And for earlier kernel versions, there is an STAP patch:
1) On the host, save the following in a file with the ".stp" extension:
probe kernel.function("mem_write").call ? {
$count = 0
}
probe syscall.ptrace { // includes compat ptrace as well
$request = 0xfff
}
2) Install the "systemtap" package and any required dependencies. Refer
to the "2. Using SystemTap" chapter in the Red Hat Enterprise Linux
"SystemTap Beginners Guide" document, available from docs.redhat.com,
for information on installing the required -debuginfo packages.
3) Run the "stap -g [filename-from-step-1].stp" command as root.