1syscall:open:entry 2/"ksh" != comm/ 3{ 4 exit(); 5} 6 7syscall:close:entry 8/comm == "ksh" && tid >= 45/ 9{ 10 exit(); 11} 12 13syscall:open:return 14/pid != 99/ 15{ 16 exit(); 17} 18 19interval:hz:100 20{ 21 exit(); 22} 23