Table 3 A performance comparison between classic and batch modes of eBPF in monitoring system call events. The total events indicate the number of events transferred to the eBPF map, whereas the lost events represent what was not processed and wasted occurrences

From: Optimus: association-based dynamic system call filtering for container attack surface reduction