function get_parent(pid:long)
{
        return task_pid(task_parent(pid2task(pid)))
}


function check_path:long(filename)
{
        subfname = substr(filename,0,5)

        if (subfname != "/proc" && subfname != "/sys/" && subfname != "/dev/")
        {
                return 1
        }
        else
        {
                return 0
        }
}

probe syscall.open* ?
{
        if (pid() != stp_pid() && pid() != get_parent(stp_pid()) && pid() != get_parent(get_parent(stp_pid())) && check_path(filename))
        {
                printf("file=%s,pid=%d,tid=%d,execname=%s\n",filename,pid(),tid(),pid2execname(pid()))
        }
}