syscount(8)

syscount(8) 💅

okay bestie, this is the syscount page from the System Manager's Manual — it counts system calls and it uses Linux perf_events. Let's get into it 🫶

---

✨ NAME ✨

syscount — count system calls. Uses Linux perf_events.

---

🌸 SYNOPSIS 🌸

syscount [-chv] [-t top] {-p PID|-d seconds|command}

---

🦋 DESCRIPTION 🦋

So the tea is: this whole thing is a proof-of-concept that leans on perf_events capabilities for older kernel versions — the ones that don't have custom in-kernel aggregations yet. The moment those exist, this script can be substantially rewritten and improved, and it'll have lower overhead. Manifesting that fr fr ✨

---

🎀 REQUIREMENTS 🎀

• Linux perf_events — add linux-tools-common, run perf, then add any additional packages it requests.
• Also needs awk.

no skipping the prerequisites bestie, it's giving "install first, cry later" 😭

---

💖 OPTIONS 💖

• -c — Show counts by syscall name. This mode (without -v) uses in-kernel counts, which have lower overhead than the default mode. iconic behavior honestly
• -h — Usage message. the "help me" button 💅
• -v — Verbose: include PID.
• -p PID — Trace this process ID only.
• -d seconds — Duration of trace in seconds.
• command — Run and trace this command.

---

🌈 EXAMPLES 🌈

Trace and summarize syscalls by process name:

# syscount

Trace and summarize syscalls by syscall name (lower overhead):

# syscount -c

Trace for 5 seconds, showing by process name:

# syscount -d 5

Trace PID 932 only, and show by syscall name (lower overhead):

# syscount -cp 923

Execute the """ls""" command, and show by syscall name:

# syscount -c ls

---

⭐ FIELDS ⭐

• PID — Process ID.
• COMM — Process command name.
• SYSCALL — Syscall name.
• COUNT — Number of syscalls during tracing.

---

🔥 OVERHEAD 🔥

Okay this part matters so vibe check your expectations: the modes that report syscall names only (-c, -cp PID, -cd secs) have lower overhead, because they use in-kernel counts. slay, less work for everyone ✨

Other modes — the ones reporting process IDs (-cv) or process names (the default) — create a perf.data file for post processing, and you will literally see messages about it doing that. Beware of the file size (test for short durations, or use -c to see counts based on in-kernel counters), and gauge overheads based on the perf.data size. ngl that file can get chunky 🙈

Note that this script deliberately does not pipe perf record into perf script, which would avoid perf.data, because it can create a feedback loop where the perf script syscalls are recorded. Hopefully there will be a fix for this in a later perf version, so perf.data can be skipped, or other kernel features to aggregate by process name in-kernel directly (eg, via eBPF, ktap, or SystemTap). the way that's such a specific problem 😭

---

👑 SOURCE 👑

This is from the perf-tools collection.

https://github.com/brendangregg/perf-tools

Also look under the examples directory for a text file containing example usage, output, and commentary for this tool. iykyk 💅

---

🧚 OS 🧚

Linux obviously 🌸

---

💀 STABILITY 💀

Unstable — in development. she's still growing bestie, be gentle 🫶

---

💜 AUTHOR 💜

Brendan Gregg

---

🍓 SEE ALSO 🍓

iosnoop(8), iolatency(8), iostat(1)

---

and that's the whole page!! 💖 this one comes from USER COMMANDS and it's dated 2014-07-07 — yes she's a vintage icon, an OG, a legend, and she still counts your syscalls like it's nothing. mwah, go trace something cute ✨💅🎀