Skip to content



sendfile() - copies data between two file descriptors


The sendfile() syscall copies data between two file descriptors. It copies data from the file descriptor in_fd and sends it to the file descriptor out_fd. The offset argument is an offset pointer, and it is used to define the position within the file from which the data will be read. The count argument defines how much data from the in_fd should be transferred.

When using sendfile() it is important to note that the data is read from the in_fd file descriptor and written directly to the out_fd descriptor without passing through user-space. This can be faster than the traditional file-read-to-user-space-buffer-and-write-to-file approach.


  • out_fd:int - File descriptor from which the data will be written
  • in_fd:int - File descriptor from which the data will be read
  • offset:off_t*[K] - Pointer to an offset value
  • count:size_t - Length of data in bytes which will be transferred

Available Tags

  • K - Originated from kernel-space




KProbe + KRetProbe


Track the arguments passed to the kernel sendfile() syscall, as well as its return values.

Example Use Case

sendfile() can be used to efficiently transfer large amounts of data between two file descriptors. It can be used to provide a way to efficiently transfer a stream of data between two network sockets.


The count argument for sendfile() is limited to 32-bits of size. If more data must be transferred, it is necessary to iterate over multiple calls to sendfile().

Additionally, passing a null pointer for the offset argument is not supported on all architectures.

  • writev() - performs scatter-gather I/O
  • send() - sends data on a socket
  • splice() - constructs a pipe out of two files/file descriptors

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.