Syscall Counter Linux Kernel Module

This kernel module counts all executed syscalls using the sys_enter tracepoint provided by the kernel. The data is accessible via a debugfs file, or via the included shell script for a live terminal view.

enabled parameter

Counting can be paused by setting the module's enabled parameter to 0.

Usage

Make sure you're running a modern kernel version (4.x+, tested on 7.0.9) on an x86_64 system with mounted debugfs

1. Clone the repo
2. Install the kernel headers using your package manager
3. Comment out #define USE_ATOMICS if you'd rather use spinlocks
4. Run sudo make install to compile and load the module
5. Run sudo make test to view the module's debugfs output via the included Scripts or view raw output at /sys/kernel/debug/syscall_counter
6. Run echo 0 | sudo tee /sys/module/syscall_counter/parameters/enabled to pause counting (echo 1 to resume)

Scripts

• gen_syscall_names.sh — generates a C header containing syscall names with their corresponding IDs, parsed from /usr/include/asm/unistd_64.h (requires kernel headers)
• print_debugfs.sh — renders a live view of the module's debugfs output using watch, sorted by count; must be run as root