Agent Output · count_openat.bpf.c
ITER 2
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
struct {
__uint(type, BPF_MAP_TYPE_HASH);
__uint(max_entries, 1024);
__type(key, u32);
__type(value, u64);
} openat_count SEC(".maps");
SEC("tracepoint/syscalls/
sys_enter_openat")
int count_openat(void *ctx) {
u32 pid = bpf_get_current_pid_tgid()
>> 32;
u64 init = 1, *v;
v = bpf_map_lookup_elem(
&openat_count, &pid);
if (v) __sync_fetch_and_add(v, 1);
else bpf_map_update_elem(
&openat_count, &pid, &init, 0);
return 0;
}
char LICENSE[] SEC("license") = "GPL";