Hi everyone

I'm creating memory map updater which is work in runtime.
I know about procfs capadilities, but I need to know who, when and where used mmap and unmap functions

This feature can be done with instrumented kernel and TraceEvent handlers, so I:

//Turn on SystemClass Events
TraceEvent(_NTO_TRACE_ADDCLASS, _NTO_TRACE_SYSTEM)) ;

//Disable some events for reducing load (I tried to enable only events what I need with same result described below)
TraceEvent(_NTO_TRACE_DELEVENT, _NTO_TRACE_SYSTEM,_NTO_TRACE_SYS_IPI));
TraceEvent(_NTO_TRACE_DELEVENT, _NTO_TRACE_SYSTEM,	 _NTO_TRACE_SYS_TIMER));

//Set wide mode for getting all info (issue exist with any parameter)
TraceEvent(_NTO_TRACE_SETCLASSWIDE, _NTO_TRACE_SYSTEM));

/And connect my handler
TraceEvent(_NTO_TRACE_ADDCLASSEVHANDLER, _NTO_TRACE_SYSTEM, SystemHdlr,&hdlr_data_sys)) ;

Inside a handler I copy to my ring buffer next values:
buffer[0] = header;
buffer[1] = el_num; //number of element returned in data_array
buffer[2] - buffer[2+el_num] = data_array; // all returned event data

I use this mechanism for ProcessCLass and ThreadClass and can see when app was created and destroyed.

So the main problem is that el_num is returned with 0x01 value, so i have only correct PID for Mmap()/Unmap() operations
.
I enabled all abilities and privileges described here http://www.qnx.com/developers/docs/am11/index.jsp?topic=%2Fcom.qnx
.doc.sat%2Ftopic%2Ffiltering_Setting_up_dynamic.html&cp=1_1_9_4_1_0

No matter was tracelogger is on or off - Handler for ProcessClass and Thread Class events rerurn full data packet, with 
names, thread states etc but for SystemClass event I have only one element in the buffer.

If I just run the tracelogger and run some app, I will have full information in the trace about mmap and unmap usage 
with addresses