: {
			ID:      events.Umount,
			id32Bit: events.Sys32umount,
			name:    "umount",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "const char*", Name: "target"},
			},
		},
		events.Stime: {
			ID:      events.Stime,
			id32Bit: events.Sys32stime,
			name:    "stime",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "const time_t*", Name: "t"},
			},
		},
		events.Stty: {
			ID:      events.Stty,
			id32Bit: events.Sys32stty,
			name:    "stty",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.Gtty: {
			ID:      events.Gtty,
			id32Bit: events.Sys32gtty,
			name:    "gtty",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.Nice: {
			ID:      events.Nice,
			id32Bit: events.Sys32nice,
			name:    "nice",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "int", Name: "inc"},
			},
		},
		events.Ftime: {
			ID:      events.Ftime,
			id32Bit: events.Sys32ftime,
			name:    "ftime",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.Prof: {
			ID:      events.Prof,
			id32Bit: events.Sys32prof,
			name:    "prof",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.Signal: {
			ID:      events.Signal,
			id32Bit: events.Sys32signal,
			name:    "signal",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "int", Name: "signum"},
				{Type: "sighandler_t", Name: "handler"},
			},
		},
		events.Lock: {
			ID:      events.Lock,
			id32Bit: events.Sys32lock,
			name:    "lock",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.Mpx: {
			ID:      events.Mpx,
			id32Bit: events.Sys32mpx,
			name:    "mpx",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.Ulimit: {
			ID:      events.Ulimit,
			id32Bit: events.Sys32ulimit,
			name:    "ulimit",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.Oldolduname: {
			ID:      events.Oldolduname,
			id32Bit: events.Sys32oldolduname,
			name:    "oldolduname",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "struct oldold_utsname*", Name: "name"},
			},
		},
		events.Sigaction: {
			ID:      events.Sigaction,
			id32Bit: events.Sys32sigaction,
			name:    "sigaction",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "int", Name: "sig"},
				{Type: "const struct sigaction*", Name: "act"},
				{Type: "struct sigaction*", Name: "oact"},
			},
		},
		events.Sgetmask: {
			ID:      events.Sgetmask,
			id32Bit: events.Sys32sgetmask,
			name:    "sgetmask",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.Ssetmask: {
			ID:      events.Ssetmask,
			id32Bit: events.Sys32ssetmask,
			name:    "ssetmask",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "long", Name: "newmask"},
			},
		},
		events.Sigsuspend: {
			ID:      events.Sigsuspend,
			id32Bit: events.Sys32sigsuspend,
			name:    "sigsuspend",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "const sigset_t*", Name: "mask"},
			},
		},
		events.Sigpending: {
			ID:      events.Sigpending,
			id32Bit: events.Sys32sigpending,
			name:    "sigpending",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "sigset_t*", Name: "set"},
			},
		},
		events.Oldlstat: {
			ID:      events.Oldlstat,
			id32Bit: events.Sys32oldlstat,
			name:    "oldlstat",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "struct stat*", Name: "statbuf"},
			},
		},
		events.Readdir: {
			ID:      events.Readdir,
			id32Bit: events.Sys32readdir,
			name:    "readdir",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "unsigned int", Name: "fd"},
				{Type: "struct old_linux_dirent*", Name: "dirp"},
				{Type: "unsigned int", Name: "count"},
			},
		},
		events.Profil: {
			ID:      events.Profil,
			id32Bit: events.Sys32profil,
			name:    "profil",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.Socketcall: {
			ID:      events.Socketcall,
			id32Bit: events.Sys32socketcall,
			name:    "socketcall",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "int", Name: "call"},
				{Type: "unsigned long*", Name: "args"},
			},
		},
		events.Olduname: {
			ID:      events.Olduname,
			id32Bit: events.Sys32olduname,
			name:    "olduname",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "struct utsname*", Name: "buf"},
			},
		},
		events.Idle: {
			ID:      events.Idle,
			id32Bit: events.Sys32idle,
			name:    "idle",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.Vm86old: {
			ID:      events.Vm86old,
			id32Bit: events.Sys32vm86old,
			name:    "vm86old",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "struct vm86_struct*", Name: "info"},
			},
		},
		events.Ipc: {
			ID:      events.Ipc,
			id32Bit: events.Sys32ipc,
			name:    "ipc",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "unsigned int", Name: "call"},
				{Type: "int", Name: "first"},
				{Type: "unsigned long", Name: "second"},
				{Type: "unsigned long", Name: "third"},
				{Type: "void*", Name: "ptr"},
				{Type: "long", Name: "fifth"},
			},
		},
		events.Sigreturn: {
			ID:      events.Sigreturn,
			id32Bit: events.Sys32sigreturn,
			name:    "sigreturn",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.Sigprocmask: {
			ID:      events.Sigprocmask,
			id32Bit: events.Sys32sigprocmask,
			name:    "sigprocmask",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "int", Name: "how"},
				{Type: "const sigset_t *restrict", Name: "set"},
				{Type: "sigset_t *restrict", Name: "oldset"},
			},
		},
		events.Bdflush: {
			ID:      events.Bdflush,
			id32Bit: events.Sys32bdflush,
			name:    "bdflush",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.Afs_syscall: {
			ID:      events.Afs_syscall,
			id32Bit: events.Sys32afs_syscall,
			name:    "afs_syscall",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.Llseek: {
			ID:      events.Llseek,
			id32Bit: events.Sys32_llseek,
			name:    "llseek",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "unsigned int", Name: "fd"},
				{Type: "unsigned long", Name: "offset_high"},
				{Type: "unsigned long", Name: "offset_low"},
				{Type: "loff_t*", Name: "result"},
				{Type: "unsigned int", Name: "whence"},
			},
		},
		events.OldSelect: {
			ID:      events.OldSelect,
			id32Bit: events.Sys32select,
			name:    "old_select",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "int", Name: "nfds"},
				{Type: "fd_set*", Name: "readfds"},
				{Type: "fd_set*", Name: "writefds"},
				{Type: "fd_set*", Name: "exceptfds"},
				{Type: "struct timeval*", Name: "timeout"},
			},
		},
		events.Vm86: {
			ID:      events.Vm86,
			id32Bit: events.Sys32vm86,
			name:    "vm86",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "unsigned long", Name: "fn"},
				{Type: "struct vm86plus_struct*", Name: "v86"},
			},
		},
		events.OldGetrlimit: {
			ID:      events.OldGetrlimit,
			id32Bit: events.Sys32getrlimit,
			name:    "old_getrlimit",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "int", Name: "resource"},
				{Type: "struct rlimit*", Name: "rlim"},
			},
		},
		events.Mmap2: {
			ID:      events.Mmap2,
			id32Bit: events.Sys32mmap2,
			name:    "mmap2",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "unsigned long", Name: "addr"},
				{Type: "unsigned long", Name: "length"},
				{Type: "unsigned long", Name: "prot"},
				{Type: "unsigned long", Name: "flags"},
				{Type: "unsigned long", Name: "fd"},
				{Type: "unsigned long", Name: "pgoffset"},
			},
		},
		events.Truncate64: {
			ID:      events.Truncate64,
			id32Bit: events.Sys32truncate64,
			name:    "truncate64",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "const char*", Name: "path"},
				{Type: "off_t", Name: "length"},
			},
		},
		events.Ftruncate64: {
			ID:      events.Ftruncate64,
			id32Bit: events.Sys32ftruncate64,
			name:    "ftruncate64",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "off_t", Name: "length"},
			},
		},
		events.Stat64: {
			ID:      events.Stat64,
			id32Bit: events.Sys32stat64,
			name:    "stat64",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "struct stat64*", Name: "statbuf"},
			},
		},
		events.Lstat64: {
			ID:      events.Lstat64,
			id32Bit: events.Sys32lstat64,
			name:    "lstat64",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "struct stat64*", Name: "statbuf"},
			},
		},
		events.Fstat64: {
			ID:      events.Fstat64,
			id32Bit: events.Sys32fstat64,
			name:    "fstat64",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "struct stat64*", Name: "statbuf"},
			},
		},
		events.Lchown16: {
			ID:      events.Lchown16,
			id32Bit: events.Sys32lchown,
			name:    "lchown16",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "old_uid_t", Name: "owner"},
				{Type: "old_gid_t", Name: "group"},
			},
		},
		events.Getuid16: {
			ID:      events.Getuid16,
			id32Bit: events.Sys32getuid,
			name:    "getuid16",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.Getgid16: {
			ID:      events.Getgid16,
			id32Bit: events.Sys32getgid,
			name:    "getgid16",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.Geteuid16: {
			ID:      events.Geteuid16,
			id32Bit: events.Sys32geteuid,
			name:    "geteuid16",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.Getegid16: {
			ID:      events.Getegid16,
			id32Bit: events.Sys32getegid,
			name:    "getegid16",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.Setreuid16: {
			ID:      events.Setreuid16,
			id32Bit: events.Sys32setreuid,
			name:    "setreuid16",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "old_uid_t", Name: "ruid"},
				{Type: "old_uid_t", Name: "euid"},
			},
		},
		events.Setregid16: {
			ID:      events.Setregid16,
			id32Bit: events.Sys32setregid,
			name:    "setregid16",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "old_gid_t", Name: "rgid"},
				{Type: "old_gid_t", Name: "egid"},
			},
		},
		events.Getgroups16: {
			ID:      events.Getgroups16,
			id32Bit: events.Sys32getgroups,
			name:    "getgroups16",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "int", Name: "size"},
				{Type: "old_gid_t*", Name: "list"},
			},
		},
		events.Setgroups16: {
			ID:      events.Setgroups16,
			id32Bit: events.Sys32setgroups,
			name:    "setgroups16",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "size_t", Name: "size"},
				{Type: "const gid_t*", Name: "list"},
			},
		},
		events.Fchown16: {
			ID:      events.Fchown16,
			id32Bit: events.Sys32fchown,
			name:    "fchown16",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "unsigned int", Name: "fd"},
				{Type: "old_uid_t", Name: "user"},
				{Type: "old_gid_t", Name: "group"},
			},
		},
		events.Setresuid16: {
			ID:      events.Setresuid16,
			id32Bit: events.Sys32setresuid,
			name:    "setresuid16",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "old_uid_t", Name: "ruid"},
				{Type: "old_uid_t", Name: "euid"},
				{Type: "old_uid_t", Name: "suid"},
			},
		},
		events.Getresuid16: {
			ID:      events.Getresuid16,
			id32Bit: events.Sys32getresuid,
			name:    "getresuid16",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "old_uid_t*", Name: "ruid"},
				{Type: "old_uid_t*", Name: "euid"},
				{Type: "old_uid_t*", Name: "suid"},
			},
		},
		events.Setresgid16: {
			ID:      events.Setresgid16,
			id32Bit: events.Sys32setresgid,
			name:    "setresgid16",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "old_uid_t", Name: "rgid"},
				{Type: "old_uid_t", Name: "euid"},
				{Type: "old_uid_t", Name: "suid"},
			},
		},
		events.Getresgid16: {
			ID:      events.Getresgid16,
			id32Bit: events.Sys32getresgid,
			name:    "getresgid16",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "old_gid_t*", Name: "rgid"},
				{Type: "old_gid_t*", Name: "egid"},
				{Type: "old_gid_t*", Name: "sgid"},
			},
		},
		events.Chown16: {
			ID:      events.Chown16,
			id32Bit: events.Sys32chown,
			name:    "chown16",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "old_uid_t", Name: "owner"},
