Skip to content



write - a syscall for writing data to a specified file descriptor


The write syscall is used to write data to a specified file descriptor. It takes three arguments: a file descriptor fd, a pointer to the data buf and its size count. It returns the number of bytes written, or -1 if there was an error.

Writing more bytes than the buffer size may cause a buffer overflow and should be avoided. Data should also be checked before writing to make sure that it is valid. It is important to note that the write syscall is non-atomic and may be interrupted by signals.


  • fd:int - file descriptor to write the data to
  • buf:void*[K, U] - pointer to the data to be written
  • count:size_t[K] - number of bytes to write from the buffer

Available Tags

  • K - Originated from kernel-space
  • U - Originated from user space (for example, pointer to user space memory used to get it)






To collect data from all write syscall invocation.

Example Use Case

A system administrator could use the write syscall to write data to a logfile.


If the buffer size is larger than the specified count, the write syscall may cause a buffer overflow.

  • read - allows a file descriptor to be read into a buffer
  • open - allows a file to be opened and set a file descriptor
  • close - closes a previously opened file descriptor

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.