wildcard_eg.d

syscall:::entry
/pid == $1/
{
}