				{Type: "old_gid_t", Name: "group"},
			},
		},
		events.Setuid16: {
			ID:      events.Setuid16,
			id32Bit: events.Sys32setuid,
			name:    "setuid16",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "old_old_uid_t", Name: "uid"},
			},
		},
		events.Setgid16: {
			ID:      events.Setgid16,
			id32Bit: events.Sys32setgid,
			name:    "setgid16",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "old_gid_t", Name: "gid"},
			},
		},
		events.Setfsuid16: {
			ID:      events.Setfsuid16,
			id32Bit: events.Sys32setfsuid,
			name:    "setfsuid16",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "old_uid_t", Name: "fsuid"},
			},
		},
		events.Setfsgid16: {
			ID:      events.Setfsgid16,
			id32Bit: events.Sys32setfsgid,
			name:    "setfsgid16",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "old_gid_t", Name: "fsgid"},
			},
		},
		events.Fcntl64: {
			ID:      events.Fcntl64,
			id32Bit: events.Sys32fcntl64,
			name:    "fcntl64",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "int", Name: "cmd"},
				{Type: "unsigned long", Name: "arg"},
			},
		},
		events.Sendfile32: {
			ID:      events.Sendfile32,
			id32Bit: events.Sys32sendfile,
			name:    "sendfile32",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "int", Name: "out_fd"},
				{Type: "int", Name: "in_fd"},
				{Type: "off_t*", Name: "offset"},
				{Type: "size_t", Name: "count"},
			},
		},
		events.Statfs64: {
			ID:      events.Statfs64,
			id32Bit: events.Sys32statfs64,
			name:    "statfs64",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "const char*", Name: "path"},
				{Type: "size_t", Name: "sz"},
				{Type: "struct statfs64*", Name: "buf"},
			},
		},
		events.Fstatfs64: {
			ID:      events.Fstatfs64,
			id32Bit: events.Sys32fstatfs64,
			name:    "fstatfs64",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "size_t", Name: "sz"},
				{Type: "struct statfs64*", Name: "buf"},
			},
		},
		events.Fadvise64_64: {
			ID:      events.Fadvise64_64,
			id32Bit: events.Sys32fadvise64_64,
			name:    "fadvise64_64",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "loff_t", Name: "offset"},
				{Type: "loff_t", Name: "len"},
				{Type: "int", Name: "advice"},
			},
		},
		events.ClockGettime32: {
			ID:      events.ClockGettime32,
			id32Bit: events.Sys32clock_gettime,
			name:    "clock_gettime32",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "clockid_t", Name: "which_clock"},
				{Type: "struct old_timespec32*", Name: "tp"},
			},
		},
		events.ClockSettime32: {
			ID:      events.ClockSettime32,
			id32Bit: events.Sys32clock_settime,
			name:    "clock_settime32",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "clockid_t", Name: "which_clock"},
				{Type: "struct old_timespec32*", Name: "tp"},
			},
		},
		events.ClockAdjtime64: {
			ID:      events.ClockAdjtime64,
			id32Bit: events.Sys32clock_adjtime64,
			name:    "clock_adjtime64",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.ClockGetresTime32: {
			ID:      events.ClockGetresTime32,
			id32Bit: events.Sys32clock_getres,
			name:    "clock_getres_time32",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "clockid_t", Name: "which_clock"},
				{Type: "struct old_timespec32*", Name: "tp"},
			},
		},
		events.ClockNanosleepTime32: {
			ID:      events.ClockNanosleepTime32,
			id32Bit: events.Sys32clock_nanosleep,
			name:    "clock_nanosleep_time32",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "clockid_t", Name: "which_clock"},
				{Type: "int", Name: "flags"},
				{Type: "struct old_timespec32*", Name: "rqtp"},
				{Type: "struct old_timespec32*", Name: "rmtp"},
			},
		},
		events.TimerGettime32: {
			ID:      events.TimerGettime32,
			id32Bit: events.Sys32timer_gettime,
			name:    "timer_gettime32",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "timer_t", Name: "timer_id"},
				{Type: "struct old_itimerspec32*", Name: "setting"},
			},
		},
		events.TimerSettime32: {
			ID:      events.TimerSettime32,
			id32Bit: events.Sys32timer_settime,
			name:    "timer_settime32",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "timer_t", Name: "timer_id"},
				{Type: "int", Name: "flags"},
				{Type: "struct old_itimerspec32*", Name: "new"},
				{Type: "struct old_itimerspec32*", Name: "old"},
			},
		},
		events.TimerfdGettime32: {
			ID:      events.TimerfdGettime32,
			id32Bit: events.Sys32timerfd_gettime,
			name:    "timerfd_gettime32",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "int", Name: "ufd"},
				{Type: "struct old_itimerspec32*", Name: "otmr"},
			},
		},
		events.TimerfdSettime32: {
			ID:      events.TimerfdSettime32,
			id32Bit: events.Sys32timerfd_settime,
			name:    "timerfd_settime32",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "int", Name: "ufd"},
				{Type: "int", Name: "flags"},
				{Type: "struct old_itimerspec32*", Name: "utmr"},
				{Type: "struct old_itimerspec32*", Name: "otmr"},
			},
		},
		events.UtimensatTime32: {
			ID:      events.UtimensatTime32,
			id32Bit: events.Sys32utimensat,
			name:    "utimensat_time32",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "unsigned int", Name: "dfd"},
				{Type: "char*", Name: "filename"},
				{Type: "struct old_timespec32*", Name: "t"},
				{Type: "int", Name: "flags"},
			},
		},
		events.Pselect6Time32: {
			ID:      events.Pselect6Time32,
			id32Bit: events.Sys32pselect6,
			name:    "pselect6_time32",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "int", Name: "n"},
				{Type: "fd_set*", Name: "inp"},
				{Type: "fd_set*", Name: "outp"},
				{Type: "fd_set*", Name: "exp"},
				{Type: "struct old_timespec32*", Name: "tsp"},
				{Type: "void*", Name: "sig"},
			},
		},
		events.PpollTime32: {
			ID:      events.PpollTime32,
			id32Bit: events.Sys32ppoll,
			name:    "ppoll_time32",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "struct pollfd*", Name: "ufds"},
				{Type: "unsigned int", Name: "nfds"},
				{Type: "struct old_timespec32*", Name: "tsp"},
				{Type: "sigset_t*", Name: "sigmask"},
				{Type: "size_t", Name: "sigsetsize"},
			},
		},
		events.IoPgeteventsTime32: {
			ID:      events.IoPgeteventsTime32,
			id32Bit: events.Sys32io_pgetevents,
			name:    "io_pgetevents_time32",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params:  []argMeta{},
		},
		events.RecvmmsgTime32: {
			ID:      events.RecvmmsgTime32,
			id32Bit: events.Sys32recvmmsg,
			name:    "recvmmsg_time32",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "int", Name: "fd"},
				{Type: "struct mmsghdr*", Name: "mmsg"},
				{Type: "unsigned int", Name: "vlen"},
				{Type: "unsigned int", Name: "flags"},
				{Type: "struct old_timespec32*", Name: "timeout"},
			},
		},
		events.MqTimedsendTime32: {
			ID:      events.MqTimedsendTime32,
			id32Bit: events.Sys32mq_timedsend,
			name:    "mq_timedsend_time32",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "mqd_t", Name: "mqdes"},
				{Type: "char*", Name: "u_msg_ptr"},
				{Type: "unsigned int", Name: "msg_len"},
				{Type: "unsigned int", Name: "msg_prio"},
				{Type: "struct old_timespec32*", Name: "u_abs_timeout"},
			},
		},
		events.MqTimedreceiveTime32: {
			ID:      events.MqTimedreceiveTime32,
			id32Bit: events.Sys32mq_timedreceive,
			name:    "mq_timedreceive_time32",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "mqd_t", Name: "mqdes"},
				{Type: "char*", Name: "u_msg_ptr"},
				{Type: "unsigned int", Name: "msg_len"},
				{Type: "unsigned int*", Name: "u_msg_prio"},
				{Type: "struct old_timespec32*", Name: "u_abs_timeout"},
			},
		},
		events.RtSigtimedwaitTime32: {
			ID:      events.RtSigtimedwaitTime32,
			id32Bit: events.Sys32rt_sigtimedwait,
			name:    "rt_sigtimedwait_time32",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "sigset_t*", Name: "uthese"},
				{Type: "siginfo_t*", Name: "uinfo"},
				{Type: "struct old_timespec32*", Name: "uts"},
				{Type: "size_t", Name: "sigsetsize"},
			},
		},
		events.FutexTime32: {
			ID:      events.FutexTime32,
			id32Bit: events.Sys32futex,
			name:    "futex_time32",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "u32*", Name: "uaddr"},
				{Type: "int", Name: "op"},
				{Type: "u32", Name: "val"},
				{Type: "struct old_timespec32*", Name: "utime"},
				{Type: "u32*", Name: "uaddr2"},
				{Type: "u32", Name: "val3"},
			},
		},
		events.SchedRrGetInterval32: {
			ID:      events.SchedRrGetInterval32,
			id32Bit: events.Sys32sched_rr_get_interval,
			name:    "sched_rr_get_interval_time32",
			syscall: true,
			sets:    []string{"syscalls", "32bit_unique"},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
				{Type: "struct old_timespec32*", Name: "interval"},
			},
		},
		//
		// End of Syscalls
		//
		events.SysEnter: {
			ID:      events.SysEnter,
			id32Bit: events.Sys32Undefined,
			name:    "sys_enter",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSysEnter, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "int", Name: "syscall"},
			},
		},
		events.SysExit: {
			ID:      events.SysExit,
			id32Bit: events.Sys32Undefined,
			name:    "sys_exit",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSysExit, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "int", Name: "syscall"},
			},
		},
		events.SchedProcessFork: {
			ID:      events.SchedProcessFork,
			id32Bit: events.Sys32Undefined,
			name:    "sched_process_fork",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSchedProcessFork, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "int", Name: "parent_tid"},
				{Type: "int", Name: "parent_ns_tid"},
				{Type: "int", Name: "parent_pid"},
				{Type: "int", Name: "parent_ns_pid"},
				{Type: "int", Name: "child_tid"},
				{Type: "int", Name: "child_ns_tid"},
				{Type: "int", Name: "child_pid"},
				{Type: "int", Name: "child_ns_pid"},
				{Type: "unsigned long", Name: "start_time"},
			},
		},
		events.SchedProcessExec: {
			ID:      events.SchedProcessExec,
			id32Bit: events.Sys32Undefined,
			name:    "sched_process_exec",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSchedProcessExec, required: true},
					{handle: ProbeLoadElfPhdrs, required: false},
				},
				tailCalls: []TailCall{
					{
						objs.ProgArrayTp,
						objs.SchedProcessExecEventSubmitTail,
						[]uint32{TailSchedProcessExecEventSubmit},
					},
				},
				//capabilities: capabilities{
				//	base: []cap.Value{
				//		// 1. set by processSchedProcessFork IF ExecHash enabled
				//		// 2. set by processSchedProcessExec by CaptureExec if needed
				//		// cap.SYS_PTRACE,
				//	},
				//},
			},
			sets: []string{"default", "proc"},
			params: []argMeta{
				{Type: "const char*", Name: "cmdpath"},
				{Type: "const char*", Name: "pathname"},
				{Type: "dev_t", Name: "dev"},
				{Type: "unsigned long", Name: "inode"},
				{Type: "unsigned long", Name: "ctime"},
				{Type: "umode_t", Name: "inode_mode"},
				{Type: "const char*", Name: "interpreter_pathname"},
				{Type: "dev_t", Name: "interpreter_dev"},
				{Type: "unsigned long", Name: "interpreter_inode"},
				{Type: "unsigned long", Name: "interpreter_ctime"},
				{Type: "const char**", Name: "argv"},
				{Type: "const char*", Name: "interp"},
				{Type: "umode_t", Name: "stdin_type"},
				{Type: "char*", Name: "stdin_path"},
				{Type: "int", Name: "invoked_from_kernel"},
				{Type: "const char**", Name: "env"},
			},
		},
		events.SchedProcessExit: {
			ID:      events.SchedProcessExit,
			id32Bit: events.Sys32Undefined,
			name:    "sched_process_exit",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSchedProcessExit, required: true},
					{handle: ProbeSchedProcessFree, required: true},
				},
			},
			sets: []string{"proc", "proc_life"},
			params: []argMeta{
				{Type: "long", Name: "exit_code"},
				// The field value represents that all threads exited at the event time.
