fix: align eBPF tracing with ptrace behavior

Drop metadata-only syscall probes disabled by the legacy production tracer, add opt-in Rust and eBPF profiling, and preserve successful exec paths with paired entry/exit capture. Extend VM coverage for execve, execveat, secondary-thread exec, and the reduced syscall set.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b3fe3fcd-33e7-4ea3-b563-8492847b2469

Author: bmiddha

docs/configuration.md

@@ -40,5 +40,7 @@ Multiple paths can be specified by separating them with a colon `:`.
 - `FSTRACE_LOG_FILE`: Write log output to this explicit file path (all binaries). See [Logging](logging.md).
 - `FSTRACE_LOG_DIR`: Write log output into this directory, one file per process (`fstrace-daemon.log`, `fstrace-<pid>.log`), so the daemon and concurrent clients never interleave.
 - `FSTRACE_DEBUG_FILE`: Legacy alias for `FSTRACE_LOG_FILE` (single shared file).
+- `FSTRACE_PROFILE`: Set to `1` in both daemon and client environments to emit
+  aggregate Rust and eBPF performance summaries. See [Logging](logging.md).
 - `FSTRACE_REPORT_FILE`: Write the report stream to this path instead of file descriptor 3. Recommended when running under `sudo` (see [Reports and file descriptor 3](reports-and-fd3.md)).
 - `FSTRACE_SOCKET`: Path to the daemon's Unix socket (default `/run/fstrace/fstrace.sock`). Both the daemon and the client honour it; set it to run a private daemon.

docs/logging.md

@@ -38,3 +38,27 @@ RUST_LOG=fstrace=trace FSTRACE_LOG_DIR=/var/log/fstrace fstrace ls / 3>/dev/null
 
 `FSTRACE_LOG_DIR` is created if it does not exist. `FSTRACE_DEBUG_FILE` remains
 supported as a legacy alias for `FSTRACE_LOG_FILE`.
+
+## Aggregate performance profiling
+
+Set `FSTRACE_PROFILE=1` in both the daemon and client environments to emit
+low-volume timing summaries instead of one log entry per event:
+
+```bash
+sudo env FSTRACE_PROFILE=1 FSTRACE_LOG_FILE=/tmp/fstrace-daemon.profile \
+  fstrace-daemon &
+FSTRACE_PROFILE=1 FSTRACE_LOG_FILE=/tmp/fstrace-client.profile \
+  fstrace npm run build 3>/dev/null
+```
+
+The client summary separates event classification/path resolution, filtering,
+debouncing, report formatting/writes, queue latency, and post-exit draining.
+The daemon summary covers event encoding/routing, queue drops, wire bytes, and
+socket writes. The eBPF summary reports per-syscall capture time, pathname-copy
+time and bytes, successful ring-buffer submissions, and ring-buffer drops.
+Per-syscall detail is sorted by total processing time.
+
+Profiling is opt-in because it reads clocks and updates counters for every
+traced event. Normal runs do not collect those timings. eBPF interval snapshots
+are global to the daemon, so profile one client at a time when exact attribution
+matters.

