---
name: "nlsysevent"
section: "4"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/nlsysevent"
---

# nlsysevent(4)

Netlink-based kernel event notification module

## NAME

**nlsysevent** – Netlink-based kernel event notification module

## SYNOPSIS

To load the driver as a module at boot time, place the following line in [loader.conf(5)](/loader.conf/5.md):

```
nlsysevent_load="YES"
```

Alternatively, to load the module at runtime:

```
kldload nlsysevent
```

## DESCRIPTION

The **nlsysevent** kernel module provides a [netlink(4)](/netlink/4.md) Generic Netlink interface for receiving kernel device events. It hooks into the [devctl(4)](/devctl/4.md) notification system and re-publishes all kernel events as Generic Netlink multicast messages under the NETLINK\_GENERIC protocol family.

This provides an alternative to reading events from */dev/devctl* (used by [devd(8)](/devd/8.md)), with the advantage that multiple consumers can subscribe to events simultaneously, and consumers can selectively subscribe to specific event groups.

### Generic Netlink Family

The module registers a Generic Netlink family named “nlsysevent”. The dynamically-assigned family identifier can be resolved using the standard CTRL\_CMD\_GETFAMILY request as described in [genetlink(4)](/genetlink/4.md).

### Commands

The following command is defined:

- NLSE\_CMD\_NEWEVENT

  Sent when a kernel event occurs. This message is never solicited by userland; it is only delivered to sockets that have subscribed to one or more multicast groups.

### Attributes

Each NLSE\_CMD\_NEWEVENT message contains the following TLV attributes:

- NLSE\_ATTR\_SYSTEM

  (string) The system name that generated the event (e.g., “ACPI, “IFNET, “USB”””).

- NLSE\_ATTR\_SUBSYSTEM

  (string) The subsystem name within the system.

- NLSE\_ATTR\_TYPE

  (string) The type of the event.

- NLSE\_ATTR\_DATA

  (string) Optional extra data associated with the event. This attribute may be absent if no extra data was provided.

### Multicast Groups

The module creates one multicast group per system name. The following groups are pre-registered when the module is loaded:

| |
| --- |
| ACPI |
| AEON |
| CAM |
| CARP |
| coretemp |
| DEVFS |
| device |
| ETHERNET |
| GEOM |
| HYPERV\_NIC\_VF |
| IFNET |
| INFINIBAND |
| KERNEL |
| nvme |
| PMU |
| RCTL |
| USB |
| VFS |
| VT |
| ZFS |

Additional groups are created dynamically as new system names appear in kernel events, up to a maximum of 64 groups.

The group identifier for a given system name can be resolved via CTRL\_CMD\_GETFAMILY and then subscribed to using the NETLINK\_ADD\_MEMBERSHIP socket option.

## EXAMPLES

The [genl(1)](/genl/1.md) utility can be used to monitor events:

```
genl monitor nlsysevent
```

## SEE ALSO

[genl(1)](/genl/1.md), [snl(3)](/snl/3.md), [devctl(4)](/devctl/4.md), [genetlink(4)](/genetlink/4.md), [netlink(4)](/netlink/4.md), [devd(8)](/devd/8.md)

## HISTORY

The **nlsysevent** module first appeared in FreeBSD 15.0.

## AUTHORS

The **nlsysevent** kernel module and this manual page were written by Baptiste Daroussin ⟨*bapt@FreeBSD.org*⟩.