The corresponding tapset/syscalls.stp has: # SYSCALL_DEFINE2(eventfd2, unsigned int, count, int, flags) probe syscall.eventfd = kernel.function("sys_eventfd2").call !, kernel.function("sys_eventfd").call ?
Here's a bit more from tapset/syscalls.stp: ---- # eventfd _____________________________________________________ # long sys_eventfd(unsigned int count) # SYSCALL_DEFINE2(eventfd2, unsigned int, count, int, flags) probe syscall.eventfd = kernel.function("sys_eventfd2").call !, kernel.function("sys_eventfd").call ? ---- The reason why it is done this way is that in the kernel sys_eventfd is just a wrapper around sys_eventfd2. This way we ignore the sys_eventfd call, and only catch the sys_eventfd2 call on kernels with sys_eventfd2. Unfortunately, as bug #11424 notes, '!' (optional and sufficient) doesn't work for kprobe.function probes. So, the above logic will be difficult to duplicate in tapset/nd_syscalls.stp.
Now that bug #11424 and bug #14378 are fixed, this bug can be addressed. Fixed in commit f6f8f0e.