Some perf counters, including all the syscall ones, are only available to the root user. sudo perf list will show all the counters, including syscall ones assuming the kernel is built with CONFIG_HAVE_SYSCALL_TRACEPOINTS (see Grisha Levit's answer regarding that).

So, to make perf top -e 'syscalls:sys_enter_*' work, run it under sudo--even if you do not need sudo for other counters like cycles.

Output from strace -Tttt -e trace=file is trace (tracing tool), and perf is usually used as profiling tool (aggregating time spent in function by name - in perf record by default on time or on hardware events + perf report, perf top modes) or as statistics tool (in perf stat mode - with counting of some events over all running time of the program).

You should try some tracing tool (trace-cmd, sysdig, lttng, ...) or you can try to use perf in tracing modes (perf record with tracepoints and perf script to output non-aggregated log over time)

There are tracepoints for syscalls (syscalls 614): http://www.brendangregg.com/perf.html#Tracepoints http://www.brendangregg.com/perf.html#StaticKernelTracing

perf record -e 'syscalls:sys_*' ./program
perf script

Example of output with format: process_name, pid, [cpu_core], time_since_boot_seconds.microseconds:, tracepoint_name, tracepoint_arguments

          ls 19178 [001]  16529.466566:                   syscalls:sys_enter_open: filename: 0x7f6ae4c38f82, flags: 0x00080000, mode: 0x
          ls 19178 [001]  16529.466570:                    syscalls:sys_exit_open: 0x4
          ls 19178 [001]  16529.466570:               syscalls:sys_enter_newfstat: fd: 0x00000004, statbuf: 0x7ffe22df92f0
          ls 19178 [001]  16529.466572:                syscalls:sys_exit_newfstat: 0x0
          ls 19178 [001]  16529.466573:                   syscalls:sys_enter_mmap: addr: 0x00000000, len: 0x00042e6f, prot: 0x00000001,
          ls 19178 [001]  16529.466767:                    syscalls:sys_exit_mmap: 0x7f6ae4df8000
          ls 19178 [001]  16529.466768:                  syscalls:sys_enter_close: fd: 0x00000004
          ls 19178 [001]  16529.466769:                   syscalls:sys_exit_close: 0x0

You may also try perf record -g -e 'syscalls:sys_*' to record function backtrace (to get information which function of the application did the syscall, and who did call this function; works better with debug information).

perf as tracing tool may not decode syscall (tracepoint) arguments; and tracing tools like trace-cmd or lttng may decode them better (at least decoding file name in open syscall).

Some improved output can be gained by using perf trace -i perf.data but you need a slightly different invocation to record.

# to record
$ perf record -e raw_syscalls:* /bin/true
# to report:
$ perf trace -i perf.data

The output is better than perf script gives you but can still be pretty inscrutable. strace figures more things out but it is harder to programmatically work with the output.