/* EDIT WITH CARE.

 * Many sections of this file were automatically generated.

 */

/* packet-sysdig-event.c

 * Routines for Sysdig event dissection

 * http://www.sysdig.org/

 * Copyright 2015, Gerald Combs <gerald@wireshark.org>

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

/*

 * Sysdig is a tool that captures and analyzes system state.

 * This dissects pcapng Sysdig Event Blocks (0x00000204), which contains

 * a system call entry or exit along with its associated parameters.

 */

/*

 * To do:

 * - Event with flags (0x00000208).

 * - Enter/exit delay.

 * - Most of this could be automatically generated from the Sysdig sources.

 *   - Alternatively we could modify Sysdig to dump its internal tables and

 *     generate a dissector from that output.

 * - Generate the column info table.

 * - Pull metainformation (processes, users, etc) into hash tables.

 */

#include <config.h>

#include <epan/exceptions.h>

#include <epan/packet.h>

#include <epan/strutil.h>

#include <packet-sysdig-event.h>

#include <wiretap/wtap.h>

#include <wiretap/pcapng_module.h>

/* #include <epan/expert.h> */

/* #include <epan/prefs.h> */

#define SYSDIG_PARAM_SIZE 2

#define SYSDIG_PARAM_SIZE_V2 2

#define SYSDIG_PARAM_SIZE_V2_LARGE 4

/* Prototypes */

void proto_reg_handoff_sysdig_event(void);

void proto_register_sysdig_event(void);

static dissector_handle_t sysdig_event_handle;

/* Initialize the protocol and registered fields */

static int proto_sysdig_event;

/* Add byte order? */

static int hf_se_cpu_id;

static int hf_se_thread_id;

static int hf_se_event_length;

static int hf_se_nparams;

static int hf_se_event_type;

static int hf_se_event_name;

static int hf_se_param_lens;

static int hf_se_param_len;

/* Name+type */

/* Header fields. Automatically generated by tools/generate-sysdig-event.py */

static int hf_param_ID_uint16;

static int hf_param_action_uint32;

static int hf_param_addr_bytes;

static int hf_param_addr_uint64;

static int hf_param_arg2_int_int64;

static int hf_param_arg2_str_string;

static int hf_param_arg_uint64;

static int hf_param_args_string;

static int hf_param_argument_uint64;

static int hf_param_aux_int32;

static int hf_param_backlog_int32;

static int hf_param_cap_effective_uint64;

static int hf_param_cap_inheritable_uint64;

static int hf_param_cap_permitted_uint64;

static int hf_param_cgroups_bytes;

static int hf_param_clockid_uint8;

static int hf_param_cmd_bytes;

static int hf_param_cmd_int16;

static int hf_param_cmd_int64;

static int hf_param_comm_string;

static int hf_param_container_id_string;

static int hf_param_core_uint8;

static int hf_param_cpu_sys_uint64;

static int hf_param_cpu_uint32;

static int hf_param_cpu_usr_uint64;

static int hf_param_cq_entries_uint32;

static int hf_param_cur_int64;

static int hf_param_cwd_string;

static int hf_param_data_bytes;

static int hf_param_desc_string;

static int hf_param_description_string;

static int hf_param_dev_string;

static int hf_param_dev_uint32;

static int hf_param_dir_string;

static int hf_param_dirfd_int64;

static int hf_param_domain_bytes;

static int hf_param_dpid_int64;

static int hf_param_dqb_bhardlimit_uint64;

static int hf_param_dqb_bsoftlimit_uint64;

static int hf_param_dqb_btime_bytes;

static int hf_param_dqb_curspace_uint64;

static int hf_param_dqb_ihardlimit_uint64;

static int hf_param_dqb_isoftlimit_uint64;

static int hf_param_dqb_itime_bytes;

static int hf_param_dqi_bgrace_bytes;

static int hf_param_dqi_flags_int8;

static int hf_param_dqi_igrace_bytes;

static int hf_param_egid_int32;

static int hf_param_entries_uint32;

static int hf_param_env_string;

static int hf_param_error_int32;

static int hf_param_euid_int32;

static int hf_param_event_data_bytes;

static int hf_param_event_data_uint64;

static int hf_param_event_type_uint32;

static int hf_param_exe_ino_ctime_bytes;

static int hf_param_exe_ino_mtime_bytes;

static int hf_param_exe_ino_uint64;

static int hf_param_exe_string;

static int hf_param_fd1_int64;

static int hf_param_fd2_int64;

static int hf_param_fd_in_int64;

static int hf_param_fd_int64;

static int hf_param_fd_out_int64;

static int hf_param_fdin_int64;

static int hf_param_fdlimit_int64;

static int hf_param_fdlimit_uint64;

static int hf_param_fdout_int64;

static int hf_param_fds_bytes;

static int hf_param_features_int32;

static int hf_param_filename_string;

static int hf_param_flags_int16;

static int hf_param_flags_int32;

static int hf_param_flags_uint32;

static int hf_param_flags_uint64;

static int hf_param_flags_uint8;

static int hf_param_gid_int32;

static int hf_param_gid_uint32;

static int hf_param_home_string;

static int hf_param_how_bytes;

static int hf_param_id_int64;

static int hf_param_id_string;

static int hf_param_id_uint32;

static int hf_param_image_string;

static int hf_param_img_bytes;

static int hf_param_in_fd_int64;

static int hf_param_initval_uint64;

static int hf_param_ino_uint64;

static int hf_param_interval_bytes;

static int hf_param_ip_uint64;

static int hf_param_json_string;

static int hf_param_key_int32;

static int hf_param_key_string;

static int hf_param_len_uint64;

static int hf_param_length_uint64;

static int hf_param_level_bytes;

static int hf_param_linkdirfd_int64;

static int hf_param_linkpath_string;

static int hf_param_loginuid_int32;

static int hf_param_mask_uint32;

static int hf_param_max_int64;

static int hf_param_maxevents_int64;

static int hf_param_min_complete_uint32;

static int hf_param_mode_int32;

static int hf_param_mode_uint32;

static int hf_param_mountfd_int64;

static int hf_param_msgcontrol_bytes;

static int hf_param_name_string;

static int hf_param_nativeID_uint16;

static int hf_param_newcur_int64;

static int hf_param_newdir_int64;

static int hf_param_newdirfd_int64;

static int hf_param_newfd_int64;

static int hf_param_newmax_int64;

static int hf_param_newpath_string;

static int hf_param_next_int64;

static int hf_param_nr_args_uint32;

static int hf_param_nsems_int32;

static int hf_param_nsops_uint32;

static int hf_param_nstype_int32;

static int hf_param_offin_uint64;

static int hf_param_offout_uint64;

static int hf_param_offset_uint64;

static int hf_param_oldcur_int64;

static int hf_param_olddir_int64;

static int hf_param_olddirfd_int64;

static int hf_param_oldfd_int64;

static int hf_param_oldmax_int64;

static int hf_param_oldpath_string;

static int hf_param_op_bytes;

static int hf_param_op_uint64;

static int hf_param_opcode_bytes;

static int hf_param_operation_int32;

static int hf_param_option_bytes;

static int hf_param_optlen_uint32;

static int hf_param_optname_bytes;

static int hf_param_out_fd_int64;

static int hf_param_path_string;

static int hf_param_pathname_string;

static int hf_param_peer_uint64;

static int hf_param_pgft_maj_uint64;

static int hf_param_pgft_min_uint64;

static int hf_param_pgid_int64;

static int hf_param_pgoffset_uint64;

static int hf_param_pid_fd_int64;

static int hf_param_pid_int64;

static int hf_param_pidns_init_start_ts_uint64;

static int hf_param_plugin_id_uint32;

static int hf_param_pos_uint64;

static int hf_param_prot_int32;

static int hf_param_proto_uint32;

static int hf_param_ptid_int64;

static int hf_param_queuelen_uint32;

static int hf_param_queuemax_uint32;

static int hf_param_queuepct_uint8;

static int hf_param_quota_fmt_int8;

static int hf_param_quota_fmt_out_int8;

static int hf_param_quotafilepath_string;

static int hf_param_ratio_uint32;

static int hf_param_reaper_tid_int64;

static int hf_param_request_bytes;

static int hf_param_request_uint64;

static int hf_param_res_int64;

