| 1 | plugin_name: ebpf.plugin |
| 2 | modules: |
| 3 | - meta: |
| 4 | plugin_name: ebpf.plugin |
| 5 | module_name: filedescriptor |
| 6 | monitored_instance: |
| 7 | name: eBPF Filedescriptor |
| 8 | link: "https://kernel.org/" |
| 9 | categories: |
| 10 | - data-collection.operating-systems |
| 11 | icon_filename: "ebpf.jpg" |
| 12 | related_resources: |
| 13 | integrations: |
| 14 | list: |
| 15 | - plugin_name: apps.plugin |
| 16 | module_name: apps |
| 17 | - plugin_name: cgroups.plugin |
| 18 | module_name: /sys/fs/cgroup |
| 19 | monitored_instance_name: Containers |
| 20 | info_provided_to_referring_integrations: |
| 21 | description: "" |
| 22 | keywords: |
| 23 | - file |
| 24 | - eBPF |
| 25 | - fd |
| 26 | - open |
| 27 | - close |
| 28 | overview: |
| 29 | data_collection: |
| 30 | metrics_description: "Monitor calls for functions responsible to open or close a file descriptor and possible errors." |
| 31 | method_description: "Attach tracing (kprobe and trampoline) to internal kernel functions according options used to compile kernel." |
| 32 | supported_platforms: |
| 33 | include: |
| 34 | - Linux |
| 35 | exclude: [] |
| 36 | multi_instance: true |
| 37 | additional_permissions: |
| 38 | description: "The plugin needs setuid because it loads data inside kernel. Netdata sets necessary permissions during installation time." |
| 39 | default_behavior: |
| 40 | auto_detection: |
| 41 | description: "The plugin checks kernel compilation flags (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) and presence of BTF files to decide which eBPF program will be attached." |
| 42 | limits: |
| 43 | description: "" |
| 44 | performance_impact: |
| 45 | description: "Depending of kernel version and frequency that files are open and close, this thread will add overhead every time that an internal kernel function monitored by this thread is called. The estimated additional period of time is between 90-200ns per call on kernels that do not have BTF technology." |
| 46 | setup: |
| 47 | prerequisites: |
| 48 | list: |
| 49 | - title: Compile kernel |
| 50 | description: | |
| 51 | Check if your kernel was compiled with necessary options (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) in `/proc/config.gz` or inside /boot/config file. Some cited names can be different accoring preferences of Linux distributions. |
| 52 | When you do not have options set, it is necessary to get the kernel source code from https://kernel.org or a kernel package from your distribution, this last is preferred. The kernel compilation has a well definedd pattern, but distributions can deliver their configuration files |
| 53 | with different names. |
| 54 | |
| 55 | Now follow steps: |
| 56 | 1. Copy the configuration file to /usr/src/linux/.config. |
| 57 | 2. Select the necessary options: make oldconfig |
| 58 | 3. Compile your kernel image: make bzImage |
| 59 | 4. Compile your modules: make modules |
| 60 | 5. Copy your new kernel image for boot loader directory |
| 61 | 6. Install the new modules: make modules_install |
| 62 | 7. Generate an initial ramdisk image (`initrd`) if it is necessary. |
| 63 | 8. Update your boot loader |
| 64 | configuration: |
| 65 | file: |
| 66 | name: "ebpf.d/fd.conf" |
| 67 | description: "Overwrite default configuration helping to reduce memory usage. You can also select charts visible on dashboard." |
| 68 | options: |
| 69 | description: | |
| 70 | All options are defined inside section `[global]`. |
| 71 | folding: |
| 72 | title: "Config options" |
| 73 | enabled: true |
| 74 | list: |
| 75 | - name: update every |
| 76 | description: Data collection frequency. |
| 77 | default_value: 10 |
| 78 | required: false |
| 79 | - name: ebpf load mode |
| 80 | description: Define whether plugin will monitor the call (`entry`) for the functions or it will also monitor the return (`return`). |
| 81 | default_value: entry |
| 82 | required: false |
| 83 | - name: apps |
| 84 | description: Enable or disable integration with apps.plugin |
| 85 | default_value: no |
| 86 | required: false |
| 87 | - name: cgroups |
| 88 | description: Enable or disable integration with cgroup.plugin |
| 89 | default_value: no |
| 90 | required: false |
| 91 | - name: pid table size |
| 92 | description: Number of elements stored inside hash tables used to monitor calls per PID. |
| 93 | default_value: 32768 |
| 94 | required: false |
| 95 | - name: ebpf type format |
| 96 | description: "Define the file type to load an eBPF program. Three options are available: `legacy` (Attach only `kprobe`), `co-re` (Plugin tries to use `trampoline` when available), and `auto` (plugin check OS configuration before to load)." |
| 97 | default_value: auto |
| 98 | required: false |
| 99 | - name: ebpf co-re tracing |
| 100 | description: "Select the attach method used by plugin when `co-re` is defined in previous option. Two options are available: `trampoline` (Option with lowest overhead), and `probe` (the same of legacy code)." |
| 101 | default_value: trampoline |
| 102 | required: false |
| 103 | - name: maps per core |
| 104 | description: Define how plugin will load their hash maps. When enabled (`yes`) plugin will load one hash table per core, instead to have centralized information. |
| 105 | default_value: yes |
| 106 | required: false |
| 107 | - name: lifetime |
| 108 | description: Set default lifetime for thread when enabled by cloud. |
| 109 | default_value: 300 |
| 110 | required: false |
| 111 | examples: |
| 112 | folding: |
| 113 | enabled: true |
| 114 | title: "" |
| 115 | list: [] |
| 116 | troubleshooting: |
| 117 | problems: |
| 118 | list: [] |
| 119 | alerts: [] |
| 120 | metrics: |
| 121 | folding: |
| 122 | title: Metrics |
