| 1 | # The `ebpf load mode` option accepts the following values : |
| 2 | # `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors. |
| 3 | # `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates |
| 4 | # new charts for the return of these functions, such as errors. |
| 5 | # |
| 6 | # The eBPF collector also creates charts for each running application through an integration with the `apps.plugin` |
| 7 | # or `cgroups.plugin`. |
| 8 | # If you want to disable the integration with `apps.plugin` or `cgroups.plugin` along with the above charts, change |
| 9 | # the setting `apps` and `cgroups` to 'no'. |
| 10 | # |
| 11 | # The following options change the hash table size: |
| 12 | # `bandwidth table size`: Maximum number of connections monitored |
| 13 | # `ipv4 connection table size`: Maximum number of IPV4 connections monitored |
| 14 | # `ipv6 connection table size`: Maximum number of IPV6 connections monitored |
| 15 | # `udp connection table size`: Maximum number of UDP connections monitored |
| 16 | # |
| 17 | # The `ebpf type format` option accepts the following values : |
| 18 | # `auto` : The eBPF collector will investigate hardware and select between the two next options. |
| 19 | # `legacy`: The eBPF collector will load the legacy code. Note: This has a bigger overload. |
| 20 | # `co-re` : The eBPF collector will use latest tracing method. Note: This is not available on all platforms. |
| 21 | # |
| 22 | # The `ebpf co-re tracing` option accepts the following values: |
| 23 | # `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host. |
| 24 | # `tracepoint`: When available, the eBPF collector will use kernel tracepoint to monitor syscall. |
| 25 | # `probe` : This is the same as legacy code. |
| 26 | # |
| 27 | # The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6. |
| 28 | # |
| 29 | # The `collect pid` option defines the PID stored inside hash tables and accepts the following options: |
| 30 | # `real parent`: Only stores real parent inside PID |
| 31 | # `parent` : Only stores parent PID. |
| 32 | # `all` : Stores all PIDs used by software. This is the most expensive option. |
| 33 | # |
| 34 | # The `lifetime` defines the time length a thread will run when it is enabled by a function. |
| 35 | # |
| 36 | # Uncomment lines to define specific options for thread. |
| 37 | [global] |
| 38 | # ebpf load mode = entry |
| 39 | # apps = yes |
| 40 | # cgroups = no |
| 41 | # update every = 10 |
| 42 | bandwidth table size = 16384 |
| 43 | socket monitoring table size = 16384 |
| 44 | udp connection table size = 4096 |
| 45 | ebpf type format = auto |
| 46 | ebpf co-re tracing = probe |
| 47 | maps per core = no |
| 48 | collect pid = all |
| 49 | lifetime = 300 |
| 50 | |
| 51 | # |
| 52 | # Network Connection |
| 53 | # |
| 54 | # This is a feature with status WIP(Work in Progress) |
| 55 | # |
| 56 | [network connections] |
| 57 | enabled = yes |
| 58 | resolve hostnames = no |
| 59 | resolve service names = yes |
| 60 | ports = * |
| 61 | # ips = !127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 fc00::/7 !::1/128 |
| 62 | ips = * |
| 63 | hostnames = * |
| 64 | |
| 65 | [service name] |
| 66 | 19999 = Netdata |