The action block is what most resembles a C function. The primary differences are some syntactical extensions to C and that we do not have a parameter list or a return value like a C function, instead it relies entirely upon side effects.

While there is not an explicit parameter list like a C function, there are parameter-like variables that are available from this provider. The availability of those parameters is dependent upon the system call probed, the entry/exit probe used, and if the system call was prototyped. In this case, we only have one ÒparameterÓ from the probe, and that is the return value.

__pid and __pname are global read-only built-ins that are contextually set based upon where they are used. __pid is the process ID (an integer) and __pname is the process name (a string).