| 123 | enabled: false |
| 124 | description: "" |
| 125 | availability: [] |
| 126 | scopes: |
| 127 | - name: cgroup |
| 128 | description: "These Metrics show grouped information per cgroup/service." |
| 129 | labels: [] |
| 130 | metrics: |
| 131 | - name: cgroup.fd_open |
| 132 | description: Number of open files |
| 133 | unit: "calls/s" |
| 134 | chart_type: line |
| 135 | dimensions: |
| 136 | - name: open |
| 137 | - name: cgroup.fd_open_error |
| 138 | description: Fails to open files |
| 139 | unit: "calls/s" |
| 140 | chart_type: line |
| 141 | dimensions: |
| 142 | - name: open |
| 143 | - name: cgroup.fd_closed |
| 144 | description: Files closed |
| 145 | unit: "calls/s" |
| 146 | chart_type: line |
| 147 | dimensions: |
| 148 | - name: close |
| 149 | - name: cgroup.fd_close_error |
| 150 | description: Fails to close files |
| 151 | unit: "calls/s" |
| 152 | chart_type: line |
| 153 | dimensions: |
| 154 | - name: close |
| 155 | - name: services.file_open |
| 156 | description: Number of open files |
| 157 | unit: "calls/s" |
| 158 | chart_type: stacked |
| 159 | dimensions: |
| 160 | - name: a dimension per systemd service |
| 161 | - name: services.file_open_error |
| 162 | description: Fails to open files |
| 163 | unit: "calls/s" |
| 164 | chart_type: stacked |
| 165 | dimensions: |
| 166 | - name: a dimension per systemd service |
| 167 | - name: services.file_closed |
| 168 | description: Files closed |
| 169 | unit: "calls/s" |
| 170 | chart_type: stacked |
| 171 | dimensions: |
| 172 | - name: a dimension per systemd service |
| 173 | - name: services.file_close_error |
| 174 | description: Fails to close files |
| 175 | unit: "calls/s" |
| 176 | chart_type: stacked |
| 177 | dimensions: |
| 178 | - name: a dimension per systemd service |
| 179 | - name: global |
| 180 | description: "These metrics show total number of calls to functions inside kernel." |
| 181 | labels: [] |
| 182 | metrics: |
| 183 | - name: filesystem.file_descriptor |
| 184 | description: Open and close calls |
| 185 | unit: "calls/s" |
| 186 | chart_type: line |
| 187 | dimensions: |
| 188 | - name: open |
| 189 | - name: close |
| 190 | - name: filesystem.file_error |
| 191 | description: Open fails |
| 192 | unit: "calls/s" |
| 193 | chart_type: line |
| 194 | dimensions: |
| 195 | - name: open |
| 196 | - name: close |
| 197 | - name: apps |
| 198 | description: "These Metrics show grouped information per apps group." |
| 199 | labels: |
| 200 | - name: app_group |
| 201 | description: The name of the group defined in the configuration. |
| 202 | metrics: |
| 203 | - name: app.ebpf_file_open |
| 204 | description: Number of open files |
| 205 | unit: "calls/s" |
| 206 | chart_type: stacked |
| 207 | dimensions: |
| 208 | - name: calls |
| 209 | - name: app.ebpf_file_open_error |
| 210 | description: Fails to open files |
| 211 | unit: "calls/s" |
| 212 | chart_type: stacked |
| 213 | dimensions: |
| 214 | - name: calls |
| 215 | - name: app.ebpf_file_closed |
| 216 | description: Files closed |
| 217 | unit: "calls/s" |
| 218 | chart_type: stacked |
| 219 | dimensions: |
| 220 | - name: calls |
| 221 | - name: app.ebpf_file_close_error |
| 222 | description: Fails to close files |
| 223 | unit: "calls/s" |
| 224 | chart_type: stacked |
| 225 | dimensions: |
| 226 | - name: calls |
| 227 | - meta: |
| 228 | plugin_name: ebpf.plugin |
| 229 | module_name: processes |
| 230 | monitored_instance: |
| 231 | name: eBPF Processes |
| 232 | link: "https://kernel.org/" |
| 233 | categories: |
| 234 | - data-collection.operating-systems |
| 235 | icon_filename: "ebpf.jpg" |
| 236 | related_resources: |
| 237 | integrations: |
| 238 | list: |
| 239 | - plugin_name: apps.plugin |
| 240 | module_name: apps |
| 241 | - plugin_name: cgroups.plugin |
| 242 | module_name: /sys/fs/cgroup |
| 243 | monitored_instance_name: Containers |
| 244 | info_provided_to_referring_integrations: |
| 245 | description: "" |
| 246 | keywords: |
| 247 | - thread |
| 248 | - fork |
| 249 | - process |
| 250 | - eBPF |
| 251 | overview: |
| 252 | data_collection: |
| 253 | metrics_description: "Monitor calls for function creating tasks (threads and processes) inside Linux kernel." |
| 254 | method_description: "Attach tracing (kprobe or tracepoint, and trampoline) to internal kernel functions." |
| 255 | supported_platforms: |
| 256 | include: |
| 257 | - Linux |
| 258 | exclude: [] |
| 259 | multi_instance: true |
| 260 | additional_permissions: |
| 261 | description: "The plugin needs setuid because it loads data inside kernel. Netada sets necessary permission during installation time." |
| 262 | default_behavior: |
| 263 | auto_detection: |
| 264 | description: "The plugin checks kernel compilation flags (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT), files inside debugfs, and presence of BTF files to decide which eBPF program will be attached." |
| 265 | limits: |
| 266 | description: "" |
| 267 | performance_impact: |
| 268 | description: "This thread will add overhead every time that an internal kernel function monitored by this thread is called." |
| 269 | setup: |
| 270 | prerequisites: |
| 271 | list: |
| 272 | - title: Compile kernel |
| 273 | description: | |
| 274 | Check if your kernel was compiled with necessary options (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) in `/proc/config.gz` or inside /boot/config file. Some cited names can be different accoring preferences of Linux distributions. |
| 275 | When you do not have options set, it is necessary to get the kernel source code from https://kernel.org or a kernel package from your distribution, this last is preferred. The kernel compilation has a well definedd pattern, but distributions can deliver their configuration files |