static int hf_param_res_or_fd_bytes;

static int hf_param_res_uint64;

static int hf_param_resolve_int32;

static int hf_param_resource_bytes;

static int hf_param_ret_int64;

static int hf_param_rgid_int32;

static int hf_param_ruid_int32;

static int hf_param_scope_string;

static int hf_param_sem_flg_0_int16;

static int hf_param_sem_flg_1_int16;

static int hf_param_sem_num_0_uint16;

static int hf_param_sem_num_1_uint16;

static int hf_param_sem_op_0_int16;

static int hf_param_sem_op_1_int16;

static int hf_param_semflg_int32;

static int hf_param_semid_int32;

static int hf_param_semnum_int32;

static int hf_param_sgid_int32;

static int hf_param_shell_string;

static int hf_param_sig_bytes;

static int hf_param_sigmask_bytes;

static int hf_param_size_int32;

static int hf_param_size_uint32;

static int hf_param_size_uint64;

static int hf_param_source_string;

static int hf_param_source_uint64;

static int hf_param_special_string;

static int hf_param_spid_int64;

static int hf_param_sq_entries_uint32;

static int hf_param_sq_thread_cpu_uint32;

static int hf_param_sq_thread_idle_uint32;

static int hf_param_status_int64;

static int hf_param_suid_int32;

static int hf_param_tags_bytes;

static int hf_param_target_fd_int64;

static int hf_param_target_string;

static int hf_param_tid_int64;

static int hf_param_timeout_bytes;

static int hf_param_timeout_int64;

static int hf_param_to_submit_uint32;

static int hf_param_trusted_exepath_string;

static int hf_param_tty_int32;

static int hf_param_tty_uint32;

static int hf_param_tuple_bytes;

static int hf_param_type_int8;

static int hf_param_type_string;

static int hf_param_type_uint32;

static int hf_param_uargs_string;

static int hf_param_uid_int32;

static int hf_param_uid_uint32;

static int hf_param_val_bytes;

static int hf_param_val_int32;

static int hf_param_val_uint64;

static int hf_param_value_bytebuf_bytes;

static int hf_param_value_charbuf_string;

static int hf_param_vm_rss_uint32;

static int hf_param_vm_size_uint32;

static int hf_param_vm_swap_uint32;

static int hf_param_vpid_int64;

static int hf_param_vtid_int64;

static int hf_param_whence_bytes;

/* Initialize the subtree pointers */

static int ett_sysdig_event;

static int ett_sysdig_parm_lens;

static int ett_sysdig_syscall;

/* Initialize the pointer to the child plugin dissector */

static dissector_handle_t sinsp_dissector_handle;

static dissector_handle_t elf_dissector_handle;

#define SYSDIG_EVENT_MIN_LENGTH 8 /* XXX Fix */

/* Event names. Automatically generated by tools/generate-sysdig-event.py */

#define EVT_STR_NA                       "NA"

#define EVT_STR_ACCEPT                   "accept"

#define EVT_STR_ACCEPT4                  "accept4"

#define EVT_STR_ACCESS                   "access"

#define EVT_STR_ASYNCEVENT               "asyncevent"

#define EVT_STR_BIND                     "bind"

#define EVT_STR_BPF                      "bpf"

#define EVT_STR_BRK                      "brk"

#define EVT_STR_CAPSET                   "capset"

#define EVT_STR_CHDIR                    "chdir"

#define EVT_STR_CHMOD                    "chmod"

#define EVT_STR_CHOWN                    "chown"

#define EVT_STR_CHROOT                   "chroot"

#define EVT_STR_CLONE                    "clone"

#define EVT_STR_CLONE3                   "clone3"

#define EVT_STR_CLOSE                    "close"

#define EVT_STR_CONNECT                  "connect"

#define EVT_STR_CONTAINER                "container"

#define EVT_STR_COPY_FILE_RANGE          "copy_file_range"

#define EVT_STR_CPU_HOTPLUG              "cpu_hotplug"

#define EVT_STR_CREAT                    "creat"

#define EVT_STR_DELETE_MODULE            "delete_module"

#define EVT_STR_DROP                     "drop"

#define EVT_STR_DUP                      "dup"

#define EVT_STR_DUP2                     "dup2"

#define EVT_STR_DUP3                     "dup3"

#define EVT_STR_EPOLL_CREATE             "epoll_create"

#define EVT_STR_EPOLL_CREATE1            "epoll_create1"

#define EVT_STR_EPOLL_WAIT               "epoll_wait"

#define EVT_STR_EVENTFD                  "eventfd"

#define EVT_STR_EVENTFD2                 "eventfd2"

#define EVT_STR_EXECVE                   "execve"

#define EVT_STR_EXECVEAT                 "execveat"

#define EVT_STR_FCHDIR                   "fchdir"

#define EVT_STR_FCHMOD                   "fchmod"

#define EVT_STR_FCHMODAT                 "fchmodat"

#define EVT_STR_FCHOWN                   "fchown"

#define EVT_STR_FCHOWNAT                 "fchownat"

#define EVT_STR_FCNTL                    "fcntl"

#define EVT_STR_FINIT_MODULE             "finit_module"

#define EVT_STR_FLOCK                    "flock"

#define EVT_STR_FORK                     "fork"

#define EVT_STR_FSCONFIG                 "fsconfig"

#define EVT_STR_FSTAT                    "fstat"

#define EVT_STR_FSTAT64                  "fstat64"

#define EVT_STR_FUTEX                    "futex"

#define EVT_STR_GETCWD                   "getcwd"

#define EVT_STR_GETDENTS                 "getdents"

#define EVT_STR_GETDENTS64               "getdents64"

#define EVT_STR_GETEGID                  "getegid"

#define EVT_STR_GETEUID                  "geteuid"

#define EVT_STR_GETGID                   "getgid"

#define EVT_STR_GETPEERNAME              "getpeername"

#define EVT_STR_GETRESGID                "getresgid"

#define EVT_STR_GETRESUID                "getresuid"

#define EVT_STR_GETRLIMIT                "getrlimit"

#define EVT_STR_GETSOCKNAME              "getsockname"

#define EVT_STR_GETSOCKOPT               "getsockopt"

#define EVT_STR_GETUID                   "getuid"

#define EVT_STR_GROUPADDED               "groupadded"

#define EVT_STR_GROUPDELETED             "groupdeleted"

#define EVT_STR_INFRA                    "infra"

#define EVT_STR_INIT_MODULE              "init_module"

#define EVT_STR_INOTIFY_INIT             "inotify_init"

#define EVT_STR_INOTIFY_INIT1            "inotify_init1"

#define EVT_STR_IO_URING_ENTER           "io_uring_enter"

#define EVT_STR_IO_URING_REGISTER        "io_uring_register"

#define EVT_STR_IO_URING_SETUP           "io_uring_setup"

#define EVT_STR_IOCTL                    "ioctl"

#define EVT_STR_K8S                      "k8s"

#define EVT_STR_KILL                     "kill"

#define EVT_STR_LCHOWN                   "lchown"

#define EVT_STR_LINK                     "link"

#define EVT_STR_LINKAT                   "linkat"

#define EVT_STR_LISTEN                   "listen"

#define EVT_STR_LLSEEK                   "llseek"

#define EVT_STR_LSEEK                    "lseek"

#define EVT_STR_LSTAT                    "lstat"

#define EVT_STR_LSTAT64                  "lstat64"

#define EVT_STR_MEMFD_CREATE             "memfd_create"

#define EVT_STR_MESOS                    "mesos"

#define EVT_STR_MKDIR                    "mkdir"

#define EVT_STR_MKDIRAT                  "mkdirat"

#define EVT_STR_MKNOD                    "mknod"

#define EVT_STR_MKNODAT                  "mknodat"

#define EVT_STR_MLOCK                    "mlock"

#define EVT_STR_MLOCK2                   "mlock2"

#define EVT_STR_MLOCKALL                 "mlockall"

#define EVT_STR_MMAP                     "mmap"

#define EVT_STR_MMAP2                    "mmap2"

#define EVT_STR_MOUNT                    "mount"

#define EVT_STR_MPROTECT                 "mprotect"

#define EVT_STR_MUNLOCK                  "munlock"

#define EVT_STR_MUNLOCKALL               "munlockall"

