Add syscall monitoring script
README