NLSYSEVENT(4)

💅 NLSYSEVENT(4) — kernel interfaces manual, but make it cute

okay so bestie, this is the nlsysevent page — it's from the Kernel Interfaces Manual, and it's all about a Netlink-based kernel event notification module. let's get into it 🫶

---

✨ SYNOPSIS ✨

so like, if you want the driver loaded as a module at boot time, you drop this line into loader.conf(5):

nlsysevent_load="YES"

or, if you'd rather load the module at runtime, no big deal:

kldload nlsysevent

---

🌸 DESCRIPTION 🌸

k so the nlsysevent kernel module gives you a netlink(4) Generic Netlink interface for receiving kernel device events. it hooks into the devctl(4) notification system and re-publishes all the kernel events as Generic Netlink multicast messages, all under the NETLINK_GENERIC protocol family. iconic behaviour honestly 👑

it's basically an alternative to reading events from /dev/devctl (which is what devd(8) uses), and the glow-up is: multiple consumers can subscribe to events at the same time, and consumers can selectively subscribe to specific event groups. the way that's such a serve 💅

🦋 Generic Netlink Family

the module registers a Generic Netlink family named nlsysevent. the dynamically-assigned family identifier can be resolved using the standard CTRL_CMD_GETFAMILY request, exactly as described in genetlink(4). iykyk ✨

🎀 Commands

here's the one command defined:

• NLSE_CMD_NEWEVENT — sent when a kernel event occurs. this message is never solicited by userland; it's only delivered to sockets that have subscribed to one or more multicast groups. no cap, it just shows up 🫶

💖 Attributes

every NLSE_CMD_NEWEVENT message contains these TLV attributes:

• NLSE_ATTR_SYSTEM — (string) the system name that generated the event (e.g., ACPI, IFNET, USB).
• NLSE_ATTR_SUBSYSTEM — (string) the subsystem name within the system.
• NLSE_ATTR_TYPE — (string) the type of the event.
• NLSE_ATTR_DATA — (string) optional extra data associated with the event. this attribute may be absent if no extra data was provided 🙈 (so like, check for it, bestie).

🌈 Multicast Groups

the module creates one multicast group per system name. these groups are pre-registered when the module is loaded:

ACPI
AEON
CAM
CARP
coretemp
DEVFS
device
ETHERNET
GEOM
HYPERV_NIC_VF
IFNET
INFINIBAND
KERNEL
nvme
PMU
RCTL
USB
VFS
VT
ZFS

more groups get created dynamically as new system names show up in kernel events, up to a maximum of 64 groups. that's the ceiling, periodt ✋

the group identifier for a given system name can be resolved via CTRL_CMD_GETFAMILY, and then you subscribe to it using the NETLINK_ADD_MEMBERSHIP socket option. slay 🌟

---

⭐ EXAMPLES ⭐

the genl(1) utility can monitor events for you:

genl monitor nlsysevent

look at her go 😭💖

---

🧚 SEE ALSO 🧚

genl(1), snl(3), devctl(4), genetlink(4), netlink(4), devd(8)

---

👑 HISTORY 👑

the nlsysevent module first appeared in FreeBSD 15.0. a legend was born 💀✨

---

🍓 AUTHORS 🍓

the nlsysevent kernel module and this manual page were written by Baptiste Daroussin <bapt@FreeBSD.org>. ty bestie for your service 🫶🎀

---

so yeah, that's the whole page — nothing skipped, every flag and group and attribute accounted for. vibe check: passed ✅

and that's a wrap! this beauty shipped in the Debian build, dated April 9, 2026 — catch you in the group chat, bestie 💜🦋