| 276 | with different names. |
| 277 | |
| 278 | Now follow steps: |
| 279 | 1. Copy the configuration file to /usr/src/linux/.config. |
| 280 | 2. Select the necessary options: make oldconfig |
| 281 | 3. Compile your kernel image: make bzImage |
| 282 | 4. Compile your modules: make modules |
| 283 | 5. Copy your new kernel image for boot loader directory |
| 284 | 6. Install the new modules: make modules_install |
| 285 | 7. Generate an initial ramdisk image (`initrd`) if it is necessary. |
| 286 | 8. Update your boot loader |
| 287 | - title: Debug Filesystem |
| 288 | description: | |
| 289 | This thread needs to attach a tracepoint to monitor when a process schedule an exit event. To allow this specific feaure, it is necessary to mount `debugfs` (`mount -t debugfs none /sys/kernel/debug/`). |
| 290 | configuration: |
| 291 | file: |
| 292 | name: "ebpf.d/process.conf" |
| 293 | description: "Overwrite default configuration helping to reduce memory usage. You can also select charts visible on dashboard." |
| 294 | options: |
| 295 | description: | |
| 296 | All options are defined inside section `[global]`. |
| 297 | folding: |
| 298 | title: "Config options" |
| 299 | enabled: true |
| 300 | list: |
| 301 | - name: update every |
| 302 | description: Data collection frequency. |
| 303 | default_value: 10 |
| 304 | required: false |
| 305 | - name: ebpf load mode |
| 306 | description: Define whether plugin will monitor the call (`entry`) for the functions or it will also monitor the return (`return`). |
| 307 | default_value: entry |
| 308 | required: false |
| 309 | - name: apps |
| 310 | description: Enable or disable integration with apps.plugin |
| 311 | default_value: no |
| 312 | required: false |
| 313 | - name: cgroups |
| 314 | description: Enable or disable integration with cgroup.plugin |
| 315 | default_value: no |
| 316 | required: false |
| 317 | - name: pid table size |
| 318 | description: Number of elements stored inside hash tables used to monitor calls per PID. |
| 319 | default_value: 32768 |
| 320 | required: false |
| 321 | - name: ebpf type format |
| 322 | description: "Define the file type to load an eBPF program. Three options are available: `legacy` (Attach only `kprobe`), `co-re` (Plugin tries to use `trampoline` when available), and `auto` (plugin check OS configuration before to load)." |
| 323 | default_value: auto |
| 324 | required: false |
| 325 | - name: ebpf co-re tracing |
| 326 | description: "Select the attach method used by plugin when `co-re` is defined in previous option. Two options are available: `trampoline` (Option with lowest overhead), and `probe` (the same of legacy code). This plugin will always try to attach a tracepoint, so option here will impact only function used to monitor task (thread and process) creation." |
| 327 | default_value: trampoline |
| 328 | required: false |
| 329 | - name: maps per core |
| 330 | description: Define how plugin will load their hash maps. When enabled (`yes`) plugin will load one hash table per core, instead to have centralized information. |
| 331 | default_value: yes |
| 332 | required: false |
| 333 | - name: lifetime |
| 334 | description: Set default lifetime for thread when enabled by cloud. |
| 335 | default_value: 300 |
| 336 | required: false |
| 337 | examples: |
| 338 | folding: |
| 339 | enabled: true |
| 340 | title: "" |
| 341 | list: [] |
| 342 | troubleshooting: |
| 343 | problems: |
| 344 | list: [] |
| 345 | alerts: [] |
| 346 | metrics: |
| 347 | folding: |
| 348 | title: Metrics |
| 349 | enabled: false |
| 350 | description: "" |
| 351 | availability: [] |
| 352 | scopes: |
| 353 | - name: global |
| 354 | description: "These metrics show total number of calls to functions inside kernel." |
| 355 | labels: [] |
| 356 | metrics: |
| 357 | - name: system.process_thread |
| 358 | description: Start process |
| 359 | unit: "calls/s" |
| 360 | chart_type: line |
| 361 | dimensions: |
| 362 | - name: process |
| 363 | - name: system.process_status |
| 364 | description: Process not closed |
| 365 | unit: "difference" |
| 366 | chart_type: line |
| 367 | dimensions: |
| 368 | - name: process |
| 369 | - name: zombie |
| 370 | - name: system.exit |
| 371 | description: Exit process |
| 372 | unit: "calls/s" |
| 373 | chart_type: line |
| 374 | dimensions: |
| 375 | - name: process |
| 376 | - name: system.task_error |
| 377 | description: Fails to create process |
| 378 | unit: "calls/s" |
| 379 | chart_type: line |
| 380 | dimensions: |
| 381 | - name: task |
| 382 | - name: apps |
| 383 | description: "These Metrics show grouped information per apps group." |
| 384 | labels: |
| 385 | - name: app_group |
| 386 | description: The name of the group defined in the configuration. |
| 387 | metrics: |
| 388 | - name: app.process_create |
| 389 | description: Process started |
| 390 | unit: "calls/s" |
| 391 | chart_type: stacked |
| 392 | dimensions: |
| 393 | - name: calls |
| 394 | - name: app.thread_create |
| 395 | description: Threads started |
| 396 | unit: "calls/s" |
| 397 | chart_type: stacked |
| 398 | dimensions: |
| 399 | - name: call |
| 400 | - name: app.task_exit |
| 401 | description: Tasks starts exit process |
| 402 | unit: "calls/s" |
| 403 | chart_type: stacked |
| 404 | dimensions: |
| 405 | - name: call |
| 406 | - name: app.task_close |
| 407 | description: Tasks closed |
| 408 | unit: "calls/s" |
| 409 | chart_type: stacked |
| 410 | dimensions: |
| 411 | - name: call |
| 412 | - name: app.task_error |
| 413 | description: Errors to create process or threads |
| 414 | unit: "calls/s" |
| 415 | chart_type: stacked |
| 416 | dimensions: |
| 417 | - name: app |
