Track syscall events across enter/exit.

Small step to #293.