				// Multiple exits of threads of the same process group at the same time could result that all threads exit
				// events would have 'true' value in this field altogether.
				{Type: "bool", Name: "process_group_exit"},
			},
		},
		events.SchedSwitch: {
			ID:      events.SchedSwitch,
			id32Bit: events.Sys32Undefined,
			name:    "sched_switch",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSchedSwitch, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "int", Name: "cpu"},
				{Type: "int", Name: "prev_tid"},
				{Type: "const char*", Name: "prev_comm"},
				{Type: "int", Name: "next_tid"},
				{Type: "const char*", Name: "next_comm"},
			},
		},
		events.ProcessOomKilled: {
			ID:      events.ProcessOomKilled,
			id32Bit: events.Sys32Undefined,
			name:    "sched_process_exit",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSchedProcessExit, required: true},
					{handle: ProbeSchedProcessFree, required: true},
					{handle: ProbeOomMarkVictim, required: true},
				},
			},
			sets: []string{"proc", "proc_life"},
			params: []argMeta{
				{Type: "long", Name: "exit_code"},
				// The field value represents that all threads exited at the event time.
				// Multiple exits of threads of the same process group at the same time could result that all threads exit
				// events would have 'true' value in this field altogether.
				{Type: "bool", Name: "process_group_exit"},
			},
		},
		events.DoExit: {
			ID:      events.DoExit,
			id32Bit: events.Sys32Undefined,
			name:    "do_exit",
			dependencies: dependencies{
				probes: []EventProbe{{handle: ProbeDoExit, required: true}},
			},
			sets:   []string{"proc", "proc_life"},
			params: []argMeta{},
		},
		events.CapCapable: {
			ID:      events.CapCapable,
			id32Bit: events.Sys32Undefined,
			name:    "cap_capable",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeCapCapable, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "int", Name: "cap"},
			},
		},
		events.VfsWrite: {
			ID:      events.VfsWrite,
			id32Bit: events.Sys32Undefined,
			name:    "vfs_write",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeVfsWrite, required: true},
					{handle: ProbeVfsWriteRet, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "dev_t", Name: "dev"},
				{Type: "unsigned long", Name: "inode"},
				{Type: "size_t", Name: "count"},
				{Type: "off_t", Name: "pos"},
			},
		},
		events.VfsWritev: {
			ID:      events.VfsWritev,
			id32Bit: events.Sys32Undefined,
			name:    "vfs_writev",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeVfsWriteV, required: true},
					{handle: ProbeVfsWriteVRet, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "dev_t", Name: "dev"},
				{Type: "unsigned long", Name: "inode"},
				{Type: "unsigned long", Name: "vlen"},
				{Type: "off_t", Name: "pos"},
			},
		},
		events.MemProtAlert: {
			ID:      events.MemProtAlert,
			id32Bit: events.Sys32Undefined,
			name:    "mem_prot_alert",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecurityMmapAddr, required: true},
					{handle: ProbeSecurityFileMProtect, required: true},
					{handle: ProbeSyscallEnter__Internal, required: true},
				},
				tailCalls: []TailCall{
					{
						objs.SysEnterInitTail,
						objs.SysEnterInit,
						[]uint32{uint32(events.Mmap), uint32(events.Mprotect), uint32(events.PkeyMprotect)},
					},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "u32", Name: "alert"},
				{Type: "void*", Name: "addr"},
				{Type: "size_t", Name: "len"},
				{Type: "int", Name: "prot"},
				{Type: "int", Name: "prev_prot"},
				{Type: "const char*", Name: "pathname"},
				{Type: "dev_t", Name: "dev"},
				{Type: "unsigned long", Name: "inode"},
				{Type: "u64", Name: "ctime"},
			},
		},
		events.CommitCreds: {
			ID:      events.CommitCreds,
			id32Bit: events.Sys32Undefined,
			name:    "commit_creds",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeCommitCreds, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "slim_cred_t", Name: "old_cred"},
				{Type: "slim_cred_t", Name: "new_cred"},
			},
		},
		events.SwitchTaskNS: {
			ID:      events.SwitchTaskNS,
			id32Bit: events.Sys32Undefined,
			name:    "switch_task_ns",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSwitchTaskNS, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "pid_t", Name: "pid"},
				{Type: "u32", Name: "new_mnt"},
				{Type: "u32", Name: "new_pid"},
				{Type: "u32", Name: "new_uts"},
				{Type: "u32", Name: "new_ipc"},
				{Type: "u32", Name: "new_net"},
				{Type: "u32", Name: "new_cgroup"},
			},
		},
		events.MagicWrite: {
			ID:      events.MagicWrite,
			id32Bit: events.Sys32Undefined,
			name:    "magic_write",
			docPath: "security_alerts/magic_write.md",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeVfsWriteMagic, required: true},
					{handle: ProbeVfsWriteMagicRet, required: true},
					{handle: ProbeVfsWriteVMagic, required: false},
					{handle: ProbeVfsWriteVMagicRet, required: false},
					{handle: ProbeKernelWriteMagic, required: false},
					{handle: ProbeKernelWriteMagicRet, required: false},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "bytes", Name: "bytes"},
				{Type: "dev_t", Name: "dev"},
				{Type: "unsigned long", Name: "inode"},
			},
		},
		events.CgroupAttachTask: {
			ID:      events.CgroupAttachTask,
			id32Bit: events.Sys32Undefined,
			name:    "cgroup_attach_task",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeCgroupAttachTask, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "const char*", Name: "cgroup_path"},
				{Type: "const char*", Name: "comm"},
				{Type: "pid_t", Name: "pid"},
			},
		},
		events.CgroupMkdir: {
			ID:      events.CgroupMkdir,
			id32Bit: events.Sys32Undefined,
			name:    "cgroup_mkdir",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeCgroupMkdir, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "u64", Name: "cgroup_id"},
				{Type: "const char*", Name: "cgroup_path"},
				{Type: "u32", Name: "hierarchy_id"},
			},
		},
		events.CgroupRmdir: {
			ID:      events.CgroupRmdir,
			id32Bit: events.Sys32Undefined,
			name:    "security_bprm_check",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecurityBPRMCheck, required: true},
				},
			},
			sets: []string{"lsm_hooks", "proc", "proc_life"},
			params: []argMeta{
				{Type: "u64", Name: "cgroup_id"},
				{Type: "const char*", Name: "cgroup_path"},
				{Type: "u32", Name: "hierarchy_id"},
			},
		},
		events.SecurityFileOpen: {
			ID:      events.SecurityFileOpen,
			id32Bit: events.Sys32Undefined,
			name:    "security_file_open",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecurityFileOpen, required: true},
					{handle: ProbeSyscallEnter__Internal, required: true},
				},
				tailCalls: []TailCall{
					{
						objs.SysEnterInitTail,
						objs.SysEnterInit,
						[]uint32{
							uint32(events.Open), uint32(events.Openat), uint32(events.Openat2),
							uint32(events.OpenByHandleAt), uint32(events.Execve),
							uint32(events.Execveat),
						},
					},
				},
			},
			sets: []string{"lsm_hooks", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "int", Name: "flags"},
				{Type: "dev_t", Name: "dev"},
				{Type: "unsigned long", Name: "inode"},
				{Type: "unsigned long", Name: "ctime"},
				{Type: "const char*", Name: "syscall_pathname"},
			},
		},
		events.SecurityInodeUnlink: {
			ID:      events.SecurityInodeUnlink,
			id32Bit: events.Sys32Undefined,
			name:    "security_inode_unlink",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecurityInodeUnlink, required: true},
				},
			},
			sets: []string{"default", "lsm_hooks", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "unsigned long", Name: "inode"},
				{Type: "dev_t", Name: "dev"},
				{Type: "u64", Name: "ctime"},
			},
		},
		events.SecuritySocketCreate: {
			ID:      events.SecuritySocketCreate,
			id32Bit: events.Sys32Undefined,
			name:    "security_socket_create",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecuritySocketCreate, required: true},
				},
			},
			sets: []string{"lsm_hooks", "net", "net_sock"},
			params: []argMeta{
				{Type: "int", Name: "family"},
				{Type: "int", Name: "type"},
				{Type: "int", Name: "protocol"},
				{Type: "int", Name: "kern"},
			},
		},
		events.SecuritySocketListen: {
			ID:      events.SecuritySocketListen,
			id32Bit: events.Sys32Undefined,
			name:    "security_socket_listen",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecuritySocketListen, required: true},
					{handle: ProbeSyscallEnter__Internal, required: true},
				},
				tailCalls: []TailCall{
					{objs.SysEnterInitTail, objs.SysEnterInit, []uint32{uint32(events.Listen)}},
				},
			},
			sets: []string{"lsm_hooks", "net", "net_sock"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "struct sockaddr*", Name: "local_addr"},
				{Type: "int", Name: "backlog"},
			},
		},
		events.SecuritySocketConnect: {
			ID:      events.SecuritySocketConnect,
			id32Bit: events.Sys32Undefined,
			name:    "security_socket_connect",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecuritySocketConnect, required: true},
					{handle: ProbeSyscallEnter__Internal, required: true},
				},
				tailCalls: []TailCall{
					{
						objs.SysEnterInitTail,
						objs.SysEnterInit,
						[]uint32{uint32(events.Connect)}},
				},
			},
			sets: []string{"default", "lsm_hooks", "net", "net_sock"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "int", Name: "type"},
				{Type: "struct sockaddr*", Name: "remote_addr"},
			},
		},
		events.SecuritySocketAccept: {
			ID:      events.SecuritySocketAccept,
			id32Bit: events.Sys32Undefined,