| 418 | - name: cgroup |
| 419 | description: "These Metrics show grouped information per cgroup/service." |
| 420 | labels: [] |
| 421 | metrics: |
| 422 | - name: cgroup.process_create |
| 423 | description: Process started |
| 424 | unit: "calls/s" |
| 425 | chart_type: line |
| 426 | dimensions: |
| 427 | - name: process |
| 428 | - name: cgroup.thread_create |
| 429 | description: Threads started |
| 430 | unit: "calls/s" |
| 431 | chart_type: line |
| 432 | dimensions: |
| 433 | - name: thread |
| 434 | - name: cgroup.task_exit |
| 435 | description: Tasks starts exit process |
| 436 | unit: "calls/s" |
| 437 | chart_type: line |
| 438 | dimensions: |
| 439 | - name: exit |
| 440 | - name: cgroup.task_close |
| 441 | description: Tasks closed |
| 442 | unit: "calls/s" |
| 443 | chart_type: line |
| 444 | dimensions: |
| 445 | - name: process |
| 446 | - name: cgroup.task_error |
| 447 | description: Errors to create process or threads |
| 448 | unit: "calls/s" |
| 449 | chart_type: line |
| 450 | dimensions: |
| 451 | - name: process |
| 452 | - name: services.process_create |
| 453 | description: Process started |
| 454 | unit: "calls/s" |
| 455 | chart_type: stacked |
| 456 | dimensions: |
| 457 | - name: a dimension per systemd service |
| 458 | - name: services.thread_create |
| 459 | description: Threads started |
| 460 | unit: "calls/s" |
| 461 | chart_type: stacked |
| 462 | dimensions: |
| 463 | - name: a dimension per systemd service |
| 464 | - name: services.task_close |
| 465 | description: Tasks starts exit process |
| 466 | unit: "calls/s" |
| 467 | chart_type: stacked |
| 468 | dimensions: |
| 469 | - name: a dimension per systemd service |
| 470 | - name: services.task_exit |
| 471 | description: Tasks closed |
| 472 | unit: "calls/s" |
| 473 | chart_type: stacked |
| 474 | dimensions: |
| 475 | - name: a dimension per systemd service |
| 476 | - name: services.task_error |
| 477 | description: Errors to create process or threads |
| 478 | unit: "calls/s" |
| 479 | chart_type: stacked |
| 480 | dimensions: |
| 481 | - name: a dimension per systemd service |
| 482 | - meta: |
| 483 | plugin_name: ebpf.plugin |
| 484 | module_name: disk |
| 485 | monitored_instance: |
| 486 | name: eBPF Disk |
| 487 | link: "https://kernel.org/" |
| 488 | categories: |
| 489 | - data-collection.storage |
| 490 | icon_filename: "ebpf.jpg" |
| 491 | related_resources: |
| 492 | integrations: |
| 493 | list: [] |
| 494 | info_provided_to_referring_integrations: |
| 495 | description: "" |
| 496 | keywords: |
| 497 | - hard Disk |
| 498 | - eBPF |
| 499 | - latency |
| 500 | - partition |
| 501 | overview: |
| 502 | data_collection: |
| 503 | metrics_description: "Measure latency for I/O events on disk." |
| 504 | method_description: "Attach tracepoints to internal kernel functions." |
| 505 | supported_platforms: |
| 506 | include: |
| 507 | - Linux |
| 508 | exclude: [] |
| 509 | multi_instance: true |
| 510 | additional_permissions: |
| 511 | description: "The plugin needs setuid because it loads data inside kernel. Netada sets necessary permission during installation time." |
| 512 | default_behavior: |
| 513 | auto_detection: |
| 514 | description: "The plugin checks kernel compilation flags (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT), files inside debugfs, and presence of BTF files to decide which eBPF program will be attached." |
| 515 | limits: |
| 516 | description: "" |
| 517 | performance_impact: |
| 518 | description: "This thread will add overhead every time that an internal kernel function monitored by this thread is called." |
| 519 | setup: |
| 520 | prerequisites: |
| 521 | list: |
| 522 | - title: Compile kernel |
| 523 | description: | |
| 524 | Check if your kernel was compiled with necessary options (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) in `/proc/config.gz` or inside /boot/config file. Some cited names can be different accoring preferences of Linux distributions. |
| 525 | When you do not have options set, it is necessary to get the kernel source code from https://kernel.org or a kernel package from your distribution, this last is preferred. The kernel compilation has a well definedd pattern, but distributions can deliver their configuration files |
| 526 | with different names. |
| 527 | |
| 528 | Now follow steps: |
| 529 | 1. Copy the configuration file to /usr/src/linux/.config. |
| 530 | 2. Select the necessary options: make oldconfig |
| 531 | 3. Compile your kernel image: make bzImage |
| 532 | 4. Compile your modules: make modules |
| 533 | 5. Copy your new kernel image for boot loader directory |
| 534 | 6. Install the new modules: make modules_install |
| 535 | 7. Generate an initial ramdisk image (`initrd`) if it is necessary. |
| 536 | 8. Update your boot loader |
| 537 | - title: Debug Filesystem |
| 538 | description: | |
| 539 | This thread needs to attach a tracepoint to monitor when a process schedule an exit event. To allow this specific feaure, it is necessary to mount `debugfs` (`mount -t debugfs none /sys/kernel/debug/`).` |
| 540 | configuration: |
| 541 | file: |
| 542 | name: "ebpf.d/disk.conf" |
| 543 | description: "Overwrite default configuration reducing number of I/O events." |
| 544 | options: |
| 545 | description: | |
| 546 | All options are defined inside section `[global]`. |
| 547 | folding: |
| 548 | title: "Config options" |
| 549 | enabled: true |
| 550 | list: |
| 551 | - name: update every |
| 552 | description: Data collection frequency. |
| 553 | default_value: 10 |
| 554 | required: false |
| 555 | - name: ebpf load mode |
| 556 | description: Define whether plugin will monitor the call (`entry`) for the functions or it will also monitor the return (`return`). |