#define EVT_STR_MUNMAP                   "munmap"

#define EVT_STR_NANOSLEEP                "nanosleep"

#define EVT_STR_NEWFSTATAT               "newfstatat"

#define EVT_STR_NOTIFICATION             "notification"

#define EVT_STR_OPEN                     "open"

#define EVT_STR_OPEN_BY_HANDLE_AT        "open_by_handle_at"

#define EVT_STR_OPENAT                   "openat"

#define EVT_STR_OPENAT2                  "openat2"

#define EVT_STR_PAGE_FAULT               "page_fault"

#define EVT_STR_PIDFD_GETFD              "pidfd_getfd"

#define EVT_STR_PIDFD_OPEN               "pidfd_open"

#define EVT_STR_PIPE                     "pipe"

#define EVT_STR_PIPE2                    "pipe2"

#define EVT_STR_PLUGINEVENT              "pluginevent"

#define EVT_STR_POLL                     "poll"

#define EVT_STR_PPOLL                    "ppoll"

#define EVT_STR_PRCTL                    "prctl"

#define EVT_STR_PREAD                    "pread"

#define EVT_STR_PREADV                   "preadv"

#define EVT_STR_PRLIMIT                  "prlimit"

#define EVT_STR_PROCESS_VM_READV         "process_vm_readv"

#define EVT_STR_PROCESS_VM_WRITEV        "process_vm_writev"

#define EVT_STR_PROCEXIT                 "procexit"

#define EVT_STR_PROCINFO                 "procinfo"

#define EVT_STR_PTRACE                   "ptrace"

#define EVT_STR_PWRITE                   "pwrite"

#define EVT_STR_PWRITEV                  "pwritev"

#define EVT_STR_QUOTACTL                 "quotactl"

#define EVT_STR_READ                     "read"

#define EVT_STR_READV                    "readv"

#define EVT_STR_RECV                     "recv"

#define EVT_STR_RECVFROM                 "recvfrom"

#define EVT_STR_RECVMMSG                 "recvmmsg"

#define EVT_STR_RECVMSG                  "recvmsg"

#define EVT_STR_RENAME                   "rename"

#define EVT_STR_RENAMEAT                 "renameat"

#define EVT_STR_RENAMEAT2                "renameat2"

#define EVT_STR_RMDIR                    "rmdir"

#define EVT_STR_SCAPEVENT                "scapevent"

#define EVT_STR_SECCOMP                  "seccomp"

#define EVT_STR_SELECT                   "select"

#define EVT_STR_SEMCTL                   "semctl"

#define EVT_STR_SEMGET                   "semget"

#define EVT_STR_SEMOP                    "semop"

#define EVT_STR_SEND                     "send"

#define EVT_STR_SENDFILE                 "sendfile"

#define EVT_STR_SENDMMSG                 "sendmmsg"

#define EVT_STR_SENDMSG                  "sendmsg"

#define EVT_STR_SENDTO                   "sendto"

#define EVT_STR_SETGID                   "setgid"

#define EVT_STR_SETNS                    "setns"

#define EVT_STR_SETPGID                  "setpgid"

#define EVT_STR_SETREGID                 "setregid"

#define EVT_STR_SETRESGID                "setresgid"

#define EVT_STR_SETRESUID                "setresuid"

#define EVT_STR_SETREUID                 "setreuid"

#define EVT_STR_SETRLIMIT                "setrlimit"

#define EVT_STR_SETSID                   "setsid"

#define EVT_STR_SETSOCKOPT               "setsockopt"

#define EVT_STR_SETUID                   "setuid"

#define EVT_STR_SHUTDOWN                 "shutdown"

#define EVT_STR_SIGNALDELIVER            "signaldeliver"

#define EVT_STR_SIGNALFD                 "signalfd"

#define EVT_STR_SIGNALFD4                "signalfd4"

#define EVT_STR_SOCKET                   "socket"

#define EVT_STR_SOCKETPAIR               "socketpair"

#define EVT_STR_SPLICE                   "splice"

#define EVT_STR_STAT                     "stat"

#define EVT_STR_STAT64                   "stat64"

#define EVT_STR_SWITCH                   "switch"

#define EVT_STR_SYMLINK                  "symlink"

#define EVT_STR_SYMLINKAT                "symlinkat"

#define EVT_STR_SYSCALL                  "syscall"

#define EVT_STR_TGKILL                   "tgkill"

#define EVT_STR_TIMERFD_CREATE           "timerfd_create"

#define EVT_STR_TKILL                    "tkill"

#define EVT_STR_TRACER                   "tracer"

#define EVT_STR_UMOUNT                   "umount"

#define EVT_STR_UMOUNT2                  "umount2"

#define EVT_STR_UNLINK                   "unlink"

#define EVT_STR_UNLINKAT                 "unlinkat"

#define EVT_STR_UNSHARE                  "unshare"

#define EVT_STR_USERADDED                "useradded"

#define EVT_STR_USERDELETED              "userdeleted"

#define EVT_STR_USERFAULTFD              "userfaultfd"

#define EVT_STR_VFORK                    "vfork"

#define EVT_STR_WRITE                    "write"

#define EVT_STR_WRITEV                   "writev"

/* EVT_... = PPME_... */

/* Event definitions. Automatically generated by tools/generate-sysdig-event.py */

