Skip to content



timerfd_gettime() - get the expiration(s) of a timer created with timerfd.


The timerfd_gettime() system call retrieves the current value of a timer created by the timerfd_create() system call. It stores the expiration(s) in the given structure pointed to by the curr_value argument. The fd argument should be a file descriptor that refers to the timer.

This event might be useful to retrieve the expiration values of a given timer in order to get insight into the state of the timer at any given time. One potential edge-case is that the given fd argument does not refer to a timer, in which case an error will be returned.


  • fd:int[K] - file descriptor crated by the timerfd_create() system call.
  • curr_value:struct itimerspec*[U] - pointer to the struct itimerspec which will hold the current and/or next expiration(s) of the timer.

Available Tags

  • K - Originated from kernel-space.
  • U - Originated from user space (for example, pointer to user space memory used to get it)




Function probe.


The timer_refresh() is hooked to check that the expiry times are up to date and to act accordingly, like set the next expiry time.



Kretprobes - return probes.


The timer_del() is hooked to detect when a timer has been deleted and to free the related data.

Example Use Case

The timerfd_gettime() system call can be used to retrieve the expiration values of a timer in order to, for example, display a progress indicator or monitor how close a timer is to expiring.


Currently, no issues with this event have been identified.

timerfd_create() - create a timer, timerfd_settime() - set expiration values for a timer, timerfd_gettime() - get the expiration(s) of a timer.

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.