			name:    "security_socket_accept",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecuritySocketAccept, required: true},
					{handle: ProbeSyscallEnter__Internal, required: true},
				},
				tailCalls: []TailCall{
					{objs.SysEnterInitTail, objs.SysEnterInit, []uint32{uint32(events.Accept), uint32(events.Accept4)}},
				},
			},
			sets: []string{"default", "lsm_hooks", "net", "net_sock"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "struct sockaddr*", Name: "local_addr"},
			},
		},
		events.SecuritySocketBind: {
			ID:      events.SecuritySocketBind,
			id32Bit: events.Sys32Undefined,
			name:    "security_socket_bind",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecuritySocketBind, required: true},
					{handle: ProbeSyscallEnter__Internal, required: true},
				},
				tailCalls: []TailCall{
					{
						objs.SysEnterInitTail,
						objs.SysEnterInit,
						[]uint32{uint32(events.Bind)}},
				},
			},
			sets: []string{"default", "lsm_hooks", "net", "net_sock"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "struct sockaddr*", Name: "local_addr"},
			},
		},
		events.SecuritySocketSetsockopt: {
			ID:      events.SecuritySocketSetsockopt,
			id32Bit: events.Sys32Undefined,
			name:    "security_socket_setsockopt",
			docPath: "lsm_hooks/security_socket_setsockopt.md",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecuritySocketSetsockopt, required: true},
					{handle: ProbeSyscallEnter__Internal, required: true},
				},
				tailCalls: []TailCall{
					{objs.SysEnterInitTail, objs.SysEnterInit, []uint32{uint32(events.Setsockopt)}},
				},
			},
			sets: []string{"lsm_hooks", "net", "net_sock"},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "int", Name: "level"},
				{Type: "int", Name: "optname"},
				{Type: "struct sockaddr*", Name: "local_addr"},
			},
		},
		events.SecuritySbMount: {
			ID:      events.SecuritySbMount,
			id32Bit: events.Sys32Undefined,
			name:    "security_sb_mount",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecuritySbMount, required: true},
				},
			},
			sets: []string{"default", "lsm_hooks", "fs"},
			params: []argMeta{
				{Type: "const char*", Name: "dev_name"},
				{Type: "const char*", Name: "path"},
				{Type: "const char*", Name: "type"},
				{Type: "unsigned long", Name: "flags"},
			},
		},
		events.SecurityBPF: {
			ID:      events.SecurityBPF,
			id32Bit: events.Sys32Undefined,
			name:    "security_bpf",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecurityBPF, required: true},
				},
			},
			sets: []string{"lsm_hooks"},
			params: []argMeta{
				{Type: "int", Name: "cmd"},
			},
		},
		events.SecurityBPFMap: {
			ID:      events.SecurityBPFMap,
			id32Bit: events.Sys32Undefined,
			name:    "security_bpf_map",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecurityBPFMap, required: true},
				},
			},
			sets: []string{"lsm_hooks"},
			params: []argMeta{
				{Type: "unsigned int", Name: "map_id"},
				{Type: "const char*", Name: "map_name"},
			},
		},
		events.SecurityKernelReadFile: {
			ID:      events.SecurityKernelReadFile,
			id32Bit: events.Sys32Undefined,
			name:    "security_kernel_read_file",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecurityKernelReadFile, required: true},
				},
			},
			sets: []string{"lsm_hooks"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "dev_t", Name: "dev"},
				{Type: "unsigned long", Name: "inode"},
				{Type: "int", Name: "type"},
				{Type: "unsigned long", Name: "ctime"},
			},
		},
		events.SecurityPostReadFile: {
			ID:      events.SecurityPostReadFile,
			id32Bit: events.Sys32Undefined,
			name:    "security_kernel_post_read_file",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecurityKernelPostReadFile, required: true},
				},
			},
			sets: []string{"lsm_hooks"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "long", Name: "size"},
				{Type: "int", Name: "type"},
			},
		},
		events.SecurityInodeMknod: {
			ID:      events.SecurityInodeMknod,
			id32Bit: events.Sys32Undefined,
			name:    "security_inode_mknod",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecurityInodeMknod, required: true},
				},
			},
			sets: []string{"lsm_hooks"},
			params: []argMeta{
				{Type: "const char*", Name: "file_name"},
				{Type: "umode_t", Name: "mode"},
				{Type: "dev_t", Name: "dev"},
			},
		},
		events.SecurityInodeSymlinkEventId: {
			ID:      events.SecurityInodeSymlinkEventId,
			id32Bit: events.Sys32Undefined,
			name:    "security_inode_symlink",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecurityInodeSymlink, required: true},
				},
			},
			sets: []string{"lsm_hooks", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "const char*", Name: "linkpath"},
				{Type: "const char*", Name: "target"},
			},
		},
		events.SecurityMmapFile: {
			ID:      events.SecurityMmapFile,
			id32Bit: events.Sys32Undefined,
			name:    "security_mmap_file",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecurityMmapFile, required: true},
				},
			},
			sets: []string{"lsm_hooks", "fs", "fs_file_ops", "proc", "proc_mem"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "int", Name: "flags"},
				{Type: "dev_t", Name: "dev"},
				{Type: "unsigned long", Name: "inode"},
				{Type: "unsigned long", Name: "ctime"},
				{Type: "unsigned long", Name: "prot"},
				{Type: "unsigned long", Name: "mmap_flags"},
			},
		},
		events.DoMmap: {
			ID:      events.DoMmap,
			id32Bit: events.Sys32Undefined,
			name:    "do_mmap",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeDoMmap, required: true},
					{handle: ProbeDoMmapRet, required: true},
				},
			},
			sets: []string{"fs", "fs_file_ops", "proc", "proc_mem"},
			params: []argMeta{
				{Type: "void*", Name: "addr"},
				{Type: "const char*", Name: "pathname"},
				{Type: "unsigned int", Name: "flags"},
				{Type: "dev_t", Name: "dev"},
				{Type: "unsigned long", Name: "inode"},
				{Type: "unsigned long", Name: "ctime"},
				{Type: "unsigned long", Name: "pgoff"},
				{Type: "unsigned long", Name: "len"},
				{Type: "unsigned long", Name: "prot"},
				{Type: "unsigned long", Name: "mmap_flags"},
			},
		},
		events.SecurityFileMprotect: {
			ID:      events.SecurityFileMprotect,
			id32Bit: events.Sys32Undefined,
			name:    "security_file_mprotect",
			docPath: "lsm_hooks/security_file_mprotect.md",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecurityFileMProtect, required: true},
					{handle: ProbeSyscallEnter__Internal, required: true},
				},
				tailCalls: []TailCall{
					{objs.SysEnterInitTail, objs.SysEnterInit, []uint32{uint32(events.Mprotect), uint32(events.PkeyMprotect)}},
				},
			},
			sets: []string{"lsm_hooks", "proc", "proc_mem", "fs", "fs_file_ops"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "int", Name: "prot"},
				{Type: "unsigned long", Name: "ctime"},
				{Type: "int", Name: "prev_prot"},
				{Type: "void*", Name: "addr"},
				{Type: "size_t", Name: "len"},
				{Type: "int", Name: "pkey"},
			},
		},
		events.InitNamespaces: {
			ID:           events.InitNamespaces,
			id32Bit:      events.Sys32Undefined,
			name:         "init_namespaces",
			sets:         []string{},
			dependencies: dependencies{
				//capabilities: capabilities{
				//	base: []cap.Value{
				//		cap.SYS_PTRACE,
				//	},
				//},
			},
			params: []argMeta{
				{Type: "u32", Name: "cgroup"},
				{Type: "u32", Name: "ipc"},
				{Type: "u32", Name: "mnt"},
				{Type: "u32", Name: "net"},
				{Type: "u32", Name: "pid"},
				{Type: "u32", Name: "pid_for_children"},
				{Type: "u32", Name: "time"},
				{Type: "u32", Name: "time_for_children"},
				{Type: "u32", Name: "user"},
				{Type: "u32", Name: "uts"},
			},
		},
		events.SocketDup: {
			ID:      events.SocketDup,
			id32Bit: events.Sys32Undefined,
			name:    "socket_dup",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSyscallEnter__Internal, required: true},
					{handle: ProbeSyscallExit__Internal, required: true},
				},
				tailCalls: []TailCall{
					{objs.SysEnterInitTail, objs.SysEnterInit, []uint32{uint32(events.Dup), uint32(events.Dup2), uint32(events.Dup3)}},
					{objs.SysExitInitTail, objs.SysExitInit, []uint32{uint32(events.Dup), uint32(events.Dup2), uint32(events.Dup3)}},
					{objs.SysExitTails, objs.SysDupExitTail, []uint32{uint32(events.Dup), uint32(events.Dup2), uint32(events.Dup3)}},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "int", Name: "oldfd"},
				{Type: "int", Name: "newfd"},
				{Type: "struct sockaddr*", Name: "remote_addr"},
			},
		},
		events.HiddenInodes: {
			ID:      events.HiddenInodes,
			id32Bit: events.Sys32Undefined,
			name:    "hidden_inodes",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeFilldir64, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "char*", Name: "hidden_process"},
			},
		},
		events.KernelWrite: {
			ID:      events.KernelWrite,
			id32Bit: events.Sys32Undefined,
			name:    "__kernel_write",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeKernelWrite, required: true},
					{handle: ProbeKernelWriteRet, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "dev_t", Name: "dev"},
				{Type: "unsigned long", Name: "inode"},
				{Type: "size_t", Name: "count"},
				{Type: "off_t", Name: "pos"},
			},
		},
		events.DirtyPipeSplice: {
			ID:      events.DirtyPipeSplice,
			id32Bit: events.Sys32Undefined,
			name:    "dirty_pipe_splice",
			sets:    []string{},
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeDoSplice, required: true},
					{handle: ProbeDoSpliceRet, required: true},
				},
				kSymbols: []KSymbol{
					{symbol: "pipe_write", required: true},
				},
			},
			params: []argMeta{
