Seconded. Way simpler than BPF, especially when all you want to see is syscalls.