Scroll to navigation

EVENTSTAT(8) System Manager's Manual EVENTSTAT(8)


eventstat - a tool to measure system events.


eventstat [options] [delay [count]]


eventstat is a program that dumps the current active system events that are added to the kernel timer list.


eventstat options are as follow:

just report events, PID and process name. By default the short task name from the kernel comm field will be displayed, however the -s and -l options will report more process name information.
report cumulative events rather than events per sample period.
report the sample event count in the CSV output rather than the default events per second rate.
strip full directory path off the process name in the CSV output.
show help.
show timer ID information.
report just kernel threads.
report long process name from /proc/pid/cmdline. This reports the process name and all the command line arguments.
only display the first event_count number of top events.
run quietly, only really makes sense with -r option.
output gathered data in a comma separated values file. This can be then imported and graphed using your favourite open source spread sheet.
report short process name from /proc/pid/cmdline. This reports just the process name.
report the minimum, maximum, average and population standard deviation at the end of the CSV output.
ignore samples where the event delta per second less than the given threshold.
enable 'top' mode, refresh display on each update.
report just user space processes.
add timestamp (the "whence" info) to the output.


Dump events every second until stopped.

sudo eventstat

Dump the top 20 events every 60 seconds until stopped.

sudo eventstat -n 20 60

Dump events every 10 seconds just 5 times.

sudo eventstat 10 5

Quietly dump events every 10 seconds just 5 times into a CSV file with short process name.

sudo eventstat 10 5 -q -s -r results.csv


The -r option generates a comma separated file report that can be imported into spreadsheets or parsed using text processing tools. Column 1 of the data is the label for each row, columns 2 onwards contain the data for each task that generated a wakeup event.

The first row lists the task name of the thread or process. Task names in [ ] brackets are kernel threads, other tasks are the names of user space processes. By default these names are derived from the task names from kernel trace events but the -s -l options fetch more complete task names from /proc/pid/cmdline instead.

The second and third rows list the names of the internal Linux kernel timer init function.

The fourth row lists the total number of wakeup events for each task during the entire run of eventstat.

The subsequent rows list the average number of wakeups per second measured during the sample interval for each task in column two onwards. The first column indicates the sample time (in seconds) since the start of the measuring.


Version 4.0 of eventstat gathers event timer data from the kernel trace event timers and hence is not compatible with previous versions of eventstat. The move to using kernel trace events was necessary as the Linux 4.12 kernel dropped support for the /proc/timer_stats interface.


powertop(8), top(1)


eventstat was written by Colin King <>

This manual page was written by Colin King <>, for the Ubuntu project (but may be used by others).


Copyright © 2011-2016 Canonical Ltd.
This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

August 14, 2017