				{Type: "unsigned long", Name: "inode_in"},
				{Type: "umode_t", Name: "in_file_type"},
				{Type: "const char*", Name: "in_file_path"},
				{Type: "loff_t", Name: "exposed_data_start_offset"},
				{Type: "size_t", Name: "exposed_data_len"},
				{Type: "unsigned long", Name: "inode_out"},
				{Type: "unsigned int", Name: "out_pipe_last_buffer_flags"},
			},
		},
		events.ContainerCreate: {
			ID:      events.ContainerCreate,
			id32Bit: events.Sys32Undefined,
			name:    "container_create",
			dependencies: dependencies{
				ids: []events.ID{events.CgroupMkdir},
			},
			sets: []string{"default", "containers"},
			params: []argMeta{
				{Type: "const char*", Name: "runtime"},
				{Type: "const char*", Name: "container_id"},
				{Type: "unsigned long", Name: "ctime"},
				{Type: "const char*", Name: "container_image"},
				{Type: "const char*", Name: "container_image_digest"},
				{Type: "const char*", Name: "container_name"},
				{Type: "const char*", Name: "pod_name"},
				{Type: "const char*", Name: "pod_namespace"},
				{Type: "const char*", Name: "pod_uid"},
				{Type: "bool", Name: "pod_sandbox"},
			},
		},
		events.ContainerRemove: {
			ID:      events.ContainerRemove,
			id32Bit: events.Sys32Undefined,
			name:    "container_remove",
			dependencies: dependencies{
				ids: []events.ID{events.CgroupRmdir},
			},
			sets: []string{"default", "containers"},
			params: []argMeta{
				{Type: "const char*", Name: "runtime"},
				{Type: "const char*", Name: "container_id"},
			},
		},
		events.ExistingContainer: {
			ID:      events.ExistingContainer,
			id32Bit: events.Sys32Undefined,
			name:    "existing_container",
			sets:    []string{"containers"},
			params: []argMeta{
				{Type: "const char*", Name: "runtime"},
				{Type: "const char*", Name: "container_id"},
				{Type: "unsigned long", Name: "ctime"},
				{Type: "const char*", Name: "container_image"},
				{Type: "const char*", Name: "container_image_digest"},
				{Type: "const char*", Name: "container_name"},
				{Type: "const char*", Name: "pod_name"},
				{Type: "const char*", Name: "pod_namespace"},
				{Type: "const char*", Name: "pod_uid"},
				{Type: "bool", Name: "pod_sandbox"},
			},
		},
		events.ProcCreate: {
			ID:      events.ProcCreate,
			id32Bit: events.Sys32Undefined,
			name:    "proc_create",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeProcCreate, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "char*", Name: "name"},
				{Type: "void*", Name: "proc_ops_addr"},
			},
		},
		events.KprobeAttach: {
			ID:      events.KprobeAttach,
			id32Bit: events.Sys32Undefined,
			name:    "kprobe_attach",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeRegisterKprobe, required: true},
					{handle: ProbeRegisterKprobeRet, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "char*", Name: "symbol_name"},
				{Type: "void*", Name: "pre_handler_addr"},
				{Type: "void*", Name: "post_handler_addr"},
			},
		},
		events.CallUsermodeHelper: {
			ID:      events.CallUsermodeHelper,
			id32Bit: events.Sys32Undefined,
			name:    "call_usermodehelper",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeCallUsermodeHelper, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "const char*const*", Name: "argv"},
				{Type: "const char*const*", Name: "envp"},
				{Type: "int", Name: "wait"},
			},
		},
		events.DebugfsCreateFile: {
			ID:      events.DebugfsCreateFile,
			id32Bit: events.Sys32Undefined,
			name:    "debugfs_create_file",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeDebugfsCreateFile, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "const char*", Name: "file_name"},
				{Type: "const char*", Name: "path"},
				{Type: "mode_t", Name: "mode"},
				{Type: "void*", Name: "proc_ops_addr"},
			},
		},
		events.PrintSyscallTable: {
			ID:       events.PrintSyscallTable,
			id32Bit:  events.Sys32Undefined,
			name:     "print_syscall_table",
			internal: true,
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbePrintSyscallTable, required: true},
				},
				kSymbols: []KSymbol{
					{symbol: "sys_call_table", required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "unsigned long[]", Name: "syscalls_addresses"},
				{Type: "unsigned long", Name: "caller_context_id"},
			},
		},
		events.HiddenKernelModule: {
			ID:      events.HiddenKernelModule,
			id32Bit: events.Sys32Undefined,
			name:    "hidden_kernel_module",
			dependencies: dependencies{
				ids: []events.ID{
					events.HiddenKernelModuleSeeker,
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "const char*", Name: "address"},
				{Type: "const char*", Name: "name"},
				{Type: "const char*", Name: "srcversion"},
			},
		},
		events.HiddenKernelModuleSeeker: {
			ID:       events.HiddenKernelModuleSeeker,
			id32Bit:  events.Sys32Undefined,
			name:     "hidden_kernel_module_seeker",
			internal: true,
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeHiddenKernelModuleSeeker, required: true},
					{handle: ProbeHiddenKernelModuleVerifier, required: true},
					{handle: ProbeModuleLoad, required: true},
					{handle: ProbeModuleFree, required: true},
					{handle: ProbeDoInitModule, required: true},
					{handle: ProbeDoInitModuleRet, required: true},
					{handle: ProbeLayoutAndAllocate, required: true},
				},
				kSymbols: []KSymbol{
					{symbol: "modules", required: true},
					{symbol: "module_kset", required: true},
					{symbol: "mod_tree", required: true},
				},
				tailCalls: []TailCall{
					// {objs.ProgArray, objs.LkmSeekerProcTail, []uint32{TailHiddenKernelModuleProc}},
					// {objs.ProgArray, objs.LkmSeekerKsetTail, []uint32{TailHiddenKernelModuleKset}},
					// {objs.ProgArray, objs.LkmSeekerModTreeTail, []uint32{TailHiddenKernelModuleModTree}},
					// {objs.ProgArray, objs.LkmSeekerNewModOnlyTail, []uint32{TailHiddenKernelModuleNewModOnly}},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "unsigned long", Name: "address"},
				{Type: "bytes", Name: "name"},
				{Type: "unsigned int", Name: "flags"},
				{Type: "bytes", Name: "srcversion"},
			},
		},
		events.HookedSyscalls: {
			ID:      events.HookedSyscalls,
			id32Bit: events.Sys32Undefined,
			name:    "hooked_syscalls",
			dependencies: dependencies{
				kSymbols: []KSymbol{
					{symbol: "_stext", required: true},
					{symbol: "_etext", required: true},
				},
				ids: []events.ID{
					events.DoInitModule,
					events.PrintSyscallTable,
				},
				//capabilities: capabilities{
				//	base: []cap.Value{
				//		cap.SYSLOG, // read /proc/kallsyms
				//	},
				//},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "[]char*", Name: "check_syscalls"},
				{Type: "[]trace.HookedSymbolData", Name: "hooked_syscalls"},
			},
		},
		events.DebugfsCreateDir: {
			ID:      events.DebugfsCreateDir,
			id32Bit: events.Sys32Undefined,
			name:    "debugfs_create_dir",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeDebugfsCreateDir, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "const char*", Name: "name"},
				{Type: "const char*", Name: "path"},
			},
		},
		events.DeviceAdd: {
			ID:      events.DeviceAdd,
			id32Bit: events.Sys32Undefined,
			name:    "device_add",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeDeviceAdd, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "const char*", Name: "name"},
				{Type: "const char*", Name: "parent_name"},
			},
		},
		events.RegisterChrdev: {
			ID:      events.RegisterChrdev,
			id32Bit: events.Sys32Undefined,
			name:    "register_chrdev",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeRegisterChrdev, required: true},
					{handle: ProbeRegisterChrdevRet, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "unsigned int", Name: "requested_major_number"},
				{Type: "unsigned int", Name: "granted_major_number"},
				{Type: "const char*", Name: "char_device_name"},
				{Type: "struct file_operations *", Name: "char_device_fops"},
			},
		},
		events.SharedObjectLoaded: {
			ID:      events.SharedObjectLoaded,
			id32Bit: events.Sys32Undefined,
			name:    "shared_object_loaded",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecurityMmapFile, required: true},
				},
				//capabilities: capabilities{
				//	base: []cap.Value{
				//		cap.SYS_PTRACE, // loadSharedObjectDynamicSymbols()
				//	},
				//},
			},
			sets: []string{"lsm_hooks", "fs", "fs_file_ops", "proc", "proc_mem"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "int", Name: "flags"},
				{Type: "dev_t", Name: "dev"},
				{Type: "unsigned long", Name: "inode"},
				{Type: "unsigned long", Name: "ctime"},
			},
		},
		events.SymbolsLoaded: {
			ID:      events.SymbolsLoaded,
			id32Bit: events.Sys32Undefined,
			name:    "symbols_loaded",
			docPath: "security_alerts/symbols_load.md",
			dependencies: dependencies{
				ids: []events.ID{
					events.SharedObjectLoaded,
					events.SchedProcessExec, // Used to get mount namespace cache
				},
			},
			sets: []string{"derived", "fs", "security_alert"},
			params: []argMeta{
				{Type: "const char*", Name: "library_path"},
				{Type: "const char*const*", Name: "symbols"},
			},
		},
		events.SymbolsCollision: {
			ID:      events.SymbolsCollision,
			id32Bit: events.Sys32Undefined,
			name:    "symbols_collision",
			docPath: "security_alerts/symbols_collision.md",
			dependencies: dependencies{
				ids: []events.ID{
					events.SharedObjectLoaded,
					events.SchedProcessExec, // Used to get mount namespace cache
				},
			},
			sets: []string{"lsm_hooks", "fs", "fs_file_ops", "proc", "proc_mem"},
			params: []argMeta{
				{Type: "const char*", Name: "loaded_path"},
				{Type: "const char*", Name: "collision_path"},
