What is the difference between hardware and software perf events?

Hardware events such as cycles and instructions are read from the CPU's Performance Monitoring Unit and are limited by the number of physical counters. Software events such as context-switches and page-faults are maintained by the kernel and have no counter limit.

How do I list all events available on my system?

Run perf list to print every supported event, grouped by hardware, software, cache, tracepoint and PMU-specific categories. Add a substring like perf list cache to filter the output to matching event names.

What does IPC mean in perf output?

IPC is instructions per cycle, computed as instructions divided by cpu-cycles. It indicates how much useful work the CPU does each cycle; a low IPC often signals stalls from cache misses, branch mispredictions or memory latency.

How do I sample a specific event with perf record?

Use perf record -e EVENT ./program, for example perf record -e cache-misses ./app. Use -g to capture call graphs and then perf report to browse the collected samples by function and symbol.

Why do some hardware events show or get multiplexed?

CPUs have a limited number of physical counters. When you request more events than counters, the kernel time-multiplexes them and scales the results, which adds estimation error. Reduce the number of simultaneous events for exact counts.

Linux perf Events Reference

Linux perf events reference

The perf tool reads CPU performance counters and kernel statistics to profile programs. Each measurement is named by an event: a symbol like cycles, cache-misses, or sched:sched_switch that you pass to perf stat or perf record. This reference lists the common events, the category they belong to, and what each one actually measures.

Filter the list by name or category to find the right symbol, then run perf stat -e EVENT ./yourprogram to count it.

How it works

Hardware events come from the CPU’s Performance Monitoring Unit (PMU), a small set of programmable counters that increment on micro-architectural occurrences such as retired instructions or last-level-cache misses. Because there are only a handful of physical counters, requesting many events forces the kernel to multiplex them in time and scale the results.

Software events are bookkeeping counters the kernel maintains directly — context switches, page faults, CPU migrations — so they are exact and unlimited. Cache events use a generic encoding of {L1D, LLC, ...} x {load, store} x {access, miss}. Tracepoints are static instrumentation points in kernel subsystems (block:, sched:, syscalls:) that fire on specific events. Symbolic names map to raw PMU codes; you can also specify a raw event with r<hex>.

Tips and examples

Measure IPC and cache behavior for a command:

perf stat -e cycles,instructions,cache-references,cache-misses ./app

Sample where cache misses happen and view by function:

perf record -e cache-misses -g ./app
perf report

Counting is low-overhead; sampling (record) is higher overhead but shows where. Use perf list to confirm which events your specific CPU supports — names vary across microarchitectures, and PMU-specific events appear as cpu/event=.../.

Linux perf Events Reference

Email me this result

Linux perf events reference

How it works

Tips and examples