log syscall to file