				{Type: "const char*const*", Name: "symbols"},
			},
		},
		events.CaptureFileWrite: {
			ID:       events.CaptureFileWrite,
			id32Bit:  events.Sys32Undefined,
			name:     "capture_file_write",
			internal: true,
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeVfsWrite, required: true},
					{handle: ProbeVfsWriteRet, required: true},
					{handle: ProbeVfsWriteV, required: false},
					{handle: ProbeVfsWriteVRet, required: false},
					{handle: ProbeKernelWrite, required: false},
					{handle: ProbeKernelWriteRet, required: false},
				},
				tailCalls: []TailCall{
					{objs.ProgArray, objs.TraceRetVfsWriteTail, []uint32{TailVfsWrite}},
					{objs.ProgArray, objs.TraceRetVfsWritevTail, []uint32{TailVfsWritev}},
					{objs.ProgArray, objs.TraceRetKernelWriteTail, []uint32{TailKernelWrite}},
					{objs.ProgArray, objs.SendBin, []uint32{TailSendBin}},
				},
				kSymbols: []KSymbol{
					{symbol: "pipe_write", required: true},
				},
			},
		},
		events.CaptureFileRead: {
			ID:       events.CaptureFileRead,
			id32Bit:  events.Sys32Undefined,
			name:     "capture_file_read",
			internal: true,
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeVfsRead, required: true},
					{handle: ProbeVfsReadRet, required: true},
					{handle: ProbeVfsReadV, required: false},
					{handle: ProbeVfsReadVRet, required: false},
				},
				tailCalls: []TailCall{
					{objs.ProgArray, objs.TraceRetVfsReadTail, []uint32{TailVfsRead}},
					{objs.ProgArray, objs.TraceRetVfsReadvTail, []uint32{TailVfsReadv}},
					{objs.ProgArray, objs.SendBin, []uint32{TailSendBin}},
				},
				kSymbols: []KSymbol{
					{symbol: "pipe_write", required: true},
				},
			},
		},
		events.CaptureExec: {
			ID:       events.CaptureExec,
			id32Bit:  events.Sys32Undefined,
			name:     "capture_exec",
			internal: true,
			dependencies: dependencies{
				ids: []events.ID{
					events.SchedProcessExec,
				},
				//capabilities: capabilities{
				//	base: []cap.Value{
				//		cap.SYS_PTRACE, // processSchedProcessExec() performance
				//	},
				//},
			},
		},
		events.CaptureModule: {
			ID:       events.CaptureModule,
			id32Bit:  events.Sys32Undefined,
			name:     "capture_module",
			internal: true,
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSyscallEnter__Internal, required: true},
					{handle: ProbeSyscallExit__Internal, required: true},
					{handle: ProbeSecurityKernelPostReadFile, required: true},
				},
				ids: []events.ID{
					events.SchedProcessExec,
				},
				tailCalls: []TailCall{
					{objs.SysEnterTails, objs.SyscallInitModule, []uint32{uint32(events.InitModule)}},
					{objs.ProgArrayTp, objs.SendBinTp, []uint32{TailSendBinTP}},
					{objs.ProgArray, objs.SendBin, []uint32{TailSendBin}},
				},
			},
		},
		events.CaptureMem: {
			ID:       events.CaptureMem,
			id32Bit:  events.Sys32Undefined,
			name:     "capture_mem",
			internal: true,
			dependencies: dependencies{
				tailCalls: []TailCall{
					{objs.ProgArray, objs.SendBin, []uint32{TailSendBin}},
				},
			},
		},
		events.CaptureBpf: {
			ID:       events.CaptureBpf,
			id32Bit:  events.Sys32Undefined,
			name:     "capture_bpf",
			internal: true,
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecurityBPF, required: true},
				},
				tailCalls: []TailCall{
					{objs.ProgArray, objs.SendBin, []uint32{TailSendBin}},
				},
			},
		},
		events.DoInitModule: {
			ID:      events.DoInitModule,
			id32Bit: events.Sys32Undefined,
			name:    "do_init_module",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeDoInitModule, required: true},
					{handle: ProbeDoInitModuleRet, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "const char*", Name: "name"},
				{Type: "const char*", Name: "version"},
				{Type: "const char*", Name: "src_version"},
			},
		},
		events.ModuleLoad: {
			ID:      events.ModuleLoad,
			id32Bit: events.Sys32Undefined,
			name:    "module_load",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeModuleLoad, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "const char*", Name: "name"},
				{Type: "const char*", Name: "version"},
				{Type: "const char*", Name: "src_version"},
			},
		},
		events.ModuleFree: {
			ID:      events.ModuleFree,
			id32Bit: events.Sys32Undefined,
			name:    "module_free",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeModuleFree, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "const char*", Name: "name"},
				{Type: "const char*", Name: "version"},
				{Type: "const char*", Name: "src_version"},
			},
		},
		events.SocketAccept: {
			ID:       events.SocketAccept,
			id32Bit:  events.Sys32Undefined,
			name:     "socket_accept",
			internal: false,
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSyscallEnter__Internal, required: true},
					{handle: ProbeSyscallExit__Internal, required: true},
				},
				ids: []events.ID{
					events.SecuritySocketAccept,
				},
				tailCalls: []TailCall{
					{objs.SysExitTails, objs.SyscallAccept4, []uint32{uint32(events.Accept), uint32(events.Accept4)}},
					{objs.SysExitInitTail, objs.SysExitInit, []uint32{uint32(events.Accept), uint32(events.Accept4)}},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "int", Name: "sockfd"},
				{Type: "struct sockaddr*", Name: "local_addr"},
				{Type: "struct sockaddr*", Name: "remote_addr"}},
		},
		events.LoadElfPhdrs: {
			ID:      events.LoadElfPhdrs,
			id32Bit: events.Sys32Undefined,
			name:    "load_elf_phdrs",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeLoadElfPhdrs, required: true},
				},
			},
			sets: []string{"proc"},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "dev_t", Name: "dev"},
				{Type: "unsigned long", Name: "inode"},
			},
		},
		//events.HookedProcFops: {
		//	ID:      events.HookedProcFops,
		//	id32Bit: events.Sys32Undefined,
		//	name:    "hooked_proc_fops",
		//	dependencies: dependencies{
		//		probes: []EventProbe{
		//			{handle: ProbeSecurityFilePermission, required: true},
		//		},
		//		kSymbols: []KSymbol{
		//			{symbol: "_stext", required: true},
		//			{symbol: "_etext", required: true},
		//		},
		//		ids: []events.ID{
		//			events.DoInitModule,
		//		},
		//		//capabilities: capabilities{
		//		//	base: []cap.Value{
		//		//		cap.SYSLOG, // read /proc/kallsyms
		//		//	},
		//		//},
		//	},
		//	sets: []string{},
		//	params: []argMeta{
		//		{Type: "[]trace.HookedSymbolData", Name: "hooked_fops_pointers"},
		//	},
		//},
		events.PrintNetSeqOps: {
			ID:      events.PrintNetSeqOps,
			id32Bit: events.Sys32Undefined,
			name:    "print_net_seq_ops",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbePrintNetSeqOps, required: true},
				},
				kSymbols: []KSymbol{
					{symbol: "tcp4_seq_ops", required: true},
					{symbol: "tcp6_seq_ops", required: true},
					{symbol: "udp_seq_ops", required: true},
					{symbol: "udp6_seq_ops", required: true},
					{symbol: "raw_seq_ops", required: true},
					{symbol: "raw6_seq_ops", required: true},
				},
			},
			internal: true,
			sets:     []string{},
			params: []argMeta{
				{Type: "unsigned long[]", Name: "net_seq_ops"},
				{Type: "unsigned long", Name: "caller_context_id"},
			},
		},
		events.HookedSeqOps: {
			ID:      events.HookedSeqOps,
			id32Bit: events.Sys32Undefined,
			name:    "hooked_seq_ops",
			dependencies: dependencies{
				kSymbols: []KSymbol{
					{symbol: "_stext", required: true},
					{symbol: "_etext", required: true},
				},
				ids: []events.ID{
					events.PrintNetSeqOps,
					events.DoInitModule,
				},
				//capabilities: capabilities{
				//	base: []cap.Value{
				//		cap.SYSLOG, // read /proc/kallsyms
				//	},
				//},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "map[string]trace.HookedSymbolData", Name: "hooked_seq_ops"},
			},
		},
		events.TaskRename: {
			ID:      events.TaskRename,
			id32Bit: events.Sys32Undefined,
			name:    "task_rename",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeTaskRename, required: true},
				},
			},
			sets: []string{"proc"},
			params: []argMeta{
				{Type: "const char*", Name: "old_name"},
				{Type: "const char*", Name: "new_name"},
			},
		},
		events.SecurityInodeRename: {
			ID:      events.SecurityInodeRename,
			id32Bit: events.Sys32Undefined,
			name:    "security_inode_rename",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecurityInodeRename, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "const char*", Name: "old_path"},
				{Type: "const char*", Name: "new_path"},
			},
		},
		events.DoSigaction: {
			ID:      events.DoSigaction,
			id32Bit: events.Sys32Undefined,
			name:    "do_sigaction",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeDoSigaction, required: true},
				},
			},
			sets: []string{"proc"},
			params: []argMeta{
				{Type: "int", Name: "sig"},
				{Type: "bool", Name: "is_sa_initialized"},
				{Type: "unsigned long", Name: "sa_flags"},
				{Type: "unsigned long", Name: "sa_mask"},
				{Type: "u8", Name: "sa_handle_method"},
				{Type: "void*", Name: "sa_handler"},
				{Type: "bool", Name: "is_old_sa_initialized"},
				{Type: "unsigned long", Name: "old_sa_flags"},
				{Type: "unsigned long", Name: "old_sa_mask"},
				{Type: "u8", Name: "old_sa_handle_method"},
				{Type: "void*", Name: "old_sa_handler"},
			},
		},
		events.BpfAttach: {
			ID:      events.BpfAttach,
			id32Bit: events.Sys32Undefined,
			name:    "bpf_attach",
			docPath: "docs/events/builtin/extra/bpf_attach.md",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSecurityFileIoctl, required: true},
					{handle: ProbeSecurityBpfProg, required: true},
					{handle: ProbeSecurityBPF, required: true},
