syscall::read:entry, syscall::write:entry /pid == 669/ { trace("yeah!"); }