SYS_openat
error = rsys_syscall(SYS_openat, &callarg, sizeof(callarg), retval);
[SYS_openat] = &filemon_sys_openat,