Writing a system call tracer using eBPF