STRUCT EVENT_COMMAND(9)

✨ struct event_command(9) ✨

okay so bestie, welcome to the struct event_command(9) page from the Kernel API Manual — this is the glow-up tour of the struct that makes event commands actually, like, do things. 🎀

---

💅 SYNOPSIS 💅

struct event_command {
    struct list_head        list;
    char *name;
    enum event_trigger_type trigger_type;
    int flags;
    int (*parse)(struct event_command *cmd_ops, struct trace_event_file
*file, char *glob, char *cmd, char *param_and_filter);
    int (*reg)(char *glob, struct event_trigger_data *data, struct
trace_event_file *file);
    void (*unreg)(char *glob, struct event_trigger_data *data, struct
trace_event_file *file);
    void (*unreg_all)(struct trace_event_file *file);
    int (*set_filter)(char *filter_str, struct event_trigger_data *data,
struct trace_event_file *file);
    void (*trigger)(struct event_trigger_data *data, struct trace_buffer
*buffer, void *rec, struct ring_buffer_event *rbe);
    bool (*count_func)(struct event_trigger_data *data, struct
trace_buffer *buffer, void *rec, struct ring_buffer_event *rbe);
    int (*init)(struct event_trigger_data *data);
    void (*free)(struct event_trigger_data *data);
    int (*print)(struct seq_file *m, struct event_trigger_data *data);
 };

like, look at her. every one of those function pointers is a little costume change. 👑

---

🌸 Members 🌸

• name — the unique name that identifies the event command. this is literally the name you use when you're setting triggers via trigger files. iykyk.
• trigger_type — a unique id that identifies the event command; only one trigger of the same type can be set at a given time for a particular event. like, it genuinely doesn't make sense to have both a traceon and a traceoff trigger attached to a single event at the same time, so traceon and traceoff share the same type even though they have different names. 💀 the trigger_type value is also used as a bit value for deferring the actual trigger action until after the current event is finished. some commands need to do this if they themselves log to the trace buffer (see the post_trigger member below). trigger_type values are defined by adding new values to the trigger_type enum in include/linux/trace_events.h.
• flags — see the enum event_command_flags below. 🚩
• parse — the callback function responsible for parsing and registering the trigger that the user wrote to the 'trigger' file. it allocates the trigger instance and registers it with the appropriate trace event. it makes use of the other event_command callback functions to orchestrate this, and is usually implemented by the generic utility function event_trigger_callback (see trace_event_triggers.c). ✨
• reg — adds the trigger to the list of triggers associated with the event, and enables the event trigger itself, after initializing it (via the event_command init function). this is also where commands can use the trigger_type value to make the decision as to whether or not multiple instances of the trigger should be allowed. usually implemented by the generic utility function register_trigger (see trace_event_triggers.c). 🫶
• unreg — removes the trigger from the list of triggers associated with the event, and disables the event trigger itself, after initializing it (via the event_command free function). usually implemented by the generic utility function unregister_trigger (see trace_event_triggers.c).
• unreg_all — an optional function called to remove all the triggers from the list of triggers associated with the event. it gets called when a trigger file is opened in truncate mode. 🧹
• set_filter — an optional function called to parse and set a filter for the trigger. > heads up: if no set_filter method is set for the event command, filters set by the user for the command will be ignored. 😭 usually implemented by the generic utility function set_trigger_filter (see trace_event_triggers.c).
• trigger — the trigger 'probe' function, called when the triggering event occurs. the data passed into this callback is the data that was supplied to the event_command reg function that registered the trigger (see struct event_command) along with the trace record, rec. 🔥
• count_func — if defined and a numeric parameter is passed to the trigger, then this function gets called before trigger is called. if this function returns false, then trigger is not executed. periodt. 🙈
• init — an optional initialization function called for the trigger when the trigger is registered (via the event_command reg function). you can use this to perform per-trigger initialization, such as incrementing a per-trigger reference count, for instance. usually implemented by the generic utility function event_trigger_init (see trace_event_triggers.c). 🌱
• free — an optional de-initialization function called for the trigger when the trigger is unregistered (via the event_command reg function). you can use this to perform per-trigger de-initialization, such as decrementing a per-trigger reference count and freeing corresponding trigger data, for instance. usually implemented by the generic utility function event_trigger_free (see trace_event_triggers.c). 🍂
• print — the callback function invoked to have the trigger print itself. usually implemented by a wrapper function that calls the generic utility function event_trigger_print (see trace_event_triggers.c). 🖨️

---

🦋 Description 🦋

event commands are invoked by users by writing the command name into the 'trigger' file associated with a trace event. the parameters associated with a specific invocation of an event command are used to create an event trigger instance, which gets added to the list of trigger instances associated with that trace event. when the event is hit, the set of triggers associated with that event is invoked. no cap. ⭐

the data members in this structure provide per-event command data for various event commands.

⚠️ all the data members below, except for post_trigger, must be set for each event command.

⚠️ all the methods below, except for set_filter and unreg_all, must be implemented.

⚠️ all the methods below, except for init and free, must be implemented.

---

👑 SEE ALSO 👑

kernel file ./kernel/trace/trace.h, struct cond_snapshot(9), struct tracer(9), tracer_tracing_is_on_cpu(9), event_trigger_unlock_commit(9), enum event_command_flags(9)

---

okay that's the whole page, bestie — go forth and struct responsibly 💜 this little cutie lives at ./kernel/trace and the version you're reading is from October 2026. slay, bye! 🌈🎀