manpagez: man pages & more
man kevent(2)
Home | html | info | man
kqueue(2)                   BSD System Calls Manual                  kqueue(2)


     kqueue, kevent, and kevent64 -- kernel event notification mechanism


     Standard C Library (libc, -lc)


     #include <sys/types.h>
     #include <sys/event.h>
     #include <sys/time.h>


     kevent(int kq, const struct kevent *changelist, int nchanges,
         struct kevent *eventlist, int nevents,
         const struct timespec *timeout);

     kevent64(int kq, const struct kevent64_s *changelist, int nchanges,
         struct kevent64_s *eventlist, int nevents, unsigned int flags,
         const struct timespec *timeout);

     EV_SET(&kev, ident, filter, flags, fflags, data, udata);

     EV_SET64(&kev, ident, filter, flags, fflags, data, udata, ext[0],


     The kqueue() system call provides a generic method of notifying the user
     when a kernel event (kevent) happens or a condition holds, based on the
     results of small pieces of kernel code termed filters.  A kevent is iden-
     tified by an (ident, filter) pair and specifies the interesting condi-
     tions to be notified about for that pair.  An (ident, filter) pair can
     only appear once in a given kqueue.  Subsequent attempts to register the
     same pair for a given kqueue will result in the replacement of the condi-
     tions being watched, not an addition.

     The filter identified in a kevent is executed upon the initial registra-
     tion of that event in order to detect whether a preexisting condition is
     present, and is also executed whenever an event is passed to the filter
     for evaluation.  If the filter determines that the condition should be
     reported, then the kevent is placed on the kqueue for the user to

     The filter is also run when the user attempts to retrieve the kevent from
     the kqueue.  If the filter indicates that the condition that triggered
     the event no longer holds, the kevent is removed from the kqueue and is
     not returned.

     Multiple events which trigger the filter do not result in multiple
     kevents being placed on the kqueue; instead, the filter will aggregate
     the events into a single struct kevent.  Calling close() on a file
     descriptor will remove any kevents that reference the descriptor.

     The kqueue() system call creates a new kernel event queue and returns a
     descriptor.  The queue is not inherited by a child created with fork(2).

     The kevent() and kevent64() system calls are used to register events with
     the queue, and return any pending events to the user.  The changelist
     argument is a pointer to an array of kevent or kevent64_s structures, as
     defined in <sys/event.h>.  All changes contained in the changelist are
     applied before any pending events are read from the queue.  The nchanges
     argument gives the size of changelist.  The eventlist argument is a
     pointer to an array of kevent or kevent64_s structures.  The nevents
     argument determines the size of eventlist.  If timeout is a non-NULL
     pointer, it specifies a maximum interval to wait for an event, which will
     be interpreted as a struct timespec.  If timeout is a NULL pointer, both
     kevent() and kevent64() wait indefinitely.  To effect a poll, the timeout
     argument should be non-NULL, pointing to a zero-valued timespec struc-
     ture.  The same array may be used for the changelist and eventlist.

     The EV_SET() macro is provided for ease of initializing a kevent struc-
     ture. Similarly, EV_SET64() initializes a kevent64_s structure.

     The kevent and kevent64_s structures are defined as:

     struct kevent {
             uintptr_t       ident;          /* identifier for this event */
             int16_t         filter;         /* filter for event */
             uint16_t        flags;          /* general flags */
             uint32_t        fflags;         /* filter-specific flags */
             intptr_t        data;           /* filter-specific data */
             void            *udata;         /* opaque user data identifier */

     struct kevent64_s {
             uint64_t        ident;          /* identifier for this event */
             int16_t         filter;         /* filter for event */
             uint16_t        flags;          /* general flags */
             uint32_t        fflags;         /* filter-specific flags */
             int64_t         data;           /* filter-specific data */
             uint64_t        udata;          /* opaque user data identifier */
             uint64_t        ext[2];         /* filter-specific extensions */


     The fields of struct kevent and struct kevent64_s are:

     ident      Value used to identify this event.  The exact interpretation
                is determined by the attached filter, but often is a file

     filter     Identifies the kernel filter used to process this event.  The
                pre-defined system filters are described below.

     flags      Actions to perform on the event.

     fflags     Filter-specific flags.

     data       Filter-specific data value.

     udata      Opaque user-defined value passed through the kernel unchanged.

     In addition, struct kevent64_s contains:

     ext[2]     This field stores extensions for the event's filter. What type
                of extension depends on what type of filter is being used.