					{handle: ProbeTpProbeRegPrioMayExist, required: true},
					{handle: ProbeCheckHelperCall, required: false},
					{handle: ProbeCheckMapFuncCompatibility, required: false},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "int", Name: "prog_type"},
				{Type: "const char*", Name: "prog_name"},
				{Type: "u32", Name: "prog_id"},
				{Type: "unsigned long[]", Name: "prog_helpers"},
				{Type: "const char*", Name: "symbol_name"},
				{Type: "u64", Name: "symbol_addr"},
				{Type: "int", Name: "attach_type"},
			},
		},
		events.KallsymsLookupName: {
			ID:      events.KallsymsLookupName,
			id32Bit: events.Sys32Undefined,
			name:    "kallsyms_lookup_name",
			docPath: "kprobes/kallsyms_lookup_name.md",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeKallsymsLookupName, required: true},
					{handle: ProbeKallsymsLookupNameRet, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "const char*", Name: "symbol_name"},
				{Type: "void*", Name: "symbol_address"},
			},
		},
		events.PrintMemDump: {
			ID:      events.PrintMemDump,
			id32Bit: events.Sys32Undefined,
			name:    "print_mem_dump",
			sets:    []string{},
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbePrintMemDump, required: true},
				},
				ids: []events.ID{
					events.DoInitModule,
				},
				kSymbols: []KSymbol{},
				//capabilities: capabilities{
				//	base: []cap.Value{
				//		cap.SYSLOG, // read /proc/kallsyms
				//	},
				//},
			},
			params: []argMeta{
				{Type: "bytes", Name: "bytes"},
				{Type: "void*", Name: "address"},
				{Type: "u64", Name: "length"},
				{Type: "u64", Name: "caller_context_id"},
				{Type: "char*", Name: "arch"},
				{Type: "char*", Name: "symbol_name"},
				{Type: "char*", Name: "symbol_owner"},
			},
		},
		events.VfsRead: {
			ID:      events.VfsRead,
			id32Bit: events.Sys32Undefined,
			name:    "vfs_read",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeVfsRead, required: true},
					{handle: ProbeVfsReadRet, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "dev_t", Name: "dev"},
				{Type: "unsigned long", Name: "inode"},
				{Type: "size_t", Name: "count"},
				{Type: "off_t", Name: "pos"},
			},
		},
		events.VfsReadv: {
			ID:      events.VfsReadv,
			id32Bit: events.Sys32Undefined,
			name:    "vfs_readv",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeVfsReadV, required: true},
					{handle: ProbeVfsReadVRet, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "dev_t", Name: "dev"},
				{Type: "unsigned long", Name: "inode"},
				{Type: "unsigned long", Name: "vlen"},
				{Type: "off_t", Name: "pos"},
			},
		},
		events.VfsUtimes: {
			ID:      events.VfsUtimes,
			id32Bit: events.Sys32Undefined,
			name:    "vfs_utimes",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeVfsUtimes, required: false},    // this probe exits in kernels >= 5.9
					{handle: ProbeUtimesCommon, required: false}, // this probe exits in kernels < 5.9
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "dev_t", Name: "dev"},
				{Type: "unsigned long", Name: "inode"},
				{Type: "u64", Name: "atime"},
				{Type: "u64", Name: "mtime"},
			},
		},
		events.DoTruncate: {
			ID:      events.DoTruncate,
			id32Bit: events.Sys32Undefined,
			name:    "do_truncate",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeDoTruncate, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "unsigned long", Name: "inode"},
				{Type: "dev_t", Name: "dev"},
				{Type: "u64", Name: "length"},
			},
		},
		events.FileModification: {
			ID:      events.FileModification,
			id32Bit: events.Sys32Undefined,
			name:    "file_modification",
			docPath: "kprobes/file_modification.md",
			sets:    []string{},
			params: []argMeta{
				{Type: "const char*", Name: "file_path"},
				{Type: "dev_t", Name: "dev"},
				{Type: "unsigned long", Name: "inode"},
				{Type: "unsigned long", Name: "old_ctime"},
				{Type: "unsigned long", Name: "new_ctime"},
			},
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeFdInstall, required: true},
					{handle: ProbeFilpClose, required: true},
					{handle: ProbeFileUpdateTime, required: true},
					{handle: ProbeFileUpdateTimeRet, required: true},
					{handle: ProbeFileModified, required: false},    // not required because doesn't ...
					{handle: ProbeFileModifiedRet, required: false}, // ... exist in kernels < 5.3
				},
			},
		},
		events.InotifyWatch: {
			ID:      events.InotifyWatch,
			id32Bit: events.Sys32Undefined,
			name:    "inotify_watch",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeInotifyFindInode, required: true},
					{handle: ProbeInotifyFindInodeRet, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "const char*", Name: "pathname"},
				{Type: "unsigned long", Name: "inode"},
				{Type: "dev_t", Name: "dev"},
			},
		},
		events.ProcessExecuteFailed: {
			ID:      events.ProcessExecuteFailed,
			id32Bit: events.Sys32Undefined,
			name:    "process_execute_failed",
			sets:    []string{"proc"},
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeExecBinprm, required: true},
					{handle: ProbeExecBinprmRet, required: true},
				},
				tailCalls: []TailCall{
					{objs.SysEnterInitTail, objs.SysEnterInit, []uint32{uint32(events.Execve), uint32(events.Execveat)}},
					{objs.ProgArray, objs.TraceRetExecBinprm1, []uint32{TailExecBinprm1}},
					{objs.ProgArray, objs.TraceRetExecBinprm2, []uint32{TailExecBinprm2}},
				},
			},
			params: []argMeta{
				{Type: "const char*", Name: "path"},
				{Type: "const char*", Name: "binary.path"},
				{Type: "dev_t", Name: "binary.device_id"},
				{Type: "unsigned long", Name: "binary.inode_number"},
				{Type: "unsigned long", Name: "binary.ctime"},
				{Type: "umode_t", Name: "binary.inode_mode"},
				{Type: "const char*", Name: "interpreter_path"},
				{Type: "umode_t", Name: "stdin_type"},
				{Type: "char*", Name: "stdin_path"},
				{Type: "int", Name: "kernel_invoked"},
				{Type: "const char*const*", Name: "binary.arguments"},
				{Type: "const char*const*", Name: "environment"},
			},
		},
		events.TtyOpen: {
			ID:      events.TtyOpen,
			id32Bit: events.Sys32Undefined,
			name:    "tty_write",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeTtyOpen, required: true},
				},
			},
			sets: []string{},
			params: []argMeta{
				{Type: "char*", Name: "path"},
				{Type: "unsigned long", Name: "inode"},
				{Type: "umode_t", Name: "inode_mode"},
				{Type: "dev_t", Name: "dev"},
			},
		},

		//
		// Begin of Network Protocol Event Types
		//
		events.NetPacketBase: {
			ID:       events.NetPacketBase,
			id32Bit:  events.Sys32Undefined,
			name:     "net_packet_base",
			internal: true,
			dependencies: dependencies{
				//capabilities: capabilities{
				//	ebpf: []cap.Value{
				//		cap.NET_ADMIN, // needed for BPF_PROG_TYPE_CGROUP_SKB
				//	},
				//},
				probes: []EventProbe{
					{handle: ProbeCgroupSKBIngress, required: true},
					{handle: ProbeCgroupSKBEgress, required: true},
					{handle: ProbeSockAllocFile, required: true},
					{handle: ProbeSockAllocFileRet, required: true},
					{handle: ProbeCgroupBPFRunFilterSKB, required: true},
					{handle: ProbeSecuritySocketRecvmsg, required: true},
					{handle: ProbeSecuritySocketSendmsg, required: true},
					{handle: ProbeSecuritySkClone, required: true},
				},
			},
			sets:   []string{"network_events"},
			params: []argMeta{},
		},
		events.NetPacketIPBase: {
			ID:       events.NetPacketIPBase,
			id32Bit:  events.Sys32Undefined,
			name:     "net_packet_ip_base",
			internal: true,
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketBase,
				},
			},
			sets: []string{"network_events"},
			params: []argMeta{
				{Type: "bytes", Name: "payload"},
			},
		},
		events.NetPacketIPv4: {
			ID:      events.NetPacketIPv4,
			id32Bit: events.Sys32Undefined,
			name:    "net_packet_ipv4",
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketIPBase,
				},
			},
			sets: []string{"network_events"},
			params: []argMeta{
				{Type: "const char*", Name: "src"}, // TODO: remove after filter supports ProtoIPv4
				{Type: "const char*", Name: "dst"}, // TODO: remove after filter supports ProtoIPv4
				{Type: "trace.ProtoIPv4", Name: "proto_ipv4"},
			},
		},
		events.NetPacketIPv6: {
			ID:      events.NetPacketIPv6,
			id32Bit: events.Sys32Undefined,
			name:    "net_packet_ipv6",
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketIPBase,
				},
			},
			sets: []string{"network_events"},
			params: []argMeta{
				{Type: "const char*", Name: "src"}, // TODO: remove after filter supports ProtoIPv6
				{Type: "const char*", Name: "dst"}, // TODO: remove after filter supports ProtoIPv6
				{Type: "trace.ProtoIPv6", Name: "proto_ipv6"},
			},
		},
		events.NetPacketTCPBase: {
			ID:       events.NetPacketTCPBase,
			id32Bit:  events.Sys32Undefined,
			name:     "net_packet_tcp_base",
			internal: true,
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketBase,
				},
			},
			sets: []string{"network_events"},
			params: []argMeta{
				{Type: "bytes", Name: "payload"},
			},
		},
		events.NetPacketTCP: {
			ID:      events.NetPacketTCP,
			id32Bit: events.Sys32Undefined,
			name:    "net_packet_tcp",
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketTCPBase,
				},
			},
			sets: []string{"network_events"},
			params: []argMeta{
				{Type: "const char*", Name: "src"},
				{Type: "const char*", Name: "dst"},
				{Type: "u16", Name: "src_port"}, // TODO: remove after filter supports ProtoTCP
				{Type: "u16", Name: "dst_port"}, // TODO: remove after filter supports ProtoTCP
				{Type: "trace.ProtoTCP", Name: "proto_tcp"},
			},
		},
		events.NetPacketUDPBase: {
			ID:       events.NetPacketUDPBase,