| 557 | default_value: entry |
| 558 | required: false |
| 559 | - name: lifetime |
| 560 | description: Set default lifetime for thread when enabled by cloud. |
| 561 | default_value: 300 |
| 562 | required: false |
| 563 | examples: |
| 564 | folding: |
| 565 | enabled: true |
| 566 | title: "" |
| 567 | list: [] |
| 568 | troubleshooting: |
| 569 | problems: |
| 570 | list: [] |
| 571 | alerts: [] |
| 572 | metrics: |
| 573 | folding: |
| 574 | title: Metrics |
| 575 | enabled: false |
| 576 | description: "" |
| 577 | availability: [] |
| 578 | scopes: |
| 579 | - name: disk |
| 580 | description: "These metrics measure latency for I/O events on every hard disk present on host." |
| 581 | labels: [] |
| 582 | metrics: |
| 583 | - name: disk.latency_io |
| 584 | description: Disk latency |
| 585 | unit: "calls/s" |
| 586 | chart_type: stacked |
| 587 | dimensions: |
| 588 | - name: latency |
| 589 | - meta: |
| 590 | plugin_name: ebpf.plugin |
| 591 | module_name: hardirq |
| 592 | monitored_instance: |
| 593 | name: eBPF Hardirq |
| 594 | link: "https://kernel.org/" |
| 595 | categories: |
| 596 | - data-collection.operating-systems |
| 597 | icon_filename: "ebpf.jpg" |
| 598 | related_resources: |
| 599 | integrations: |
| 600 | list: [] |
| 601 | info_provided_to_referring_integrations: |
| 602 | description: "" |
| 603 | keywords: |
| 604 | - HardIRQ |
| 605 | - eBPF |
| 606 | overview: |
| 607 | data_collection: |
| 608 | metrics_description: "Monitor latency for each HardIRQ available." |
| 609 | method_description: "Attach tracepoints to internal kernel functions." |
| 610 | supported_platforms: |
| 611 | include: |
| 612 | - Linux |
| 613 | exclude: [] |
| 614 | multi_instance: true |
| 615 | additional_permissions: |
| 616 | description: "The plugin needs setuid because it loads data inside kernel. Netada sets necessary permission during installation time." |
| 617 | default_behavior: |
| 618 | auto_detection: |
| 619 | description: "The plugin checks kernel compilation flags (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT), files inside debugfs, and presence of BTF files to decide which eBPF program will be attached." |
| 620 | limits: |
| 621 | description: "" |
| 622 | performance_impact: |
| 623 | description: "This thread will add overhead every time that an internal kernel function monitored by this thread is called." |
| 624 | setup: |
| 625 | prerequisites: |
| 626 | list: |
| 627 | - title: Compile kernel |
| 628 | description: | |
| 629 | Check if your kernel was compiled with necessary options (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) in `/proc/config.gz` or inside /boot/config file. Some cited names can be different accoring preferences of Linux distributions. |
| 630 | When you do not have options set, it is necessary to get the kernel source code from https://kernel.org or a kernel package from your distribution, this last is preferred. The kernel compilation has a well definedd pattern, but distributions can deliver their configuration files |
| 631 | with different names. |
| 632 | |
| 633 | Now follow steps: |
| 634 | 1. Copy the configuration file to /usr/src/linux/.config. |
| 635 | 2. Select the necessary options: make oldconfig |
| 636 | 3. Compile your kernel image: make bzImage |
| 637 | 4. Compile your modules: make modules |
| 638 | 5. Copy your new kernel image for boot loader directory |
| 639 | 6. Install the new modules: make modules_install |
| 640 | 7. Generate an initial ramdisk image (`initrd`) if it is necessary. |
| 641 | 8. Update your boot loader |
| 642 | - title: Debug Filesystem |
| 643 | description: | |
| 644 | This thread needs to attach a tracepoint to monitor when a process schedule an exit event. To allow this specific feaure, it is necessary to mount `debugfs` (`mount -t debugfs none /sys/kernel/debug/`). |
| 645 | configuration: |
| 646 | file: |
| 647 | name: "ebpf.d/hardirq.conf" |
| 648 | description: "Overwrite default configuration reducing number of I/O events." |
| 649 | options: |
| 650 | description: | |
| 651 | All options are defined inside section `[global]`. |
| 652 | folding: |
| 653 | title: "Config options" |
| 654 | enabled: true |
| 655 | list: |
| 656 | - name: update every |
| 657 | description: Data collection frequency. |
| 658 | default_value: 10 |
| 659 | required: false |
| 660 | - name: ebpf load mode |
| 661 | description: Define whether plugin will monitor the call (`entry`) for the functions or it will also monitor the return (`return`). |
| 662 | default_value: entry |
| 663 | required: false |
| 664 | - name: lifetime |
| 665 | description: Set default lifetime for thread when enabled by cloud. |
| 666 | default_value: 300 |
| 667 | required: false |
| 668 | examples: |
| 669 | folding: |
| 670 | enabled: true |
| 671 | title: "" |
| 672 | list: [] |
| 673 | troubleshooting: |
| 674 | problems: |
| 675 | list: [] |
| 676 | alerts: [] |
| 677 | metrics: |
| 678 | folding: |
| 679 | title: Metrics |
| 680 | enabled: false |
| 681 | description: "" |
| 682 | availability: [] |
| 683 | scopes: |
| 684 | - name: global |
| 685 | description: "These metrics show latest timestamp for each hardIRQ available on host." |
| 686 | labels: [] |
| 687 | metrics: |
| 688 | - name: system.hardirq_latency |
| 689 | description: Hard IRQ latency |
| 690 | unit: "milliseconds" |
| 691 | chart_type: stacked |
| 692 | dimensions: |
| 693 | - name: hardirq names |
| 694 | - meta: |
| 695 | plugin_name: ebpf.plugin |
| 696 | module_name: cachestat |
| 697 | monitored_instance: |
| 698 | name: eBPF Cachestat |
| 699 | link: "https://kernel.org/" |
| 700 | categories: |
| 701 | - data-collection.operating-systems |
