kstat

kstat is a kernel statistics facility used by Solaris and related systems to expose runtime kernel metrics to user-space programs. It provides a unified, stable interface for monitoring resources, performance counters, and internal state across various subsystems such as CPU activity, memory, I/O, networking, and device drivers.

In the kernel, statistics are organized as a chain of kstat objects. Each object is identified by a module name, a statistic name, a class, and an instance, and it carries a data area containing one or more statistics. User-space access is typically performed through the libkstat library, which offers functions to open the kstat chain, locate specific kstat objects, and read their data. A typical workflow includes opening the chain, updating it to reflect the current kernel state, and then reading values. The /dev/kstat interface and the kstat command-line tool provide convenient means to inspect statistics from the command line.

The data model supports both simple named statistics and more complex structures. Named statistics are represented with types such as kstat_named, while more elaborate data can be exposed via specialized kstat structures such as kstat_io for I/O counters or kstat_timer for timing data. Data can be read in a way that allows programs to compute deltas over time, enabling activity and performance analyses.

kstat serves as a core mechanism for system monitoring, diagnostics, and performance tuning. It remains a foundational facility in Solaris and illumos-derived systems, offering a stable API that distinguishes kernel statistics from other interfaces like procfs or sysfs.