It actually turns out most of the calls are `openat(2)`. I had the same question initially.
In DTrace, you can specify a probe like
syscall::*open*:entry / / { }
bpftrace -e 'tracepoint:syscalls:sys_enter_open* { printf("%d\n", pid); }'
bpftrace -e 'tracepoint:syscalls:sys_enter_open* { printf("%d %s\n", pid, str(args->filename)); }'
You can do it like this:
bpftrace -e 'tracepoint:syscalls:sys_enter_open { printf("%d %s\n", pid, str(args->filename)); } tracepoint:syscalls:sys_enter_openat { printf("%d %s\n", pid, str(args->filename)); }'