| 1 | # The `ebpf load mode` option accepts the following values : |
| 2 | # `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors. |
| 3 | # `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates |
| 4 | # new charts for the return of these functions, such as errors. |
| 5 | # |
| 6 | # The `ebpf type format` option accepts the following values : |
| 7 | # `auto` : The eBPF collector will investigate hardware and select between the two next options. |
| 8 | # `legacy`: The eBPF collector will load the legacy code. Note: This has a bigger overload. |
| 9 | # `co-re` : The eBPF collector will use latest tracing method. Note: This is not available on all platforms. |
| 10 | # |
| 11 | # The `ebpf co-re tracing` option accepts the following values: |
| 12 | # `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host. |
| 13 | # `tracepoint`: When available, the eBPF collector will use kernel tracepoint to monitor syscall. |
| 14 | # `probe` : This is the same as legacy code. |
| 15 | # |
| 16 | # The `lifetime` defines the time length a thread will run when it is enabled by a function. |
| 17 | # |
| 18 | [global] |
| 19 | # ebpf load mode = entry |
| 20 | # update every = 1 |
| 21 | ebpf type format = auto |
| 22 | ebpf co-re tracing = trampoline |
| 23 | lifetime = 300 |