     The flags field can contain the following values:

     EV_ADD         Adds the event to the kqueue.  Re-adding an existing event
                    will modify the parameters of the original event, and not
                    result in a duplicate entry.  Adding an event automati-
                    cally enables it, unless overridden by the EV_DISABLE

     EV_ENABLE      Permit kevent() and kevent64() to return the event if it
                    is triggered.

     EV_DISABLE     Disable the event so kevent() and kevent64() will not
                    return it.  The filter itself is not disabled.

     EV_DELETE      Removes the event from the kqueue.  Events which are
                    attached to file descriptors are automatically deleted on
                    the last close of the descriptor.

     EV_RECEIPT     This flag is useful for making bulk changes to a kqueue
                    without draining any pending events. When passed as input,
                    it forces EV_ERROR to always be returned.  When a filter
                    is successfully added, the data field will be zero.

     EV_ONESHOT     Causes the event to return only the first occurrence of
                    the filter being triggered.  After the user retrieves the
                    event from the kqueue, it is deleted.

     EV_CLEAR       After the event is retrieved by the user, its state is
                    reset.  This is useful for filters which report state
                    transitions instead of the current state.  Note that some
                    filters may automatically set this flag internally.

     EV_EOF         Filters may set this flag to indicate filter-specific EOF

     EV_ERROR       See RETURN VALUES below.


     The predefined system filters are listed below.  Arguments may be passed
     to and from the filter via the fflags and data fields in the kevent or
     kevent64_s structure.

     EVFILT_READ      Takes a file descriptor as the identifier, and returns
                      whenever there is data available to read.  The behavior
                      of the filter is slightly different depending on the
                      descriptor type.

                          Sockets which have previously been passed to
                          listen() return when there is an incoming connection
                          pending.  data contains the size of the listen back-

                          Other socket descriptors return when there is data
                          to be read, subject to the SO_RCVLOWAT value of the
                          socket buffer.  This may be overridden with a per-
                          filter low water mark at the time the filter is
                          added by setting the NOTE_LOWAT flag in fflags, and
                          specifying the new low water mark in data.  On
                          return, data contains the number of bytes of proto-
                          col data available to read.

                          If the read direction of the socket has shutdown,
                          then the filter also sets EV_EOF in flags, and
                          returns the socket error (if any) in fflags.  It is
                          possible for EOF to be returned (indicating the con-
                          nection is gone) while there is still data pending
                          in the socket buffer.

                          Returns when the file pointer is not at the end of
                          file.  data contains the offset from current posi-
                          tion to end of file, and may be negative.

                      Fifos, Pipes
                          Returns when the there is data to read; data con-
                          tains the number of bytes available.

                          When the last writer disconnects, the filter will
                          set EV_EOF in flags.  This may be cleared by passing
                          in EV_CLEAR, at which point the filter will resume
                          waiting for data to become available before return-

     EVFILT_WRITE     Takes a file descriptor as the identifier, and returns
                      whenever it is possible to write to the descriptor.  For
                      sockets, pipes and fifos, data will contain the amount
                      of space remaining in the write buffer.  The filter will
                      set EV_EOF when the reader disconnects, and for the fifo
                      case, this may be cleared by use of EV_CLEAR.  Note that
                      this filter is not supported for vnodes.

                      For sockets, the low water mark and socket error han-
                      dling is identical to the EVFILT_READ case.

     EVFILT_AIO       This filter is currently unsupported.

     EVFILT_VNODE     Takes a file descriptor as the identifier and the events
                      to watch for in fflags, and returns when one or more of
                      the requested events occurs on the descriptor.  The
                      events to monitor are:

                      NOTE_DELETE    The unlink() system call was called on
                                     the file referenced by the descriptor.

                      NOTE_WRITE     A write occurred on the file referenced
                                     by the descriptor.

                      NOTE_EXTEND    The file referenced by the descriptor was

                      NOTE_ATTRIB    The file referenced by the descriptor had
                                     its attributes changed.

                      NOTE_LINK      The link count on the file changed.

                      NOTE_RENAME    The file referenced by the descriptor was

                      NOTE_REVOKE    Access to the file was revoked via
                                     revoke(2) or the underlying fileystem was

                      On return, fflags contains the events which triggered
                      the filter.

     EVFILT_PROC      Takes the process ID to monitor as the identifier and
                      the events to watch for in fflags, and returns when the
                      process performs one or more of the requested events.
                      If a process can normally see another process, it can
                      attach an event to it.  The events to monitor are:

                      NOTE_EXIT    The process has exited.

                                   The process has exited and its exit status
                                   is in filter specific data. Valid only on
                                   child processes and to be used along with

                      NOTE_FORK    The process created a child process via
                                   fork(2) or similar call.