#define EVT_GENERIC_E                  0

#define EVT_GENERIC_X                  1

#define EVT_SYSCALL_OPEN_E             2

#define EVT_SYSCALL_OPEN_X             3

#define EVT_SYSCALL_CLOSE_E            4

#define EVT_SYSCALL_CLOSE_X            5

#define EVT_SYSCALL_READ_E             6

#define EVT_SYSCALL_READ_X             7

#define EVT_SYSCALL_WRITE_E            8

#define EVT_SYSCALL_WRITE_X            9

#define EVT_SYSCALL_BRK_1_E           10

#define EVT_SYSCALL_BRK_1_X           11

#define EVT_SYSCALL_EXECVE_8_E        12

#define EVT_SYSCALL_EXECVE_8_X        13

#define EVT_SYSCALL_CLONE_11_E        14

#define EVT_SYSCALL_CLONE_11_X        15

#define EVT_PROCEXIT_E                16

#define EVT_PROCEXIT_X                17

#define EVT_SOCKET_SOCKET_E           18

#define EVT_SOCKET_SOCKET_X           19

#define EVT_SOCKET_BIND_E             20

#define EVT_SOCKET_BIND_X             21

#define EVT_SOCKET_CONNECT_E          22

#define EVT_SOCKET_CONNECT_X          23

#define EVT_SOCKET_LISTEN_E           24

#define EVT_SOCKET_LISTEN_X           25

#define EVT_SOCKET_ACCEPT_E           26

#define EVT_SOCKET_ACCEPT_X           27

#define EVT_SOCKET_SEND_E             28

#define EVT_SOCKET_SEND_X             29

#define EVT_SOCKET_SENDTO_E           30

#define EVT_SOCKET_SENDTO_X           31

#define EVT_SOCKET_RECV_E             32

#define EVT_SOCKET_RECV_X             33

#define EVT_SOCKET_RECVFROM_E         34

#define EVT_SOCKET_RECVFROM_X         35

#define EVT_SOCKET_SHUTDOWN_E         36

#define EVT_SOCKET_SHUTDOWN_X         37

#define EVT_SOCKET_GETSOCKNAME_E      38

#define EVT_SOCKET_GETSOCKNAME_X      39

#define EVT_SOCKET_GETPEERNAME_E      40

#define EVT_SOCKET_GETPEERNAME_X      41

#define EVT_SOCKET_SOCKETPAIR_E       42

#define EVT_SOCKET_SOCKETPAIR_X       43

#define EVT_SOCKET_SETSOCKOPT_E       44

#define EVT_SOCKET_SETSOCKOPT_X       45

#define EVT_SOCKET_GETSOCKOPT_E       46

#define EVT_SOCKET_GETSOCKOPT_X       47

#define EVT_SOCKET_SENDMSG_E          48

#define EVT_SOCKET_SENDMSG_X          49

#define EVT_SOCKET_SENDMMSG_E         50

#define EVT_SOCKET_SENDMMSG_X         51

#define EVT_SOCKET_RECVMSG_E          52

#define EVT_SOCKET_RECVMSG_X          53

#define EVT_SOCKET_RECVMMSG_E         54

#define EVT_SOCKET_RECVMMSG_X         55

#define EVT_SOCKET_ACCEPT4_E          56

#define EVT_SOCKET_ACCEPT4_X          57

#define EVT_SYSCALL_CREAT_E           58

#define EVT_SYSCALL_CREAT_X           59

#define EVT_SYSCALL_PIPE_E            60

#define EVT_SYSCALL_PIPE_X            61

#define EVT_SYSCALL_EVENTFD_E         62

#define EVT_SYSCALL_EVENTFD_X         63

#define EVT_SYSCALL_FUTEX_E           64

#define EVT_SYSCALL_FUTEX_X           65

#define EVT_SYSCALL_STAT_E            66

#define EVT_SYSCALL_STAT_X            67

#define EVT_SYSCALL_LSTAT_E           68

#define EVT_SYSCALL_LSTAT_X           69

#define EVT_SYSCALL_FSTAT_E           70

#define EVT_SYSCALL_FSTAT_X           71

#define EVT_SYSCALL_STAT64_E          72

#define EVT_SYSCALL_STAT64_X          73

#define EVT_SYSCALL_LSTAT64_E         74

#define EVT_SYSCALL_LSTAT64_X         75

#define EVT_SYSCALL_FSTAT64_E         76

#define EVT_SYSCALL_FSTAT64_X         77

#define EVT_SYSCALL_EPOLLWAIT_E       78

#define EVT_SYSCALL_EPOLLWAIT_X       79

#define EVT_SYSCALL_POLL_E            80

#define EVT_SYSCALL_POLL_X            81

#define EVT_SYSCALL_SELECT_E          82

#define EVT_SYSCALL_SELECT_X          83

#define EVT_SYSCALL_NEWSELECT_E       84

#define EVT_SYSCALL_NEWSELECT_X       85

#define EVT_SYSCALL_LSEEK_E           86

#define EVT_SYSCALL_LSEEK_X           87

#define EVT_SYSCALL_LLSEEK_E          88

#define EVT_SYSCALL_LLSEEK_X          89

#define EVT_SYSCALL_IOCTL_2_E         90

#define EVT_SYSCALL_IOCTL_2_X         91

#define EVT_SYSCALL_GETCWD_E          92

#define EVT_SYSCALL_GETCWD_X          93

#define EVT_SYSCALL_CHDIR_E           94

#define EVT_SYSCALL_CHDIR_X           95

#define EVT_SYSCALL_FCHDIR_E          96

#define EVT_SYSCALL_FCHDIR_X          97

#define EVT_SYSCALL_MKDIR_E           98

#define EVT_SYSCALL_MKDIR_X           99

#define EVT_SYSCALL_RMDIR_E          100

#define EVT_SYSCALL_RMDIR_X          101

#define EVT_SYSCALL_OPENAT_E         102

#define EVT_SYSCALL_OPENAT_X         103

#define EVT_SYSCALL_LINK_E           104

#define EVT_SYSCALL_LINK_X           105

#define EVT_SYSCALL_LINKAT_E         106

#define EVT_SYSCALL_LINKAT_X         107

#define EVT_SYSCALL_UNLINK_E         108

#define EVT_SYSCALL_UNLINK_X         109

#define EVT_SYSCALL_UNLINKAT_E       110

#define EVT_SYSCALL_UNLINKAT_X       111

#define EVT_SYSCALL_PREAD_E          112

#define EVT_SYSCALL_PREAD_X          113

#define EVT_SYSCALL_PWRITE_E         114

#define EVT_SYSCALL_PWRITE_X         115

#define EVT_SYSCALL_READV_E          116

#define EVT_SYSCALL_READV_X          117

#define EVT_SYSCALL_WRITEV_E         118

#define EVT_SYSCALL_WRITEV_X         119

#define EVT_SYSCALL_PREADV_E         120

#define EVT_SYSCALL_PREADV_X         121

#define EVT_SYSCALL_PWRITEV_E        122

#define EVT_SYSCALL_PWRITEV_X        123

#define EVT_SYSCALL_DUP_E            124

#define EVT_SYSCALL_DUP_X            125

#define EVT_SYSCALL_SIGNALFD_E       126

#define EVT_SYSCALL_SIGNALFD_X       127

#define EVT_SYSCALL_KILL_E           128

#define EVT_SYSCALL_KILL_X           129

#define EVT_SYSCALL_TKILL_E          130

#define EVT_SYSCALL_TKILL_X          131

#define EVT_SYSCALL_TGKILL_E         132

#define EVT_SYSCALL_TGKILL_X         133

#define EVT_SYSCALL_NANOSLEEP_E      134

#define EVT_SYSCALL_NANOSLEEP_X      135

#define EVT_SYSCALL_TIMERFD_CREATE_E 136

#define EVT_SYSCALL_TIMERFD_CREATE_X 137

#define EVT_SYSCALL_INOTIFY_INIT_E   138

#define EVT_SYSCALL_INOTIFY_INIT_X   139

#define EVT_SYSCALL_GETRLIMIT_E      140

#define EVT_SYSCALL_GETRLIMIT_X      141

#define EVT_SYSCALL_SETRLIMIT_E      142

#define EVT_SYSCALL_SETRLIMIT_X      143

#define EVT_SYSCALL_PRLIMIT_E        144

#define EVT_SYSCALL_PRLIMIT_X        145

