Skip to content



cgroup_rmdir - An event that is triggered whenever a cgroup directory is removed.


The cgroup_rmdir event is intricately crafted to monitor the removal of directories within the cgroup filesystem. As containers are orchestrated and managed using control groups (cgroup), the removal of a directory often indicates the termination or scaling down of a container instance.

By keeping tabs on these directory removal events with cgroup_rmdir, operators can capture crucial insights into container terminations, resource deallocations, and other significant container lifecycle events within the system.

This event is pivotal for administrators looking to scrutinize container lifecycle events and for understanding the orchestration dynamics in complex containerized environments.


  • cgroup_id (u64): The unique identifier associated with the cgroup being removed.
  • cgroup_path (const char*): The file system path pointing to the cgroup directory that's being removed.
  • hierarchy_id (u32): Denotes the hierarchy level of the cgroup that's being removed.




Raw tracepoint (utilizing raw_tracepoint/cgroup_rmdir).


To keenly observe and capture details each time a cgroup directory is removed. Information related to the cgroup's unique identifier, its file system path, and its hierarchy level is collected.

Example Use Case

  1. Container Termination Monitoring**: By tracing cgroup directory removals, the system can identify when containers are terminated, offering a perspective into system scaling dynamics and potential anomalies.
  2. Resource Cleanup: Keeping track of the removal of cgroups helps in understanding resource deallocations and ensuring efficient resource usage across the infrastructure.
  • container_remove: A derived event that focuses on providing detailed insights about the container corresponding to the removed cgroup directory.

Note: This document was generated by OpenAI with a human review process.