Records what every process on a machine did at the syscall boundary, with nothing instrumented, and draws it as one map from the whole fleet down to a single call. Checks what your tracing claims against what the kernel saw.