Linux System Call Monitoring 

The post describes building a Linux kernel Loadable Kernel Module to monitor and log specific syscalls by temporarily replacing syscall handlers, using Kprobes to discover the address of kallsyms_lookup_name on newer kernels where it isn’t exported, and demonstrating the approach by tracking getuid calls with dmesg. It explains the rationale, limitations, and configuration caveats for Kprobes, and presents the work as a learning exercise in kernel tracing and security research rather than an incident or vulnerability report.