A probe is a location or activity to which a set of actions can be bound. The syntax for specifying a probe is a colon specified list of up to four items:
Provider - the instrumentation to be used. Some providers you will encounter are syscall to monitor system calls, io for disk io, and many others.
Module - a specific program location. It could be the name of the module the probe is located in. It could also be the name of a kernel module or the name of a user library.
Function - A specific function name.
Name - An indication of the probe’s semantic meaning. entry and return are common ones.
In keventwatch.d, the only probe was syscall::kevent:entry. The provider is syscall, there is no module, the function is kevent, and the name ...