| 702 | icon_filename: "ebpf.jpg" |
| 703 | related_resources: |
| 704 | integrations: |
| 705 | list: |
| 706 | - plugin_name: apps.plugin |
| 707 | module_name: apps |
| 708 | - plugin_name: cgroups.plugin |
| 709 | module_name: /sys/fs/cgroup |
| 710 | monitored_instance_name: Containers |
| 711 | info_provided_to_referring_integrations: |
| 712 | description: "" |
| 713 | keywords: |
| 714 | - Page cache |
| 715 | - Hit ratio |
| 716 | - eBPF |
| 717 | overview: |
| 718 | data_collection: |
| 719 | metrics_description: "Monitor Linux page cache events giving for users a general vision about how his kernel is manipulating files." |
| 720 | method_description: "Attach tracing (kprobe, trampoline) to internal kernel functions according options used to compile kernel." |
| 721 | supported_platforms: |
| 722 | include: |
| 723 | - Linux |
| 724 | exclude: [] |
| 725 | multi_instance: true |
| 726 | additional_permissions: |
| 727 | description: "The plugin needs setuid because it loads data inside kernel. Netada sets necessary permission during installation time." |
| 728 | default_behavior: |
| 729 | auto_detection: |
| 730 | description: "The plugin checks kernel compilation flags (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) and presence of BTF files to decide which eBPF program will be attached." |
| 731 | limits: |
| 732 | description: "" |
| 733 | performance_impact: |
| 734 | description: "This thread will add overhead every time that an internal kernel function monitored by this thread is called. The estimated additional period of time is between 90-200ns per call on kernels that do not have BTF technology." |
| 735 | setup: |
| 736 | prerequisites: |
| 737 | list: |
| 738 | - title: Compile kernel |
| 739 | description: | |
| 740 | Check if your kernel was compiled with necessary options (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) in `/proc/config.gz` or inside /boot/config file. Some cited names can be different accoring preferences of Linux distributions. |
| 741 | When you do not have options set, it is necessary to get the kernel source code from https://kernel.org or a kernel package from your distribution, this last is preferred. The kernel compilation has a well definedd pattern, but distributions can deliver their configuration files |
| 742 | with different names. |
| 743 | |
| 744 | Now follow steps: |
| 745 | 1. Copy the configuration file to /usr/src/linux/.config. |
| 746 | 2. Select the necessary options: make oldconfig |
| 747 | 3. Compile your kernel image: make bzImage |
| 748 | 4. Compile your modules: make modules |
| 749 | 5. Copy your new kernel image for boot loader directory |
| 750 | 6. Install the new modules: make modules_install |
| 751 | 7. Generate an initial ramdisk image (`initrd`) if it is necessary. |
| 752 | 8. Update your boot loader |
| 753 | configuration: |
| 754 | file: |
| 755 | name: "ebpf.d/cachestat.conf" |
| 756 | description: "Overwrite default configuration helping to reduce memory usage. You can also select charts visible on dashboard." |
| 757 | options: |
| 758 | description: | |
| 759 | All options are defined inside section `[global]`. |
| 760 | folding: |
| 761 | title: "Config options" |
| 762 | enabled: true |
| 763 | list: |
| 764 | - name: update every |
| 765 | description: Data collection frequency. |
| 766 | default_value: 10 |
| 767 | required: false |
| 768 | - name: ebpf load mode |
| 769 | description: Define whether plugin will monitor the call (`entry`) for the functions or it will also monitor the return (`return`). |
| 770 | default_value: entry |
| 771 | required: false |
| 772 | - name: apps |
| 773 | description: Enable or disable integration with apps.plugin |
| 774 | default_value: no |
| 775 | required: false |
| 776 | - name: cgroups |
| 777 | description: Enable or disable integration with cgroup.plugin |
| 778 | default_value: no |
| 779 | required: false |
| 780 | - name: pid table size |
| 781 | description: Number of elements stored inside hash tables used to monitor calls per PID. |
| 782 | default_value: 32768 |
| 783 | required: false |
| 784 | - name: ebpf type format |
| 785 | description: "Define the file type to load an eBPF program. Three options are available: `legacy` (Attach only `kprobe`), `co-re` (Plugin tries to use `trampoline` when available), and `auto` (plugin check OS configuration before to load)." |
| 786 | default_value: auto |
| 787 | required: false |
| 788 | - name: ebpf co-re tracing |
| 789 | description: "Select the attach method used by plugin when `co-re` is defined in previous option. Two options are available: `trampoline` (Option with lowest overhead), and `probe` (the same of legacy code)." |
| 790 | default_value: trampoline |
| 791 | required: false |
| 792 | - name: maps per core |
| 793 | description: Define how plugin will load their hash maps. When enabled (`yes`) plugin will load one hash table per core, instead to have centralized information. |
| 794 | default_value: yes |
| 795 | required: false |
| 796 | - name: lifetime |
| 797 | description: Set default lifetime for thread when enabled by cloud. |
| 798 | default_value: 300 |
| 799 | required: false |
| 800 | examples: |
| 801 | folding: |
| 802 | enabled: true |
| 803 | title: "" |
| 804 | list: [] |
| 805 | troubleshooting: |
| 806 | problems: |
| 807 | list: [] |
| 808 | alerts: [] |
| 809 | metrics: |
| 810 | folding: |
| 811 | title: Metrics |
| 812 | enabled: false |
| 813 | description: "" |
| 814 | availability: [] |
| 815 | scopes: |
| 816 | - name: global |
| 817 | description: "These metrics show total number of calls to functions inside kernel." |
| 818 | labels: [] |
| 819 | metrics: |
| 820 | - name: mem.cachestat_ratio |
