---
name: "avc_cache_stats"
section: "3"
platform: "linux"
package: "libselinux1-dev"
version: "3.8.1-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/avc_cache_stats"
---

# avc\_cache\_stats(3)

obtain userspace SELinux AVC statistics

## NAME

avc\_cache\_stats, avc\_av\_stats, avc\_sid\_stats - obtain userspace SELinux AVC statistics

## SYNOPSIS

**#include \<selinux/selinux.h\>**\
 **#include \<selinux/avc.h\>**

**void avc\_av\_stats(void);**

**void avc\_sid\_stats(void);**

**void avc\_cache\_stats(struct avc\_cache\_stats \****stats***);**

## DESCRIPTION

The userspace AVC maintains two internal hash tables, one to store security ID's and one to cache access decisions.

**avc\_av\_stats**() and **avc\_sid\_stats**() produce log messages indicating the status of the access decision and SID tables, respectively.  The messages contain the number of entries in the table, number of hash buckets and number of buckets used, and maximum number of entries in a single bucket.

**avc\_cache\_stats**() populates a structure whose fields reflect cache activity:

```
struct avc_cache_stats {
	unsigned	entry_lookups;
	unsigned	entry_hits;
	unsigned	entry_misses;
	unsigned	entry_discards;
	unsigned	cav_lookups;
	unsigned	cav_hits;
	unsigned	cav_probes;
	unsigned	cav_misses;
};
```

- *entry\_lookups*

  Number of queries made.

- *entry\_hits*

  Number of times a decision was found in the *aeref* argument.

- *entry\_misses*

  Number of times a decision was not found in the *aeref* argument.

- *entry\_discards*

  Number of times a decision was not found in the *aeref* argument and the *aeref* argument was non-NULL.

- *cav\_lookups*

  Number of cache lookups.

- *cav\_hits*

  Number of cache hits.

- *cav\_misses*

  Number of cache misses.

- *cav\_probes*

  Number of entries examined while searching the cache.

## NOTES

When the cache is flushed as a result of a call to **avc\_reset**() or a policy change notification, the statistics returned by **avc\_cache\_stats**() are reset to zero.  The SID table, however, is left unchanged.

When a policy change notification is received, a call to **avc\_av\_stats**() is made before the cache is flushed.

## AUTHOR

Eamon Walsh \<ewalsh@tycho.nsa.gov\>

## SEE ALSO

[**avc\_init**(3)](/avc_init/3.md), [**avc\_has\_perm**(3)](/avc_has_perm/3.md), [**avc\_context\_to\_sid**(3)](/avc_context_to_sid/3.md), [**avc\_add\_callback**(3)](/avc_add_callback/3.md), [**selinux**(8)](/selinux/8.md)