Where are all syscalls restored in linux?

pstrace can be used to trace all syscalls,

but where are all syscall开发者_如何学Pythons restored??

I need to know this so that I can use grep xxx to know whether xxx is a syscall..

I think that you refer to strace and you want to filter its output.

The -e option of strace gives you the power to decide which calls should be printed. Here is an excerpt from the manual:

-e trace=file
               Trace  all  system  calls  which  take  a  file  name  as  an  argument.   You  can  think of this as an abbreviation for
               -e trace=open,stat,chmod,unlink,...  which is useful to seeing what files the process is referencing.  Furthermore, using
               the abbreviation will ensure that you don't accidentally forget to include a call like lstat in the list.  Betchya woulda
               forgot that one.

   -e trace=process
               Trace all system calls which involve process management.  This is useful for watching the fork, wait, and exec steps of a
               process.

   -e trace=network
               Trace all the network related system calls.

   -e trace=signal
               Trace all signal related system calls.

   -e trace=ipc
               Trace all IPC related system calls.

   -e trace=desc
               Trace all file descriptor related system calls.

You can also select individual system calls.