| 821 | description: Hit ratio |
| 822 | unit: "%" |
| 823 | chart_type: line |
| 824 | dimensions: |
| 825 | - name: ratio |
| 826 | - name: mem.cachestat_dirties |
| 827 | description: Number of dirty pages |
| 828 | unit: "page/s" |
| 829 | chart_type: line |
| 830 | dimensions: |
| 831 | - name: dirty |
| 832 | - name: mem.cachestat_hits |
| 833 | description: Number of accessed files |
| 834 | unit: "hits/s" |
| 835 | chart_type: line |
| 836 | dimensions: |
| 837 | - name: hit |
| 838 | - name: mem.cachestat_misses |
| 839 | description: Files out of page cache |
| 840 | unit: "misses/s" |
| 841 | chart_type: line |
| 842 | dimensions: |
| 843 | - name: miss |
| 844 | - name: apps |
| 845 | description: "These Metrics show grouped information per apps group." |
| 846 | labels: |
| 847 | - name: app_group |
| 848 | description: The name of the group defined in the configuration. |
| 849 | metrics: |
| 850 | - name: app.ebpf_cachestat_hit_ratio |
| 851 | description: Hit ratio |
| 852 | unit: "%" |
| 853 | chart_type: line |
| 854 | dimensions: |
| 855 | - name: ratio |
| 856 | - name: app.ebpf_cachestat_dirty_pages |
| 857 | description: Number of dirty pages |
| 858 | unit: "page/s" |
| 859 | chart_type: stacked |
| 860 | dimensions: |
| 861 | - name: pages |
| 862 | - name: app.ebpf_cachestat_access |
| 863 | description: Number of accessed files |
| 864 | unit: "hits/s" |
| 865 | chart_type: stacked |
| 866 | dimensions: |
| 867 | - name: hits |
| 868 | - name: app.ebpf_cachestat_misses |
| 869 | description: Files out of page cache |
| 870 | unit: "misses/s" |
| 871 | chart_type: stacked |
| 872 | dimensions: |
| 873 | - name: misses |
| 874 | - name: cgroup |
| 875 | description: "" |
| 876 | labels: [] |
| 877 | metrics: |
| 878 | - name: cgroup.cachestat_ratio |
| 879 | description: Hit ratio |
| 880 | unit: "%" |
| 881 | chart_type: line |
| 882 | dimensions: |
| 883 | - name: ratio |
| 884 | - name: cgroup.cachestat_dirties |
| 885 | description: Number of dirty pages |
| 886 | unit: "page/s" |
| 887 | chart_type: line |
| 888 | dimensions: |
| 889 | - name: dirty |
| 890 | - name: cgroup.cachestat_hits |
| 891 | description: Number of accessed files |
| 892 | unit: "hits/s" |
| 893 | chart_type: line |
| 894 | dimensions: |
| 895 | - name: hit |
| 896 | - name: cgroup.cachestat_misses |
| 897 | description: Files out of page cache |
| 898 | unit: "misses/s" |
| 899 | chart_type: line |
| 900 | dimensions: |
| 901 | - name: miss |
| 902 | - name: services.cachestat_ratio |
| 903 | description: Hit ratio |
| 904 | unit: "%" |
| 905 | chart_type: line |
| 906 | dimensions: |
| 907 | - name: a dimension per systemd service |
| 908 | - name: services.cachestat_dirties |
| 909 | description: Number of dirty pages |
| 910 | unit: "page/s" |
| 911 | chart_type: line |
| 912 | dimensions: |
| 913 | - name: a dimension per systemd service |
| 914 | - name: services.cachestat_hits |
| 915 | description: Number of accessed files |
| 916 | unit: "hits/s" |
| 917 | chart_type: line |
| 918 | dimensions: |
| 919 | - name: a dimension per systemd service |
| 920 | - name: services.cachestat_misses |
| 921 | description: Files out of page cache |
| 922 | unit: "misses/s" |
| 923 | chart_type: line |
| 924 | dimensions: |
| 925 | - name: a dimension per systemd service |
| 926 | - meta: |
| 927 | plugin_name: ebpf.plugin |
| 928 | module_name: sync |
| 929 | monitored_instance: |
| 930 | name: eBPF Sync |
| 931 | link: "https://kernel.org/" |
| 932 | categories: |
| 933 | - data-collection.storage |
| 934 | icon_filename: "ebpf.jpg" |
| 935 | related_resources: |
| 936 | integrations: |
| 937 | list: [] |
| 938 | info_provided_to_referring_integrations: |
| 939 | description: "" |
| 940 | keywords: |
| 941 | - syscall |
| 942 | - eBPF |
| 943 | - hard disk |
| 944 | - memory |
| 945 | overview: |
| 946 | data_collection: |
| 947 | metrics_description: "Monitor syscall responsible to move data from memory to storage device." |
| 948 | method_description: "Attach tracing (kprobe, trampoline) to internal kernel functions according options used to compile kernel." |
| 949 | supported_platforms: |
| 950 | include: |
| 951 | - Linux |
| 952 | exclude: [] |
| 953 | multi_instance: true |
| 954 | additional_permissions: |
| 955 | description: "The plugin needs setuid because it loads data inside kernel. Netada sets necessary permission during installation time." |
| 956 | default_behavior: |
| 957 | auto_detection: |
| 958 | description: "The plugin checks kernel compilation flags (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT, CONFIG_HAVE_SYSCALL_TRACEPOINTS), files inside debugfs, and presence of BTF files to decide which eBPF program will be attached." |
| 959 | limits: |
| 960 | description: "" |
| 961 | performance_impact: |
| 962 | description: "This thread will add overhead every time that an internal kernel function monitored by this thread is called. The estimated additional period of time is between 90-200ns per call on kernels that do not have BTF technology." |
| 963 | setup: |
| 964 | prerequisites: |
| 965 | list: |
| 966 | - title: Compile kernel |
| 967 | description: | |
| 968 | Check if your kernel was compiled with necessary options (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) in `/proc/config.gz` or inside /boot/config file. Some cited names can be different accoring preferences of Linux distributions. |
| 969 | When you do not have options set, it is necessary to get the kernel source code from https://kernel.org or a kernel package from your distribution, this last is preferred. The kernel compilation has a well definedd pattern, but distributions can deliver their configuration files |
