Patent ID: 7017157

Claim:
A system call information recording method by an information processing device, which works by an operating system and comprises plural system calls calling processes in the operating system, the operating system stored in the recording device of the information processing device, comprising: storing one or more plural system call groups, each of the system call groups including plural system calls grouped by a process function for the system calls; deciding whether a system call trace function is valid or not, when a system call occurs; deciding whether a mode recording the system calls information is set or not, when the system call is decided valid; recording information of the system call in a log of the recording device, when the mode recording the system calls information is set; deciding by each of the system calls, whether a mode recording the system call information by the system call group in which the system call belongs is set or not set, when the mode recording the system calls information is not set; recording information of the system call in the log, when the mode recording the system call group is set; deciding by each of the system calls, whether a mode recording the system call information by the system call selected to record the system call information is set or not set, when the system call group is not set recorded in the recording mode; and recording information of the system call in the log, when the mode recording the system call is set, otherwise not recording the system call information of the system call; wherein, the plural system call groups are grouped by process functions, respectively, and each of the system call groups including the plural system calls, and the system calls in selected system call groups are recorded in the log of the recording device.