Re: Keeping track of called syscalls in real-time

On Wed, 28 Jun 2017 17:48:15 -0300, Ben Mezger said:

Can the kernel keep track of all the system calls that were called by an application/module in real-time? I know I can statically use strace, or even gdb, but I am looking for a solution in real time when the application/module is already running and the user has no control over it.

What actual problem are you trying to solve by having the information? How "real-time" does it have to be? Have you looked at the syscall audit facility?