Yeah, I was thinking of a formalism that's equivalent. That is, an "alias blacklist" for "sys_ni_syscall". That means the sys_ni_syscall PC value is disallowed for probe matches unless they are for the "sys_ni_syscall" name. Thanks, Roland