On Sat, Nov 19, 2016 at 9:45 AM, Mazhar Naqvi via iovisor-dev <[email protected]> wrote: > Hi, > > > I am trying to attach my function to a tracepoint. I followed brendangregg's > script "urandomread.py" and modified it to attach to > syscalls:sys_enters_socket but the program gives me an error. > > > Here's a code snippet I am using: > > > b = BPF(text=""" > TRACEPOINT_PROBE(syscalls, sys_enter_socket) { > bpf_trace_printk("Hello\\n"); > return 0; > }; > """) > > Can anyone point out what I am doing wrong? The script seems to work fine > for raw_syscalls:sys_enter but not for the one mentioned above. > > Why is ebpf unable to attach to syscalls:sys_enter_socket event? Thanks in > advance.
from the kernel point of view syscalls are not tracepoints, so tracepoint+bpf support doesn't cover them. For now please use kprobe on sys_* function as a workaround. Thanks _______________________________________________ iovisor-dev mailing list [email protected] https://lists.iovisor.org/mailman/listinfo/iovisor-dev
