PROBE::SYSCALL_ANY(3stap)

💖 PROBE::SYSCALL_ANY 💖

okay bestie, so this is a page from the SystemTap Tapset Reference — it's manual section 3stap, and it's all about the syscall_any tapset. Buckle up, it's short but it's iconic. ✨

---

🌸 NAME 🌸

probe::syscall_any.return — literally just: Record exit from a syscall 🎀

---

🦋 SYNOPSIS 🦋

probe syscall_any.return {}

that's it. that's the whole probe. no arguments, no fuss, she's lowkey minimal and we respect it 💅

---

💜 VALUES 💜

these are the things you can peek at when this probe fires. three of them. all bangers.

• syscall_nr — number of the syscall
• retval — return value of the syscall
• name — name of the syscall

like. the number, the return, and the name. the full trio. the way that's so helpful of her fr fr 🙈

---

🧚 CONTEXT 🧚

The process performing the syscall

(yeah — it's the process doing the syscall. the main character of this whole operation, no cap 👑)

---

🔥 DESCRIPTION 🔥

so here's the tea, and it's giving smart:

She prefers kernel.tracepoint("sys_exit") when vmlinux.h BTF tracepoints are available. but if they're not? she's got a backup plan, bestie — she falls back to kernel.trace("sys_exit") (kernel 3.5+). 🫶

so like: fancy modern tracepoints first, old reliable second. she's flexible. she's adaptable. she ate. 💅

ngl the fallback is the important part — if your kernel is doing the BTF thing she rides the tracepoint, otherwise it's the plain trace route. either way, kernel 3.5+ is the floor here. ⭐

---

🌈 SEE ALSO 🌈

• tapset::syscall_any(3stap)

go read that one too, iykyk 📖✨

---

and that's the whole page, bestie!! 💖 This was the SystemTap Tapset Reference, version September 2026 — mwah, go trace some syscalls, you've got this 🦋🎀💜