ftrace.event.kprobes.vfs_read { probes = "vfs_read $arg1" enable }