let program: &mut KProbe = bpf.program_mut("probe_open").unwrap().try_into()?;
    program.load()?;
    program.attach("__x64_sys_open", 0)?;

    let mut perf_array = AsyncPerfEventArray::try_from(bpf.map_mut("EVENTS")?)?;
     for cpu_id in online_cpus()? {
            let mut buf = perf_array.open(cpu_id, None)?;
            task::spawn(async move{
                let mut buffers = (0..10)
                .map(|_| BytesMut::with_capacity(1024))
                .collect::<Vec<_>>();

            loop{
                let events = buf.read_events(&mut buffers).await.unwrap();
                for buf in buffers.iter_mut().take(events.read) {
                    let ptr = buf.as_ptr() as *const PacketLog;
                    let data = unsafe { ptr.read_unaligned() };
                    let proc_name = String::from_utf8(data.prog_name.to_vec()).unwrap();
                    let file_name = String::from_utf8_lossy(&data.fname.to_vec()).into_owned();
                    println!("LOG: proc_name:{}, filename:{},flag:{}", proc_name,file_name,data.flg);                 
                }
            }
            });
     }

    fn try_probe_open(ctx: ProbeContext) -> Result<u32, u32> {
        let ptr_fname: *const u8 = ctx.arg(0).ok_or(1u32).map_err(|_| {info!(&ctx,"get arg 1 err");1 as u32})?;
        let  mut fname = [0u8; 100];
        unsafe{helpers::bpf_probe_read_kernel_str_bytes(ptr_fname,&mut fname).map_err(|e| {info!(&ctx,"read kernel buff err:{}",e); e as u32 })? };
        let flg: i32= ctx.arg(1).ok_or(1u32).map_err(|_| {info!(&ctx,"get arg 2 err");1 as u32})?;
  
        let prog_name = helpers::bpf_get_current_comm().map_err(|e| e as u32)?;

        let log_entry = PacketLog {
            fname,flg,prog_name,};
  
        unsafe {
            EVENTS.output(&ctx, &log_entry, 0);
        }

        Ok(0)
    }