perf(symbolizer): Optimize stack enrichment

Except when the LoadImage event is emitted by
the System process, all other events are safe
to ignore callstack symbolization.

Author: rabbitstack

pkg/symbolize/symbolizer.go

@@ -285,7 +285,15 @@ func (s *Symbolizer) syncModules(e *kevent.Kevent) error {
 func (s *Symbolizer) processCallstack(e *kevent.Kevent) error {
 	addrs := e.Kparams.MustGetSliceAddrs(kparams.Callstack)
 	e.Callstack.Init(len(addrs))
-	if (e.IsCreateFile() && e.IsOpenDisposition()) || (e.IsSystemPid() && !e.IsLoadImage()) {
+
+	// skip stack enrichment for the events generated by the System process
+	// except the LoadImage event which may prove to be useful when the driver
+	// is loaded and the kernel address symbolization is enabled
+	if e.IsSystemPid() && !e.IsLoadImage() {
+		return nil
+	}
+
+	if e.IsCreateFile() && e.IsOpenDisposition() {
 		// for high-volume events decorating
 		// the frames with symbol information
 		// is not viable. For this reason, the