#define EVT_SCHEDSWITCH_1_E          146

#define EVT_SCHEDSWITCH_1_X          147

#define EVT_DROP_E                   148

#define EVT_DROP_X                   149

#define EVT_SYSCALL_FCNTL_E          150

#define EVT_SYSCALL_FCNTL_X          151

#define EVT_SCHEDSWITCH_6_E          152

#define EVT_SCHEDSWITCH_6_X          153

#define EVT_SYSCALL_EXECVE_13_E      154

#define EVT_SYSCALL_EXECVE_13_X      155

#define EVT_SYSCALL_CLONE_16_E       156

#define EVT_SYSCALL_CLONE_16_X       157

#define EVT_SYSCALL_BRK_4_E          158

#define EVT_SYSCALL_BRK_4_X          159

#define EVT_SYSCALL_MMAP_E           160

#define EVT_SYSCALL_MMAP_X           161

#define EVT_SYSCALL_MMAP2_E          162

#define EVT_SYSCALL_MMAP2_X          163

#define EVT_SYSCALL_MUNMAP_E         164

#define EVT_SYSCALL_MUNMAP_X         165

#define EVT_SYSCALL_SPLICE_E         166

#define EVT_SYSCALL_SPLICE_X         167

#define EVT_SYSCALL_PTRACE_E         168

#define EVT_SYSCALL_PTRACE_X         169

#define EVT_SYSCALL_IOCTL_3_E        170

#define EVT_SYSCALL_IOCTL_3_X        171

#define EVT_SYSCALL_EXECVE_14_E      172

#define EVT_SYSCALL_EXECVE_14_X      173

#define EVT_SYSCALL_RENAME_E         174

#define EVT_SYSCALL_RENAME_X         175

#define EVT_SYSCALL_RENAMEAT_E       176

#define EVT_SYSCALL_RENAMEAT_X       177

#define EVT_SYSCALL_SYMLINK_E        178

#define EVT_SYSCALL_SYMLINK_X        179

#define EVT_SYSCALL_SYMLINKAT_E      180

#define EVT_SYSCALL_SYMLINKAT_X      181

#define EVT_SYSCALL_FORK_E           182

#define EVT_SYSCALL_FORK_X           183

#define EVT_SYSCALL_VFORK_E          184

#define EVT_SYSCALL_VFORK_X          185

#define EVT_PROCEXIT_1_E             186

#define EVT_PROCEXIT_1_X             187

#define EVT_SYSCALL_SENDFILE_E       188

#define EVT_SYSCALL_SENDFILE_X       189

#define EVT_SYSCALL_QUOTACTL_E       190

#define EVT_SYSCALL_QUOTACTL_X       191

#define EVT_SYSCALL_SETRESUID_E      192

#define EVT_SYSCALL_SETRESUID_X      193

#define EVT_SYSCALL_SETRESGID_E      194

#define EVT_SYSCALL_SETRESGID_X      195

#define EVT_SCAPEVENT_E              196

#define EVT_SCAPEVENT_X              197

#define EVT_SYSCALL_SETUID_E         198

#define EVT_SYSCALL_SETUID_X         199

#define EVT_SYSCALL_SETGID_E         200

#define EVT_SYSCALL_SETGID_X         201

#define EVT_SYSCALL_GETUID_E         202

#define EVT_SYSCALL_GETUID_X         203

#define EVT_SYSCALL_GETEUID_E        204

#define EVT_SYSCALL_GETEUID_X        205

#define EVT_SYSCALL_GETGID_E         206

#define EVT_SYSCALL_GETGID_X         207

#define EVT_SYSCALL_GETEGID_E        208

#define EVT_SYSCALL_GETEGID_X        209

#define EVT_SYSCALL_GETRESUID_E      210

#define EVT_SYSCALL_GETRESUID_X      211

#define EVT_SYSCALL_GETRESGID_E      212

#define EVT_SYSCALL_GETRESGID_X      213

#define EVT_SYSCALL_EXECVE_15_E      214

#define EVT_SYSCALL_EXECVE_15_X      215

#define EVT_SYSCALL_CLONE_17_E       216

#define EVT_SYSCALL_CLONE_17_X       217

#define EVT_SYSCALL_FORK_17_E        218

#define EVT_SYSCALL_FORK_17_X        219

#define EVT_SYSCALL_VFORK_17_E       220

#define EVT_SYSCALL_VFORK_17_X       221

#define EVT_SYSCALL_CLONE_20_E       222

#define EVT_SYSCALL_CLONE_20_X       223

#define EVT_SYSCALL_FORK_20_E        224

#define EVT_SYSCALL_FORK_20_X        225

#define EVT_SYSCALL_VFORK_20_E       226

#define EVT_SYSCALL_VFORK_20_X       227

#define EVT_CONTAINER_E              228

#define EVT_CONTAINER_X              229

#define EVT_SYSCALL_EXECVE_16_E      230

#define EVT_SYSCALL_EXECVE_16_X      231

#define EVT_SIGNALDELIVER_E          232

#define EVT_SIGNALDELIVER_X          233

#define EVT_PROCINFO_E               234

#define EVT_PROCINFO_X               235

#define EVT_SYSCALL_GETDENTS_E       236

#define EVT_SYSCALL_GETDENTS_X       237

#define EVT_SYSCALL_GETDENTS64_E     238

#define EVT_SYSCALL_GETDENTS64_X     239

#define EVT_SYSCALL_SETNS_E          240

#define EVT_SYSCALL_SETNS_X          241

#define EVT_SYSCALL_FLOCK_E          242

#define EVT_SYSCALL_FLOCK_X          243

#define EVT_CPU_HOTPLUG_E            244

#define EVT_CPU_HOTPLUG_X            245

#define EVT_SOCKET_ACCEPT_5_E        246

#define EVT_SOCKET_ACCEPT_5_X        247

#define EVT_SOCKET_ACCEPT4_5_E       248

#define EVT_SOCKET_ACCEPT4_5_X       249

#define EVT_SYSCALL_SEMOP_E          250

#define EVT_SYSCALL_SEMOP_X          251

#define EVT_SYSCALL_SEMCTL_E         252

#define EVT_SYSCALL_SEMCTL_X         253

#define EVT_SYSCALL_PPOLL_E          254

#define EVT_SYSCALL_PPOLL_X          255

#define EVT_SYSCALL_MOUNT_E          256

#define EVT_SYSCALL_MOUNT_X          257

#define EVT_SYSCALL_UMOUNT_E         258

#define EVT_SYSCALL_UMOUNT_X         259

#define EVT_K8S_E                    260

#define EVT_K8S_X                    261

#define EVT_SYSCALL_SEMGET_E         262

#define EVT_SYSCALL_SEMGET_X         263

#define EVT_SYSCALL_ACCESS_E         264

#define EVT_SYSCALL_ACCESS_X         265

#define EVT_SYSCALL_CHROOT_E         266

#define EVT_SYSCALL_CHROOT_X         267

#define EVT_TRACER_E                 268

#define EVT_TRACER_X                 269

#define EVT_MESOS_E                  270

#define EVT_MESOS_X                  271

#define EVT_CONTAINER_JSON_E         272

#define EVT_CONTAINER_JSON_X         273

#define EVT_SYSCALL_SETSID_E         274

#define EVT_SYSCALL_SETSID_X         275

#define EVT_SYSCALL_MKDIR_2_E        276

#define EVT_SYSCALL_MKDIR_2_X        277

#define EVT_SYSCALL_RMDIR_2_E        278

#define EVT_SYSCALL_RMDIR_2_X        279

#define EVT_NOTIFICATION_E           280

#define EVT_NOTIFICATION_X           281

#define EVT_SYSCALL_EXECVE_17_E      282

#define EVT_SYSCALL_EXECVE_17_X      283

#define EVT_SYSCALL_UNSHARE_E        284

#define EVT_SYSCALL_UNSHARE_X        285

#define EVT_INFRASTRUCTURE_EVENT_E   286

#define EVT_INFRASTRUCTURE_EVENT_X   287

#define EVT_SYSCALL_EXECVE_18_E      288

#define EVT_SYSCALL_EXECVE_18_X      289

#define EVT_PAGE_FAULT_E             290