docs/output-format.md

@@ -6,8 +6,16 @@ File access reports are printed to file descriptor 3 in the following format:
 <access_type><file_type> <file_path>
 ```
 
-- `<access_type>`: `R` for read, `W` for write/create, `D` for delete, `E` for enumerate
-- `<file_type>`: `F` for file, `D` for directory, `X` for does not exist
+- `<access_type>`: `R` for read, `W` for write/create, `D` for delete. `E` is
+  reserved for directory enumeration.
+- `<file_type>`: `F` for file, `D` for directory, `X` for does not exist, `L`
+  for symbolic link, `?` when the type is unknown.
+
+fstrace intentionally does not attach probes for the metadata-only
+`stat`/`access`/`readlink` families or for `getdents` directory enumeration.
+Those calls dominate dependency-resolution workloads while duplicating paths
+already reported by `open`/`openat`; omitting them matches the original
+ptrace tracer's production seccomp filter.
 
 See [Reports and file descriptor 3](reports-and-fd3.md) for how to redirect the
 report stream (and how to handle `sudo`).

docs/testing.md

@@ -10,7 +10,7 @@ cargo xtask test        # or: cargo test --release --workspace --exclude fstrace
 Run `cargo xtask check` to reproduce the full CI lint/test gate locally
 (format check + clippy + unit tests).
 
-The privileged loader and full syscall coverage are exercised end-to-end inside a
+The privileged loader and enabled syscall set are exercised end-to-end inside a
 throwaway QEMU VM, so the eBPF programs never load on the host. The harness is
 written entirely in Rust: `xtask` drives the VM orchestration, the `fstrace-vmtest`
 crate provides the in-guest suite, and a thin companion binary, `fstrace-scenario`,

fstrace-common/src/lib.rs

@@ -25,6 +25,10 @@ pub const EVENT_FORK: u32 = 0xFFFF_0001;
 /// pid from its routing table.
 pub const EVENT_EXIT: u32 = 0xFFFF_0002;
 
+/// Number of profile slots, covering every stable [`Syscall`] wire value up to
+/// the highest enabled discriminant (including reserved gaps).
+pub const SYSCALL_COUNT: usize = 33;
+
 /// The set of syscalls fstrace traces.
 ///
 /// The discriminants are stable wire values written into [`Event::syscall`] by
@@ -37,15 +41,6 @@ pub enum Syscall {
     Openat = 1,
     Openat2 = 2,
     Creat = 3,
-    Stat = 4,
-    Lstat = 5,
-    Newfstatat = 6,
-    Statx = 7,
-    Access = 8,
-    Faccessat = 9,
-    Faccessat2 = 10,
-    Readlink = 11,
-    Readlinkat = 12,
     Unlink = 13,
     Unlinkat = 14,
     Rmdir = 15,
@@ -59,8 +54,6 @@ pub enum Syscall {
     Symlink = 23,
     Symlinkat = 24,
     Truncate = 25,
-    Getdents = 26,
-    Getdents64 = 27,
     Chdir = 28,
     Fchdir = 29,
     Execve = 30,
@@ -77,15 +70,6 @@ impl Syscall {
             1 => Openat,
             2 => Openat2,
             3 => Creat,
-            4 => Stat,
-            5 => Lstat,
-            6 => Newfstatat,
-            7 => Statx,
-            8 => Access,
-            9 => Faccessat,
-            10 => Faccessat2,
-            11 => Readlink,
-            12 => Readlinkat,
             13 => Unlink,
             14 => Unlinkat,
             15 => Rmdir,
@@ -99,8 +83,6 @@ impl Syscall {
             23 => Symlink,
             24 => Symlinkat,
             25 => Truncate,
-            26 => Getdents,
-            27 => Getdents64,
             28 => Chdir,
             29 => Fchdir,
             30 => Execve,
@@ -110,8 +92,62 @@ impl Syscall {
         };
         Some(syscall)
     }
+
+    /// Stable lowercase name used in diagnostics and profile output.
+    pub const fn name(self) -> &'static str {
+        use Syscall::*;
+        match self {
+            Open => "open",
+            Openat => "openat",
+            Openat2 => "openat2",
+            Creat => "creat",
+            Unlink => "unlink",
+            Unlinkat => "unlinkat",
+            Rmdir => "rmdir",
+            Rename => "rename",
+            Renameat => "renameat",
+            Renameat2 => "renameat2",
+            Mkdir => "mkdir",
+            Mkdirat => "mkdirat",
+            Link => "link",
+            Linkat => "linkat",
+            Symlink => "symlink",
+            Symlinkat => "symlinkat",
+            Truncate => "truncate",
+            Chdir => "chdir",
+            Fchdir => "fchdir",
+            Execve => "execve",
+            Execveat => "execveat",
+            Close => "close",
+        }
+    }
 }
 
+/// Per-syscall counters populated by the eBPF capture path when profiling is
+/// enabled. The map is per-CPU, so these fields can be updated without atomic
+/// operations and summed by the daemon after a client disconnects.
+#[repr(C)]
+#[derive(Copy, Clone, Debug, Default)]
+pub struct EbpfProfileStat {
+    /// Traced syscall exits that entered the capture path.
+    pub calls: u64,
+    /// Events successfully submitted to the ring buffer.
+    pub submitted: u64,
+    /// Events dropped because the ring buffer had no free reservation.
+    pub ringbuf_drops: u64,
+    /// Userspace pathname reads attempted.
+    pub path_reads: u64,
+    /// Path bytes copied from userspace.
+    pub path_bytes: u64,
+    /// Nanoseconds in capture after pid selection and profile enablement.
+    pub capture_ns: u64,
+    /// Nanoseconds within `capture_ns` spent in pathname read helpers.
+    pub path_read_ns: u64,
+}
+
+#[cfg(feature = "user")]
+unsafe impl aya::Pod for EbpfProfileStat {}
+
 /// How a path was accessed. Serialised as the first output character.
 #[derive(Copy, Clone, Debug, PartialEq, Eq)]
 pub enum AccessType {
@@ -225,10 +261,17 @@ mod tests {
 
     #[test]
     fn syscall_roundtrips_through_u32() {
-        for value in 0..=32u32 {
+        for value in [
+            0, 1, 2, 3, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 28, 29, 30, 31, 32,
+        ] {
             let syscall = Syscall::from_u32(value).expect("known discriminant");
             assert_eq!(syscall as u32, value);
         }
+        for value in 4..=12 {
+            assert_eq!(Syscall::from_u32(value), None);
+        }
+        assert_eq!(Syscall::from_u32(26), None);
+        assert_eq!(Syscall::from_u32(27), None);
         assert_eq!(Syscall::from_u32(33), None);
         assert_eq!(Syscall::from_u32(u32::MAX), None);
     }