When failing to read the tracepoint event format, like currently with
sys_execve, that is not defined via SYSCALL_DEFINE macros and thus
doesn't have an entry in:
$ ls -d /sys/kernel/debug/tracing/events/syscalls/sys_enter_*exec*
/sys/kernel/debug/tracing/events/syscalls/sys_enter_kexec_load
$