#define EVT_PAGE_FAULT_X             291

#define EVT_SYSCALL_EXECVE_19_E      292

#define EVT_SYSCALL_EXECVE_19_X      293

#define EVT_SYSCALL_SETPGID_E        294

#define EVT_SYSCALL_SETPGID_X        295

#define EVT_SYSCALL_BPF_E            296

#define EVT_SYSCALL_BPF_X            297

#define EVT_SYSCALL_SECCOMP_E        298

#define EVT_SYSCALL_SECCOMP_X        299

#define EVT_SYSCALL_UNLINK_2_E       300

#define EVT_SYSCALL_UNLINK_2_X       301

#define EVT_SYSCALL_UNLINKAT_2_E     302

#define EVT_SYSCALL_UNLINKAT_2_X     303

#define EVT_SYSCALL_MKDIRAT_E        304

#define EVT_SYSCALL_MKDIRAT_X        305

#define EVT_SYSCALL_OPENAT_2_E       306

#define EVT_SYSCALL_OPENAT_2_X       307

#define EVT_SYSCALL_LINK_2_E         308

#define EVT_SYSCALL_LINK_2_X         309

#define EVT_SYSCALL_LINKAT_2_E       310

#define EVT_SYSCALL_LINKAT_2_X       311

#define EVT_SYSCALL_FCHMODAT_E       312

#define EVT_SYSCALL_FCHMODAT_X       313

#define EVT_SYSCALL_CHMOD_E          314

#define EVT_SYSCALL_CHMOD_X          315

#define EVT_SYSCALL_FCHMOD_E         316

#define EVT_SYSCALL_FCHMOD_X         317

#define EVT_SYSCALL_RENAMEAT2_E      318

#define EVT_SYSCALL_RENAMEAT2_X      319

#define EVT_SYSCALL_USERFAULTFD_E    320

#define EVT_SYSCALL_USERFAULTFD_X    321

#define EVT_PLUGINEVENT_E            322

#define EVT_PLUGINEVENT_X            323

#define EVT_CONTAINER_JSON_2_E       324

#define EVT_CONTAINER_JSON_2_X       325

#define EVT_SYSCALL_OPENAT2_E        326

#define EVT_SYSCALL_OPENAT2_X        327

#define EVT_SYSCALL_MPROTECT_E       328

#define EVT_SYSCALL_MPROTECT_X       329

#define EVT_SYSCALL_EXECVEAT_E       330

#define EVT_SYSCALL_EXECVEAT_X       331

#define EVT_SYSCALL_COPY_FILE_RANGE_E 332

#define EVT_SYSCALL_COPY_FILE_RANGE_X 333

#define EVT_SYSCALL_CLONE3_E         334

#define EVT_SYSCALL_CLONE3_X         335

#define EVT_SYSCALL_OPEN_BY_HANDLE_AT_E 336

#define EVT_SYSCALL_OPEN_BY_HANDLE_AT_X 337

#define EVT_SYSCALL_IO_URING_SETUP_E 338

#define EVT_SYSCALL_IO_URING_SETUP_X 339

#define EVT_SYSCALL_IO_URING_ENTER_E 340

#define EVT_SYSCALL_IO_URING_ENTER_X 341

#define EVT_SYSCALL_IO_URING_REGISTER_E 342

#define EVT_SYSCALL_IO_URING_REGISTER_X 343

#define EVT_SYSCALL_MLOCK_E          344

#define EVT_SYSCALL_MLOCK_X          345

#define EVT_SYSCALL_MUNLOCK_E        346

#define EVT_SYSCALL_MUNLOCK_X        347

#define EVT_SYSCALL_MLOCKALL_E       348

#define EVT_SYSCALL_MLOCKALL_X       349

#define EVT_SYSCALL_MUNLOCKALL_E     350

#define EVT_SYSCALL_MUNLOCKALL_X     351

#define EVT_SYSCALL_CAPSET_E         352

#define EVT_SYSCALL_CAPSET_X         353

#define EVT_USER_ADDED_E             354

#define EVT_USER_ADDED_X             355

#define EVT_USER_DELETED_E           356

#define EVT_USER_DELETED_X           357

#define EVT_GROUP_ADDED_E            358

#define EVT_GROUP_ADDED_X            359

#define EVT_GROUP_DELETED_E          360

#define EVT_GROUP_DELETED_X          361

#define EVT_SYSCALL_DUP2_E           362

#define EVT_SYSCALL_DUP2_X           363

#define EVT_SYSCALL_DUP3_E           364

#define EVT_SYSCALL_DUP3_X           365

#define EVT_SYSCALL_DUP_1_E          366

#define EVT_SYSCALL_DUP_1_X          367

#define EVT_SYSCALL_BPF_2_E          368

#define EVT_SYSCALL_BPF_2_X          369

#define EVT_SYSCALL_MLOCK2_E         370

#define EVT_SYSCALL_MLOCK2_X         371

#define EVT_SYSCALL_FSCONFIG_E       372

#define EVT_SYSCALL_FSCONFIG_X       373

#define EVT_SYSCALL_EPOLL_CREATE_E   374

#define EVT_SYSCALL_EPOLL_CREATE_X   375

#define EVT_SYSCALL_EPOLL_CREATE1_E  376

#define EVT_SYSCALL_EPOLL_CREATE1_X  377

#define EVT_SYSCALL_CHOWN_E          378

#define EVT_SYSCALL_CHOWN_X          379

#define EVT_SYSCALL_LCHOWN_E         380

#define EVT_SYSCALL_LCHOWN_X         381

#define EVT_SYSCALL_FCHOWN_E         382

#define EVT_SYSCALL_FCHOWN_X         383

#define EVT_SYSCALL_FCHOWNAT_E       384

#define EVT_SYSCALL_FCHOWNAT_X       385

#define EVT_SYSCALL_UMOUNT_1_E       386

#define EVT_SYSCALL_UMOUNT_1_X       387

#define EVT_SOCKET_ACCEPT4_6_E       388

#define EVT_SOCKET_ACCEPT4_6_X       389

#define EVT_SYSCALL_UMOUNT2_E        390

#define EVT_SYSCALL_UMOUNT2_X        391

#define EVT_SYSCALL_PIPE2_E          392

#define EVT_SYSCALL_PIPE2_X          393

#define EVT_SYSCALL_INOTIFY_INIT1_E  394

#define EVT_SYSCALL_INOTIFY_INIT1_X  395

#define EVT_SYSCALL_EVENTFD2_E       396

#define EVT_SYSCALL_EVENTFD2_X       397

#define EVT_SYSCALL_SIGNALFD4_E      398

#define EVT_SYSCALL_SIGNALFD4_X      399

#define EVT_SYSCALL_PRCTL_E          400

#define EVT_SYSCALL_PRCTL_X          401

#define EVT_ASYNCEVENT_E             402

#define EVT_ASYNCEVENT_X             403

#define EVT_SYSCALL_MEMFD_CREATE_E   404

#define EVT_SYSCALL_MEMFD_CREATE_X   405

#define EVT_SYSCALL_PIDFD_GETFD_E    406

#define EVT_SYSCALL_PIDFD_GETFD_X    407

#define EVT_SYSCALL_PIDFD_OPEN_E     408

#define EVT_SYSCALL_PIDFD_OPEN_X     409

#define EVT_SYSCALL_INIT_MODULE_E    410

#define EVT_SYSCALL_INIT_MODULE_X    411

#define EVT_SYSCALL_FINIT_MODULE_E   412

#define EVT_SYSCALL_FINIT_MODULE_X   413

#define EVT_SYSCALL_MKNOD_E          414

#define EVT_SYSCALL_MKNOD_X          415

#define EVT_SYSCALL_MKNODAT_E        416

#define EVT_SYSCALL_MKNODAT_X        417

#define EVT_SYSCALL_NEWFSTATAT_E     418

#define EVT_SYSCALL_NEWFSTATAT_X     419

#define EVT_SYSCALL_PROCESS_VM_READV_E 420

#define EVT_SYSCALL_PROCESS_VM_READV_X 421

#define EVT_SYSCALL_PROCESS_VM_WRITEV_E 422

#define EVT_SYSCALL_PROCESS_VM_WRITEV_X 423

#define EVT_SYSCALL_DELETE_MODULE_E  424

#define EVT_SYSCALL_DELETE_MODULE_X  425

#define EVT_SYSCALL_SETREUID_E       426

#define EVT_SYSCALL_SETREUID_X       427

#define EVT_SYSCALL_SETREGID_E       428

#define EVT_SYSCALL_SETREGID_X       429

static const value_string event_type_vals[] = {

/* Value strings. Automatically generated by tools/generate-sysdig-event.py */

    { EVT_GENERIC_E,                   EVT_STR_SYSCALL },

    { EVT_GENERIC_X,                   EVT_STR_SYSCALL },

