syscall log through LKM