			id32Bit:  events.Sys32Undefined,
			name:     "net_packet_udp_base",
			internal: true,
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketBase,
				},
			},
			sets: []string{"network_events"},
			params: []argMeta{
				{Type: "bytes", Name: "payload"},
			},
		},
		events.NetPacketUDP: {
			ID:      events.NetPacketUDP,
			id32Bit: events.Sys32Undefined,
			name:    "net_packet_udp",
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketUDPBase,
				},
			},
			sets: []string{"network_events"},
			params: []argMeta{
				{Type: "const char*", Name: "src"},
				{Type: "const char*", Name: "dst"},
				{Type: "u16", Name: "src_port"}, // TODO: remove after filter supports ProtoUDP
				{Type: "u16", Name: "dst_port"}, // TODO: remove after filter supports ProtoUDP
				{Type: "trace.ProtoUDP", Name: "proto_udp"},
			},
		},
		events.NetPacketICMPBase: {
			ID:      events.NetPacketICMPBase,
			id32Bit: events.Sys32Undefined,
			name:    "net_packet_icmp_base",
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketBase,
				},
			},
			internal: true,
			sets:     []string{"network_events"},
			params: []argMeta{
				{Type: "bytes", Name: "payload"},
			},
		},
		events.NetPacketICMP: {
			ID:      events.NetPacketICMP,
			id32Bit: events.Sys32Undefined,
			name:    "net_packet_icmp",
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketICMPBase,
				},
			},
			sets: []string{"default", "network_events"},
			params: []argMeta{
				{Type: "const char*", Name: "src"},
				{Type: "const char*", Name: "dst"},
				{Type: "trace.ProtoICMP", Name: "proto_icmp"},
			},
		},
		events.NetPacketICMPv6Base: {
			ID:       events.NetPacketICMPv6Base,
			id32Bit:  events.Sys32Undefined,
			name:     "net_packet_icmpv6_base",
			internal: true,
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketBase,
				},
			},
			sets: []string{"network_events"},
			params: []argMeta{
				{Type: "bytes", Name: "payload"},
			},
		},
		events.NetPacketICMPv6: {
			ID:      events.NetPacketICMPv6,
			id32Bit: events.Sys32Undefined,
			name:    "net_packet_icmpv6",
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketICMPv6Base,
				},
			},
			sets: []string{"default", "network_events"},
			params: []argMeta{
				{Type: "const char*", Name: "src"},
				{Type: "const char*", Name: "dst"},
				{Type: "trace.ProtoICMPv6", Name: "proto_icmpv6"},
			},
		},
		events.NetPacketDNSBase: {
			ID:       events.NetPacketDNSBase,
			id32Bit:  events.Sys32Undefined,
			name:     "net_packet_dns_base",
			internal: true,
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketBase,
				},
			},
			sets: []string{"network_events"},
			params: []argMeta{
				{Type: "proto.DNS", Name: "payload"},
			},
		},
		events.NetPacketDNS: {
			ID:      events.NetPacketDNS,
			id32Bit: events.Sys32Undefined,
			name:    "net_packet_dns", // preferred event to write signatures
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketDNSBase,
				},
			},
			sets: []string{"network_events"},
			params: []argMeta{
				{Type: "const char*", Name: "src"},
				{Type: "const char*", Name: "dst"},
				{Type: "u16", Name: "src_port"},
				{Type: "u16", Name: "dst_port"},
				{Type: "trace.ProtoDNS", Name: "proto_dns"},
			},
		},
		events.NetPacketDNSRequest: {
			ID:      events.NetPacketDNSRequest,
			id32Bit: events.Sys32Undefined,
			name:    "net_packet_dns_request", // simple dns event compatible dns_request (deprecated)
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketDNSBase,
				},
			},
			sets: []string{"default", "network_events"},
			params: []argMeta{
				{Type: "trace.PktMeta", Name: "metadata"},
				{Type: "[]trace.DnsQueryData", Name: "dns_questions"},
			},
		},
		events.NetPacketDNSResponse: {
			ID:      events.NetPacketDNSResponse,
			id32Bit: events.Sys32Undefined,
			name:    "net_packet_dns_response", // simple dns event compatible dns_response (deprecated)
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketDNSBase,
				},
			},
			sets: []string{"default", "network_events"},
			params: []argMeta{
				{Type: "trace.PktMeta", Name: "metadata"},
				{Type: "[]trace.DnsResponseData", Name: "dns_response"},
			},
		},
		events.NetPacketHTTPBase: {
			ID:       events.NetPacketHTTPBase,
			id32Bit:  events.Sys32Undefined,
			name:     "net_packet_http_base",
			internal: true,
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketBase,
				},
			},
			sets: []string{"network_events"},
			params: []argMeta{
				{Type: "bytes", Name: "payload"},
			},
		},
		events.NetPacketHTTP: {
			ID:      events.NetPacketHTTP,
			id32Bit: events.Sys32Undefined,
			name:    "net_packet_http", // preferred event to write signatures
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketHTTPBase,
				},
			},
			sets: []string{"network_events"},
			params: []argMeta{
				{Type: "const char*", Name: "src"},
				{Type: "const char*", Name: "dst"},
				{Type: "u16", Name: "src_port"},
				{Type: "u16", Name: "dst_port"},
				{Type: "trace.ProtoHTTP", Name: "proto_http"},
			},
		},
		events.NetPacketHTTPRequest: {
			ID:      events.NetPacketHTTPRequest,
			id32Bit: events.Sys32Undefined,
			name:    "net_packet_http_request",
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketHTTPBase,
				},
			},
			sets: []string{"default", "network_events"},
			params: []argMeta{
				{Type: "trace.PktMeta", Name: "metadata"},
				{Type: "trace.ProtoHTTPRequest", Name: "http_request"},
			},
		},
		events.NetPacketHTTPResponse: {
			ID:      events.NetPacketHTTPResponse,
			id32Bit: events.Sys32Undefined,
			name:    "net_packet_http_response",
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketHTTPBase,
				},
			},
			sets: []string{"default", "network_events"},
			params: []argMeta{
				{Type: "trace.PktMeta", Name: "metadata"},
				{Type: "trace.ProtoHTTPResponse", Name: "http_response"},
			},
		},
		events.NetPacketSOCKS5Base: {
			ID:       events.NetPacketSOCKS5Base,
			id32Bit:  events.Sys32Undefined,
			name:     "net_packet_socks5_base",
			internal: true,
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketBase,
				},
			},
			sets: []string{"network_events"},
			params: []argMeta{
				{Type: "bytes", Name: "payload"},
			},
		},
		events.NetPacketCapture: {
			ID:       events.NetPacketCapture, // all packets have full payload (sent in a dedicated perfbuffer)
			id32Bit:  events.Sys32Undefined,
			name:     "net_packet_capture",
			internal: true,
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketBase,
				},
			},
			params: []argMeta{
				{Type: "bytes", Name: "payload"},
			},
		},
		events.CaptureNetPacket: {
			ID:       events.CaptureNetPacket, // network packet capture pseudo event
			id32Bit:  events.Sys32Undefined,
			name:     "capture_net_packet",
			internal: true,
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketCapture,
				},
			},
		},
		events.SockSetState: {
			ID:      events.SockSetState,
			id32Bit: events.Sys32Undefined,
			name:    "sock_set_state",
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: ProbeSockAllocFile, required: true},
					{handle: ProbeSockAllocFileRet, required: true},
					{handle: ProbeSecuritySocketConnect, required: true},
					{handle: ProbeSecuritySocketListen, required: true},
					{handle: ProbeInetSockSetState, required: true},
				},
			},
			params: []argMeta{
				{Type: "u32", Name: "old_state"},
				{Type: "u32", Name: "new_state"},
				{Type: "tuple", Name: "tuple"},
			},
		},
		events.TrackSyscallStats: {
			ID:           events.TrackSyscallStats,
			id32Bit:      events.Sys32Undefined,
			name:         "track_syscall_stats",
			syscall:      true,
			sets:         []string{"syscalls"},
			dependencies: dependencies{skipDefaultTailCalls: true},
			params:       []argMeta{},
		},
		//
		// End of Network Protocol Event Types (keep them at the end)
		//

		// Event used for testing in unit tests
		events.TestEvent: {
			ID:       events.TestEvent,
			id32Bit:  events.Sys32Undefined,
			name:     "test_event",
			internal: true,
			syscall:  false,
		},
		//
		// Begin of Signal Events (Control Plane)
		//
		events.SignalCgroupMkdir: {
			ID:       events.SignalCgroupMkdir,
			id32Bit:  events.Sys32Undefined,
			name:     "signal_cgroup_mkdir",
			internal: true,
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: SignalCgroupMkdir, required: true},
				},
			},
			sets: []string{"signal"},
			params: []argMeta{
				{Type: "u64", Name: "cgroup_id"},
				{Type: "const char*", Name: "cgroup_path"},
				{Type: "u32", Name: "hierarchy_id"},
			},
		},
		events.SignalCgroupRmdir: {
			ID:       events.SignalCgroupRmdir,
			id32Bit:  events.Sys32Undefined,
			name:     "signal_cgroup_rmdir",
			internal: true,
			dependencies: dependencies{
				probes: []EventProbe{
					{handle: SignalCgroupRmdir, required: true},
				},
			},
			sets: []string{"signal"},
			params: []argMeta{
				{Type: "u64", Name: "cgroup_id"},
				{Type: "const char*", Name: "cgroup_path"},
				{Type: "u32", Name: "hierarchy_id"},
			},
		},
		events.NetFlowBase: {
			ID:       events.NetFlowBase,
			id32Bit:  events.Sys32Undefined,
			name:     "net_packet_flow_base",
			internal: true,
			dependencies: dependencies{
				ids: []events.ID{
					events.NetPacketBase,
				},
			},
			sets: []string{"network_events"},
			params: []argMeta{
				{Type: "u8", Name: "proto"},
				{Type: "u8", Name: "direction"},
				{Type: "tuple", Name: "tuple"},
				{Type: "u64", Name: "tx_bytes"},
				{Type: "u64", Name: "rx_bytes"},
				{Type: "u64", Name: "tx_packets"},
				{Type: "u64", Name: "rx_packets"},
			},
		},
	}
}