timerfd_settime¶

Intro¶

timerfd_settime - set the expiration and interval of an installed timer

Description¶

The timerfd_settime() system call arms (starts) or disarms (stops) the timer referred to by the file descriptor fd. It does this by setting the timer's expiration and interval according to the values specified in the struct itimerspec pointed to by the new_value argument. If the old_value argument is non-NULL, then the previous struct itimerspec is returned in this location. This syscall also allows the user to specify the TFD_TIMER_ABSTIME descriptor to indicate that new_value->it_value is evaluated relative to the CLOCK_REALTIME clock.

Arguments¶

fd: int - file descriptor referring to the timer instance.
flags: int - flags specifying the behavior of the timer. Flags: TFD_TIMER_ABSTIME
new_value: const struct itimerspec* [K] - pointer to the new timer value.
old_value: struct itimerspec* [K] - pointer to the previous timer value

Available Tags¶

K - Originated from kernel-space.

Hooks¶

`sys_timerfd_settime`¶

Type¶

kprobe

Purpose¶

To monitor the duration of timerfd_settime system calls.

Example Use Case¶

This event can be used for monitoring a timer. For example, it can be used to record the time at which an application sets a timer.

Issues¶

None known.

timerfd_gettime - read the timer expiration and interval

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.