improve syscall collection mechanism