Track syscall events across enter/exit.