bpftrace username and the openat system call

Once again I am playing with eBPF and bpftrace. This time I am trying to trace all file access. Whenever a file is open, created, or deleted I want to print the filename, the process ID, and the user who did it. bpftrace has the username built in to get the username. However, I noticed I was missing a lot of file creations and by trial and error, I discovered many applications use the openat…