Enabling syscalls tracing (kernel tracer), you will not be able to disable them
with disable-event. This is a known limitation. You can disable the entire
channel to do the trick.
+\-\-filter 'expression'
+ Set a filter on a newly enabled event.
+ Filter expression on event fields event recording
+ depends on evaluation. Only specify on first activation
+ of a given event within a session. Filter only allowed
+ when enabling events within a session before tracing is
+ started.
.fi
.IP "\fBdisable-channel\fP NAME[,NAME2,...] [\-k|\-u] [OPTIONS]"
fprintf(ofp, " --filter \'expression\'\n");
fprintf(ofp, " Filter expression on event fields,\n");
fprintf(ofp, " event recording depends on evaluation.\n");
+ fprintf(ofp, " Only specify on first activation of\n");
+ fprintf(ofp, " a given event within a session.\n");
+ fprintf(ofp, " Filter only allowed when enabling\n");
+ fprintf(ofp, " events within a session before tracing\n");
+ fprintf(ofp, " is started.\n");
fprintf(ofp, "\n");
}