Syscall Trace filter

The filter box on Syscall Trace accepts the shared syntax. A word with no operator searches the syscall name, TID, task and info text. For a saved recording the filter checks every saved call in a cancellable worker, so page counts and totals include matches beyond the first page.

A filter over a saved run counts matches across every saved call. Antinomie 0.6.2, a recorded run.

Fields are case-insensitive. Text compares are case-sensitive; use lower() to ignore case.

Fields

Completion offers the argument names of the call you filter on. Antinomie 0.8.0, synthetic data.

Field	Type	Meaning
syscall.num	integer	Native syscall number (alias syscall.number)
syscall.name	text	Syscall name (aliases syscall, name); case-sensitive in ==
syscall.group	text	Syscall group, such as File & filesystem or Network
ret	integer	Exit result; missing when the exit was not recorded (aliases result, syscall.ret)
syscall.errno	integer	Positive errno for a Linux error return; missing on success
syscall.success	boolean	The result is not a Linux errno
syscall.duration_ns	integer	Exit minus entry guest time, in ns
call.id	integer	Invocation id (alias call_id)
tid	integer	Thread id (alias process.tid)
pid	integer	Process id (aliases process.pid, process.tgid)
cpu	integer	CPU recorded on the event
task	integer	Task cookie (aliases cookie, task.cookie, process.cookie)
stream.id	integer	Telemetry stream identity
process.exe	text	Executable path, on a call that committed an exec
process.argv	text list	Argument strings, on a call that committed an exec
process.state	text	exited for a call during which the task ended
process.ppid, process.parent_cookie, process.uid, process.gid, process.comm	integer, text	Per-task provenance. Missing on syscall rows in this version, so they never match.
info	text	The rendered Info column text
event.id, event.sequence	integer	Recorded event sequence
event.time_ns	integer	Guest monotonic time in ns
event.complete	boolean	All retained events of the call are complete
event.gap	text list	Recorded completeness issues

Arguments

Field	Type	Meaning
args.0 to args.5	integer	Argument word by position
args.raw[0] to args.raw[5]	integer	The raw captured argument word; for a pointer argument this is the address
args.<name>	integer	Argument by its schema name for this call, such as fd, dirfd, flags, prot, addr, len, count. Signed C types (int, long, …) compare as signed.
args.path	text	Captured path, filename or pathname string, not the pointer. Aliases args.file, args.filename, args.pathname.
args.old_path, args.new_path	text	Captured old and new path strings (aliases args.oldname, args.newname)
args.addr, args.len, args.prot, args.buf	integer	Aliases for the address, length, protection and buffer argument (address, length, protection, buffer also work)
args.<argument>.<member>	integer, text, boolean	A member of a captured structure, such as args.how.flags for openat2’s open_how
args.<argument>.complete, .captured_size, .expected_size, .status, .capture_error, .layout	various	How completely the argument was captured

Captured structures

New in 0.8.0

Every branch of bpf’s union bpf_attr is a keyword, qualified by the commands that read it: args.attr.map_fd for the map element commands, args.attr.query.attach_type for a query, args.attr.insn_cnt of a load, args.attr.attach_bpf_fd and args.attr.attach_type of an attach, args.attr.link_create.attach_type and so on. Before 0.8.0, args.attr.attach_type of a BPF_PROG_ATTACH and args.attr.bpf_fd of a BPF_OBJ_PIN read the word of a same-named member of another command. The members of io_uring_params, group lists (gid_t[]) and xt_counters_info have keywords too. Help → Filter guide and completion list them all.

Not available as keywords: the members of siginfo_t and sigevent (their branch is selected by a member, not an argument), signal sets, and ipt_replace. These are still shown decoded in the trace.

A path field is missing unless its string was captured. Structure members use layouts checked against the pinned Linux 6.12.94 x86-64 headers, and a member is missing when its layout, selector or phase is unsupported or ambiguous. args.<argument>.status is the capture status number; see Capture statuses.

Help → Filter guide lists every schema argument name, every syscall name and every structure member. Completion offers the same.

Examples

syscall.name == openat && ret < 0
syscall.name in {connect, sendto, sendmsg}
syscall.group == "Network" && syscall.success
exists(syscall.errno) && syscall.errno == 2
args.prot & 7 == 7
args.path contains "/etc/"
lower(args.path) contains "ssh"
args.fd == 1 && syscall.name == write
args.how.flags & 0x40 != 0
syscall.name == bpf && args.attr.map_fd == 4
syscall.duration_ns > 1000000
event.complete == false
missing(ret)
call.id == 1

Left-click chips above the trace hide whole syscall groups, which narrows the list without a filter. See Syscall Trace.