    { EVT_SYSCALL_OPEN_E,              EVT_STR_OPEN },

    { EVT_SYSCALL_OPEN_X,              EVT_STR_OPEN },

    { EVT_SYSCALL_CLOSE_E,             EVT_STR_CLOSE },

    { EVT_SYSCALL_CLOSE_X,             EVT_STR_CLOSE },

    { EVT_SYSCALL_READ_E,              EVT_STR_READ },

    { EVT_SYSCALL_READ_X,              EVT_STR_READ },

    { EVT_SYSCALL_WRITE_E,             EVT_STR_WRITE },

    { EVT_SYSCALL_WRITE_X,             EVT_STR_WRITE },

    { EVT_SYSCALL_BRK_1_E,             EVT_STR_BRK },

    { EVT_SYSCALL_BRK_1_X,             EVT_STR_BRK },

    { EVT_SYSCALL_EXECVE_8_E,          EVT_STR_EXECVE },

    { EVT_SYSCALL_EXECVE_8_X,          EVT_STR_EXECVE },

    { EVT_SYSCALL_CLONE_11_E,          EVT_STR_CLONE },

    { EVT_SYSCALL_CLONE_11_X,          EVT_STR_CLONE },

    { EVT_PROCEXIT_E,                  EVT_STR_PROCEXIT },

    { EVT_PROCEXIT_X,                  EVT_STR_NA },

    { EVT_SOCKET_SOCKET_E,             EVT_STR_SOCKET },

    { EVT_SOCKET_SOCKET_X,             EVT_STR_SOCKET },

    { EVT_SOCKET_BIND_E,               EVT_STR_BIND },

    { EVT_SOCKET_BIND_X,               EVT_STR_BIND },

    { EVT_SOCKET_CONNECT_E,            EVT_STR_CONNECT },

    { EVT_SOCKET_CONNECT_X,            EVT_STR_CONNECT },

    { EVT_SOCKET_LISTEN_E,             EVT_STR_LISTEN },

    { EVT_SOCKET_LISTEN_X,             EVT_STR_LISTEN },

    { EVT_SOCKET_ACCEPT_E,             EVT_STR_ACCEPT },

    { EVT_SOCKET_ACCEPT_X,             EVT_STR_ACCEPT },

    { EVT_SOCKET_SEND_E,               EVT_STR_SEND },

    { EVT_SOCKET_SEND_X,               EVT_STR_SEND },

    { EVT_SOCKET_SENDTO_E,             EVT_STR_SENDTO },

    { EVT_SOCKET_SENDTO_X,             EVT_STR_SENDTO },

    { EVT_SOCKET_RECV_E,               EVT_STR_RECV },

    { EVT_SOCKET_RECV_X,               EVT_STR_RECV },

    { EVT_SOCKET_RECVFROM_E,           EVT_STR_RECVFROM },

    { EVT_SOCKET_RECVFROM_X,           EVT_STR_RECVFROM },

    { EVT_SOCKET_SHUTDOWN_E,           EVT_STR_SHUTDOWN },

    { EVT_SOCKET_SHUTDOWN_X,           EVT_STR_SHUTDOWN },

    { EVT_SOCKET_GETSOCKNAME_E,        EVT_STR_GETSOCKNAME },

    { EVT_SOCKET_GETSOCKNAME_X,        EVT_STR_GETSOCKNAME },

    { EVT_SOCKET_GETPEERNAME_E,        EVT_STR_GETPEERNAME },

    { EVT_SOCKET_GETPEERNAME_X,        EVT_STR_GETPEERNAME },

    { EVT_SOCKET_SOCKETPAIR_E,         EVT_STR_SOCKETPAIR },

    { EVT_SOCKET_SOCKETPAIR_X,         EVT_STR_SOCKETPAIR },

    { EVT_SOCKET_SETSOCKOPT_E,         EVT_STR_SETSOCKOPT },

    { EVT_SOCKET_SETSOCKOPT_X,         EVT_STR_SETSOCKOPT },

    { EVT_SOCKET_GETSOCKOPT_E,         EVT_STR_GETSOCKOPT },

    { EVT_SOCKET_GETSOCKOPT_X,         EVT_STR_GETSOCKOPT },

    { EVT_SOCKET_SENDMSG_E,            EVT_STR_SENDMSG },

    { EVT_SOCKET_SENDMSG_X,            EVT_STR_SENDMSG },

    { EVT_SOCKET_SENDMMSG_E,           EVT_STR_SENDMMSG },

    { EVT_SOCKET_SENDMMSG_X,           EVT_STR_SENDMMSG },

    { EVT_SOCKET_RECVMSG_E,            EVT_STR_RECVMSG },

    { EVT_SOCKET_RECVMSG_X,            EVT_STR_RECVMSG },

    { EVT_SOCKET_RECVMMSG_E,           EVT_STR_RECVMMSG },

    { EVT_SOCKET_RECVMMSG_X,           EVT_STR_RECVMMSG },

    { EVT_SOCKET_ACCEPT4_E,            EVT_STR_ACCEPT },

    { EVT_SOCKET_ACCEPT4_X,            EVT_STR_ACCEPT },

    { EVT_SYSCALL_CREAT_E,             EVT_STR_CREAT },

    { EVT_SYSCALL_CREAT_X,             EVT_STR_CREAT },

    { EVT_SYSCALL_PIPE_E,              EVT_STR_PIPE },

    { EVT_SYSCALL_PIPE_X,              EVT_STR_PIPE },

    { EVT_SYSCALL_EVENTFD_E,           EVT_STR_EVENTFD },

    { EVT_SYSCALL_EVENTFD_X,           EVT_STR_EVENTFD },

    { EVT_SYSCALL_FUTEX_E,             EVT_STR_FUTEX },

    { EVT_SYSCALL_FUTEX_X,             EVT_STR_FUTEX },

    { EVT_SYSCALL_STAT_E,              EVT_STR_STAT },

    { EVT_SYSCALL_STAT_X,              EVT_STR_STAT },

    { EVT_SYSCALL_LSTAT_E,             EVT_STR_LSTAT },

    { EVT_SYSCALL_LSTAT_X,             EVT_STR_LSTAT },

    { EVT_SYSCALL_FSTAT_E,             EVT_STR_FSTAT },

    { EVT_SYSCALL_FSTAT_X,             EVT_STR_FSTAT },

    { EVT_SYSCALL_STAT64_E,            EVT_STR_STAT64 },

    { EVT_SYSCALL_STAT64_X,            EVT_STR_STAT64 },

    { EVT_SYSCALL_LSTAT64_E,           EVT_STR_LSTAT64 },

    { EVT_SYSCALL_LSTAT64_X,           EVT_STR_LSTAT64 },

    { EVT_SYSCALL_FSTAT64_E,           EVT_STR_FSTAT64 },

    { EVT_SYSCALL_FSTAT64_X,           EVT_STR_FSTAT64 },

    { EVT_SYSCALL_EPOLLWAIT_E,         EVT_STR_EPOLL_WAIT },

    { EVT_SYSCALL_EPOLLWAIT_X,         EVT_STR_EPOLL_WAIT },

    { EVT_SYSCALL_POLL_E,              EVT_STR_POLL },

    { EVT_SYSCALL_POLL_X,              EVT_STR_POLL },

    { EVT_SYSCALL_SELECT_E,            EVT_STR_SELECT },

    { EVT_SYSCALL_SELECT_X,            EVT_STR_SELECT },

    { EVT_SYSCALL_NEWSELECT_E,         EVT_STR_SELECT },

    { EVT_SYSCALL_NEWSELECT_X,         EVT_STR_SELECT },

    { EVT_SYSCALL_LSEEK_E,             EVT_STR_LSEEK },

    { EVT_SYSCALL_LSEEK_X,             EVT_STR_LSEEK },

    { EVT_SYSCALL_LLSEEK_E,            EVT_STR_LLSEEK },

    { EVT_SYSCALL_LLSEEK_X,            EVT_STR_LLSEEK },

    { EVT_SYSCALL_IOCTL_2_E,           EVT_STR_IOCTL },

    { EVT_SYSCALL_IOCTL_2_X,           EVT_STR_IOCTL },

    { EVT_SYSCALL_GETCWD_E,            EVT_STR_GETCWD },

    { EVT_SYSCALL_GETCWD_X,            EVT_STR_GETCWD },

    { EVT_SYSCALL_CHDIR_E,             EVT_STR_CHDIR },

    { EVT_SYSCALL_CHDIR_X,             EVT_STR_CHDIR },

    { EVT_SYSCALL_FCHDIR_E,            EVT_STR_FCHDIR },

    { EVT_SYSCALL_FCHDIR_X,            EVT_STR_FCHDIR },

    { EVT_SYSCALL_MKDIR_E,             EVT_STR_MKDIR },

    { EVT_SYSCALL_MKDIR_X,             EVT_STR_MKDIR },

    { EVT_SYSCALL_RMDIR_E,             EVT_STR_RMDIR },

    { EVT_SYSCALL_RMDIR_X,             EVT_STR_RMDIR },

    { EVT_SYSCALL_OPENAT_E,            EVT_STR_OPENAT },

    { EVT_SYSCALL_OPENAT_X,            EVT_STR_OPENAT },

    { EVT_SYSCALL_LINK_E,              EVT_STR_LINK },

    { EVT_SYSCALL_LINK_X,              EVT_STR_LINK },

    { EVT_SYSCALL_LINKAT_E,            EVT_STR_LINKAT },