                      NOTE_EXEC    The process executed a new process via
                                   execve(2) or similar call.

                      NOTE_SIGNAL  The process was sent a signal. Status can
                                   be checked via waitpid(2) or similar call.

                      NOTE_REAP    The process was reaped by the parent via
                                   wait(2) or similar call. Deprecated, use

                      On return, fflags contains the events which triggered
                      the filter.

     EVFILT_SIGNAL    Takes the signal number to monitor as the identifier and
                      returns when the given signal is generated for the
                      process.  This coexists with the signal() and
                      sigaction() facilities, and has a lower precedence.
                      Only signals sent to the process, not to a particular
                      thread, will trigger the filter. The filter will record
                      all attempts to deliver a signal to a process, even if
                      the signal has been marked as SIG_IGN.  Event notifica-
                      tion happens before normal signal delivery processing.
                      data returns the number of times the signal has been
                      generated since the last call to kevent().  This filter
                      automatically sets the EV_CLEAR flag internally.

     EVFILT_MACHPORT  Takes the name of a mach port, or port set, in ident and
                      waits until a message is received on the port or port
                      set. When a message is recieved, the size of the message
                      is returned in data and if fflags is set to
                      MACH_RCV_MSG, a pointer to the message is returned in

     EVFILT_TIMER     Establishes an interval timer with the data timer iden-
                      tified by ident.  When adding a timer, data specifies
                      the timeout period and fflags can be set to one of the

                      NOTE_SECONDS   data is in seconds

                      NOTE_USECONDS  data is in microseconds

                      NOTE_NSECONDS  data is in nanoseconds

                      NOTE_ABSOLUTE  data is an absolute timeout

                      NOTE_CRITICAL  system makes a best effort to fire this
                                     timer as scheduled.

                                     system has extra leeway to coalesce this

                      NOTE_LEEWAY    ext[1] holds user-supplied slop in dead-
                                     line for timer coalescing.

                      If fflags is not set, the default is milliseconds. The
                      timer will be periodic unless EV_ONESHOT is specified.
                      On return, data contains the number of times the timeout
                      has expired since the last call to kevent() or
                      kevent64().  This filter automatically sets the EV_CLEAR
                      flag internally.


     In the ext[2] field of the kevent64_s struture, ext[0] is only used with
     the EVFILT_MACHPORT filter.  With other filters, ext[0] is passed through
     kevent64() much like udata.  ext[1] can always be used like udata.  For
     the use of ext[0], see the EVFILT_MACHPORT filter above.


     The kqueue() system call creates a new kernel event queue and returns a
     file descriptor.  If there was an error creating the kernel event queue,
     a value of -1 is returned and errno set.

     The kevent() and kevent64() system calls return the number of events
     placed in the eventlist, up to the value given by nevents.  If an error
     occurs while processing an element of the changelist and there is enough
     room in the eventlist, then the event will be placed in the eventlist
     with EV_ERROR set in flags and the system error in data.  Otherwise, -1
     will be returned, and errno will be set to indicate the error condition.
     If the time limit expires, then kevent() and kevent64() return 0.


     The kqueue() system call fails if:

     [ENOMEM]           The kernel failed to allocate enough memory for the
                        kernel queue.

     [EMFILE]           The per-process descriptor table is full.

     [ENFILE]           The system file table is full.

     The kevent() and kevent64() system calls fail if:

     [EACCES]           The process does not have permission to register a

     [EFAULT]           There was an error reading or writing the kevent or
                        kevent64_s structure.

     [EBADF]            The specified descriptor is invalid.

     [EINTR]            A signal was delivered before the timeout expired and
                        before any events were placed on the kqueue for

     [EINVAL]           The specified time limit or filter is invalid.

     [ENOENT]           The event could not be found to be modified or

     [ENOMEM]           No memory was available to register the event.

     [ESRCH]            The specified process to attach to does not exist.


     aio_error(2), aio_read(2), aio_return(2), read(2), select(2),
     sigaction(2), write(2), signal(3)


     The kqueue() and kevent() system calls first appeared in FreeBSD 4.1.


     The kqueue() system and this manual page were written by Jonathan Lemon


     Not all filesystem types support kqueue-style notifications.  And even
     some that do, like some remote filesystems, may only support a subset of
     the notification semantics described here.

BSD                            October 21, 2008                            BSD

Mac OS X 10.9.1 - Generated Mon Jan 6 08:01:51 CST 2014
© 2000-2021
Individual documents may contain additional copyright information.