create_filter(9)

💅 create_filter(9) — from the Kernel API Manual, bestie

okay so picture this: you're deep in the kernel's tracing guts and you need a filter. not like a coffee filter, a trace event filter. this little guy create_filter is the function that makes one for you. let's get into it ✨

---

🌸 SYNOPSIS 🌸

int create_filter (struct trace_array *tr , struct trace_event_call
*call , char *filter_string , bool set_str , struct event_filter
**filterp );

that's the whole gang right there 🫶 five args, one int coming back at you.

---

🎀 ARGUMENTS 🎀

• tr — the trace array that's associated with these events. your home base for this whole situation.
• call — the trace_event_call you're creating a filter for. the main character of this operation, lowkey.
• filter_string — the filter string itself. the actual filter-y text, periodt.
• set_str — this one's the remember-y flag: it says "remember filter_str and enable detailed error in filter". so if you want your filter to hold onto the string and give you detailed errors, set it true. 💅
• filterp — the out param for the created filter, and heads up: it's always updated on return. ⚠️ but there's a strict vibe check here — it must be a pointer that references a NULL pointer. no cap, don't skip that part.

---

🦋 DESCRIPTION 🦋

So what does it actually do? It creates a filter for call with filter_str. 🎀 And if set_str is true, then filter_str gets copied and recorded in the new filter — iconic behaviour honestly.

Now the returns, because this is where people get caught out 😭

• On success → returns 0, and *filterp points to the new filter. slay. ✅
• On failure → returns -errno, and *filterp may point to NULL or to a new filter. 🙈

and that second failure case is the sneaky one: in that case, the returned filter contains error information if set_str is true, and the caller is responsible for freeing it. so like… you have to clean up. main character responsibility fr fr 🫶

⚠️ ngl the *filterp must-be-a-pointer-to-a-NULL-pointer rule is not a suggestion, bestie. it's giving "read the argument list twice before you compile." 💀

---

🌈 SEE ALSO 🌈

• Kernel file ./kernel/trace/trace_events_filter.c
• struct prog_entry(9)
• update_preds(9)
• filter_parse_regex(9)
• create_system_filter(9)

all the siblings in the same kernel file — go say hi, they're all part of the filter cinematic universe 🧚✨

---

and that's the whole page, bestie 💖 this one lives under ./kernel/trace and it's dated October 2026 in the Kernel API Manual — so when you see it, you'll know exactly where it came from. mwah 🎀👑