    { EVT_SYSCALL_LINKAT_X,            EVT_STR_LINKAT },

    { EVT_SYSCALL_UNLINK_E,            EVT_STR_UNLINK },

    { EVT_SYSCALL_UNLINK_X,            EVT_STR_UNLINK },

    { EVT_SYSCALL_UNLINKAT_E,          EVT_STR_UNLINKAT },

    { EVT_SYSCALL_UNLINKAT_X,          EVT_STR_UNLINKAT },

    { EVT_SYSCALL_PREAD_E,             EVT_STR_PREAD },

    { EVT_SYSCALL_PREAD_X,             EVT_STR_PREAD },

    { EVT_SYSCALL_PWRITE_E,            EVT_STR_PWRITE },

    { EVT_SYSCALL_PWRITE_X,            EVT_STR_PWRITE },

    { EVT_SYSCALL_READV_E,             EVT_STR_READV },

    { EVT_SYSCALL_READV_X,             EVT_STR_READV },

    { EVT_SYSCALL_WRITEV_E,            EVT_STR_WRITEV },

    { EVT_SYSCALL_WRITEV_X,            EVT_STR_WRITEV },

    { EVT_SYSCALL_PREADV_E,            EVT_STR_PREADV },

    { EVT_SYSCALL_PREADV_X,            EVT_STR_PREADV },

    { EVT_SYSCALL_PWRITEV_E,           EVT_STR_PWRITEV },

    { EVT_SYSCALL_PWRITEV_X,           EVT_STR_PWRITEV },

    { EVT_SYSCALL_DUP_E,               EVT_STR_DUP },

    { EVT_SYSCALL_DUP_X,               EVT_STR_DUP },

    { EVT_SYSCALL_SIGNALFD_E,          EVT_STR_SIGNALFD },

    { EVT_SYSCALL_SIGNALFD_X,          EVT_STR_SIGNALFD },

    { EVT_SYSCALL_KILL_E,              EVT_STR_KILL },

    { EVT_SYSCALL_KILL_X,              EVT_STR_KILL },

    { EVT_SYSCALL_TKILL_E,             EVT_STR_TKILL },

    { EVT_SYSCALL_TKILL_X,             EVT_STR_TKILL },

    { EVT_SYSCALL_TGKILL_E,            EVT_STR_TGKILL },

    { EVT_SYSCALL_TGKILL_X,            EVT_STR_TGKILL },

    { EVT_SYSCALL_NANOSLEEP_E,         EVT_STR_NANOSLEEP },

    { EVT_SYSCALL_NANOSLEEP_X,         EVT_STR_NANOSLEEP },

    { EVT_SYSCALL_TIMERFD_CREATE_E,    EVT_STR_TIMERFD_CREATE },

    { EVT_SYSCALL_TIMERFD_CREATE_X,    EVT_STR_TIMERFD_CREATE },

    { EVT_SYSCALL_INOTIFY_INIT_E,      EVT_STR_INOTIFY_INIT },

    { EVT_SYSCALL_INOTIFY_INIT_X,      EVT_STR_INOTIFY_INIT },

    { EVT_SYSCALL_GETRLIMIT_E,         EVT_STR_GETRLIMIT },

    { EVT_SYSCALL_GETRLIMIT_X,         EVT_STR_GETRLIMIT },

    { EVT_SYSCALL_SETRLIMIT_E,         EVT_STR_SETRLIMIT },

    { EVT_SYSCALL_SETRLIMIT_X,         EVT_STR_SETRLIMIT },

    { EVT_SYSCALL_PRLIMIT_E,           EVT_STR_PRLIMIT },

    { EVT_SYSCALL_PRLIMIT_X,           EVT_STR_PRLIMIT },

    { EVT_SCHEDSWITCH_1_E,             EVT_STR_SWITCH },

    { EVT_SCHEDSWITCH_1_X,             EVT_STR_NA },

    { EVT_DROP_E,                      EVT_STR_DROP },

    { EVT_DROP_X,                      EVT_STR_DROP },

    { EVT_SYSCALL_FCNTL_E,             EVT_STR_FCNTL },

    { EVT_SYSCALL_FCNTL_X,             EVT_STR_FCNTL },

    { EVT_SCHEDSWITCH_6_E,             EVT_STR_SWITCH },

    { EVT_SCHEDSWITCH_6_X,             EVT_STR_NA },

    { EVT_SYSCALL_EXECVE_13_E,         EVT_STR_EXECVE },

    { EVT_SYSCALL_EXECVE_13_X,         EVT_STR_EXECVE },

    { EVT_SYSCALL_CLONE_16_E,          EVT_STR_CLONE },

    { EVT_SYSCALL_CLONE_16_X,          EVT_STR_CLONE },

    { EVT_SYSCALL_BRK_4_E,             EVT_STR_BRK },

    { EVT_SYSCALL_BRK_4_X,             EVT_STR_BRK },

    { EVT_SYSCALL_MMAP_E,              EVT_STR_MMAP },

    { EVT_SYSCALL_MMAP_X,              EVT_STR_MMAP },

    { EVT_SYSCALL_MMAP2_E,             EVT_STR_MMAP2 },

    { EVT_SYSCALL_MMAP2_X,             EVT_STR_MMAP2 },

    { EVT_SYSCALL_MUNMAP_E,            EVT_STR_MUNMAP },

    { EVT_SYSCALL_MUNMAP_X,            EVT_STR_MUNMAP },

    { EVT_SYSCALL_SPLICE_E,            EVT_STR_SPLICE },

    { EVT_SYSCALL_SPLICE_X,            EVT_STR_SPLICE },

    { EVT_SYSCALL_PTRACE_E,            EVT_STR_PTRACE },

    { EVT_SYSCALL_PTRACE_X,            EVT_STR_PTRACE },

    { EVT_SYSCALL_IOCTL_3_E,           EVT_STR_IOCTL },

    { EVT_SYSCALL_IOCTL_3_X,           EVT_STR_IOCTL },

    { EVT_SYSCALL_EXECVE_14_E,         EVT_STR_EXECVE },

    { EVT_SYSCALL_EXECVE_14_X,         EVT_STR_EXECVE },

    { EVT_SYSCALL_RENAME_E,            EVT_STR_RENAME },

    { EVT_SYSCALL_RENAME_X,            EVT_STR_RENAME },

    { EVT_SYSCALL_RENAMEAT_E,          EVT_STR_RENAMEAT },

    { EVT_SYSCALL_RENAMEAT_X,          EVT_STR_RENAMEAT },

    { EVT_SYSCALL_SYMLINK_E,           EVT_STR_SYMLINK },

    { EVT_SYSCALL_SYMLINK_X,           EVT_STR_SYMLINK },

    { EVT_SYSCALL_SYMLINKAT_E,         EVT_STR_SYMLINKAT },

    { EVT_SYSCALL_SYMLINKAT_X,         EVT_STR_SYMLINKAT },

    { EVT_SYSCALL_FORK_E,              EVT_STR_FORK },

    { EVT_SYSCALL_FORK_X,              EVT_STR_FORK },

    { EVT_SYSCALL_VFORK_E,             EVT_STR_VFORK },

    { EVT_SYSCALL_VFORK_X,             EVT_STR_VFORK },

    { EVT_PROCEXIT_1_E,                EVT_STR_PROCEXIT },

    { EVT_PROCEXIT_1_X,                EVT_STR_NA },

    { EVT_SYSCALL_SENDFILE_E,          EVT_STR_SENDFILE },

    { EVT_SYSCALL_SENDFILE_X,          EVT_STR_SENDFILE },

    { EVT_SYSCALL_QUOTACTL_E,          EVT_STR_QUOTACTL },

    { EVT_SYSCALL_QUOTACTL_X,          EVT_STR_QUOTACTL },

    { EVT_SYSCALL_SETRESUID_E,         EVT_STR_SETRESUID },

    { EVT_SYSCALL_SETRESUID_X,         EVT_STR_SETRESUID },

    { EVT_SYSCALL_SETRESGID_E,         EVT_STR_SETRESGID },

    { EVT_SYSCALL_SETRESGID_X,         EVT_STR_SETRESGID },

    { EVT_SCAPEVENT_E,                 EVT_STR_SCAPEVENT },

    { EVT_SCAPEVENT_X,                 EVT_STR_SCAPEVENT },

    { EVT_SYSCALL_SETUID_E,            EVT_STR_SETUID },

    { EVT_SYSCALL_SETUID_X,            EVT_STR_SETUID },

    { EVT_SYSCALL_SETGID_E,            EVT_STR_SETGID },

    { EVT_SYSCALL_SETGID_X,            EVT_STR_SETGID },

    { EVT_SYSCALL_GETUID_E,            EVT_STR_GETUID },

    { EVT_SYSCALL_GETUID_X,            EVT_STR_GETUID },

    { EVT_SYSCALL_GETEUID_E,           EVT_STR_GETEUID },

    { EVT_SYSCALL_GETEUID_X,           EVT_STR_GETEUID },

    { EVT_SYSCALL_GETGID_E,            EVT_STR_GETGID },

    { EVT_SYSCALL_GETGID_X,            EVT_STR_GETGID },

    { EVT_SYSCALL_GETEGID_E,           EVT_STR_GETEGID },

    { EVT_SYSCALL_GETEGID_X,           EVT_STR_GETEGID },

    { EVT_SYSCALL_GETRESUID_E,         EVT_STR_GETRESUID },

    { EVT_SYSCALL_GETRESUID_X,         EVT_STR_GETRESUID },