| 970 | with different names. |
| 971 | |
| 972 | Now follow steps: |
| 973 | 1. Copy the configuration file to /usr/src/linux/.config. |
| 974 | 2. Select the necessary options: make oldconfig |
| 975 | 3. Compile your kernel image: make bzImage |
| 976 | 4. Compile your modules: make modules |
| 977 | 5. Copy your new kernel image for boot loader directory |
| 978 | 6. Install the new modules: make modules_install |
| 979 | 7. Generate an initial ramdisk image (`initrd`) if it is necessary. |
| 980 | 8. Update your boot loader |
| 981 | - title: Debug Filesystem |
| 982 | description: | |
| 983 | This thread needs to attach a tracepoint to monitor when a process schedule an exit event. To allow this specific feaure, it is necessary to mount `debugfs` (`mount -t debugfs none /sys/kernel/debug`). |
| 984 | configuration: |
| 985 | file: |
| 986 | name: "ebpf.d/sync.conf" |
| 987 | description: "Overwrite default configuration and allows user to select charts visible on dashboard." |
| 988 | options: |
| 989 | description: | |
| 990 | This configuration file have two different sections. The `[global]` overwrites all default options, while `[syscalls]` allow user to select the syscall to monitor. |
| 991 | folding: |
| 992 | title: "Config options" |
| 993 | enabled: true |
| 994 | list: |
| 995 | - name: update every |
| 996 | description: Data collection frequency. |
| 997 | default_value: 10 |
| 998 | required: false |
| 999 | - name: ebpf load mode |
| 1000 | description: Define whether plugin will monitor the call (`entry`) for the functions or it will also monitor the return (`return`). |
| 1001 | default_value: entry |
| 1002 | required: false |
| 1003 | - name: apps |
| 1004 | description: Enable or disable integration with apps.plugin |
| 1005 | default_value: no |
| 1006 | required: false |
| 1007 | - name: cgroups |
| 1008 | description: Enable or disable integration with cgroup.plugin |
| 1009 | default_value: no |
| 1010 | required: false |
| 1011 | - name: pid table size |
| 1012 | description: Number of elements stored inside hash tables used to monitor calls per PID. |
| 1013 | default_value: 32768 |
| 1014 | required: false |
| 1015 | - name: ebpf type format |
| 1016 | description: "Define the file type to load an eBPF program. Three options are available: `legacy` (Attach only `kprobe`), `co-re` (Plugin tries to use `trampoline` when available), and `auto` (plugin check OS configuration before to load)." |
| 1017 | default_value: auto |
| 1018 | required: false |
| 1019 | - name: ebpf co-re tracing |
| 1020 | description: "Select the attach method used by plugin when `co-re` is defined in previous option. Two options are available: `trampoline` (Option with lowest overhead), and `probe` (the same of legacy code)." |
| 1021 | default_value: trampoline |
| 1022 | required: false |
| 1023 | - name: maps per core |
| 1024 | description: Define how plugin will load their hash maps. When enabled (`yes`) plugin will load one hash table per core, instead to have centralized information. |
| 1025 | default_value: yes |
| 1026 | required: false |
| 1027 | - name: lifetime |
| 1028 | description: Set default lifetime for thread when enabled by cloud. |
| 1029 | default_value: 300 |
| 1030 | required: false |
| 1031 | - name: sync |
| 1032 | description: Enable or disable monitoring for syscall `sync` |
| 1033 | default_value: yes |
| 1034 | required: false |
| 1035 | - name: msync |
| 1036 | description: Enable or disable monitoring for syscall `msync` |
| 1037 | default_value: yes |
| 1038 | required: false |
| 1039 | - name: fsync |
| 1040 | description: Enable or disable monitoring for syscall `fsync` |
| 1041 | default_value: yes |
| 1042 | required: false |
| 1043 | - name: fdatasync |
| 1044 | description: Enable or disable monitoring for syscall `fdatasync` |
| 1045 | default_value: yes |
| 1046 | required: false |
| 1047 | - name: syncfs |
| 1048 | description: Enable or disable monitoring for syscall `syncfs` |
| 1049 | default_value: yes |
| 1050 | required: false |
| 1051 | - name: sync_file_range |
| 1052 | description: Enable or disable monitoring for syscall `sync_file_range` |
| 1053 | default_value: yes |
| 1054 | required: false |
| 1055 | examples: |
| 1056 | folding: |
| 1057 | enabled: true |
| 1058 | title: "" |
| 1059 | list: [] |
| 1060 | troubleshooting: |
| 1061 | problems: |
| 1062 | list: [] |
| 1063 | alerts: |
| 1064 | - name: sync_freq |
| 1065 | link: https://github.com/netdata/netdata/blob/master/src/health/health.d/synchronization.conf |
| 1066 | metric: mem.sync |
| 1067 | info: |
| 1068 | number of sync() system calls. Every call causes all pending modifications to filesystem metadata and cached file data to be written to the |
| 1069 | underlying filesystems. |
| 1070 | metrics: |
| 1071 | folding: |
| 1072 | title: Metrics |
| 1073 | enabled: false |
| 1074 | description: "" |
| 1075 | availability: [] |
| 1076 | scopes: |
| 1077 | - name: global |
| 1078 | description: "These metrics show total number of calls to functions inside kernel." |
| 1079 | labels: [] |
| 1080 | metrics: |
| 1081 | - name: mem.file_sync |
| 1082 | description: Monitor calls to fsync(2) and fdatasync(2). |
| 1083 | unit: "calls/s" |
| 1084 | chart_type: stacked |
| 1085 | dimensions: |
| 1086 | - name: fsync |
| 1087 | - name: fdatasync |
| 1088 | - name: mem.memory_map |
| 1089 | description: Monitor calls to msync(2). |
| 1090 | unit: "calls/s" |
| 1091 | chart_type: line |
| 1092 | dimensions: |
| 1093 | - name: msync |
| 1094 | - name: mem.sync |
| 1095 | description: Monitor calls to sync(2) and syncfs(2). |
| 1096 | unit: "calls/s" |
| 1097 | chart_type: line |
| 1098 | dimensions: |
| 1099 | - name: sync |
| 1100 | - name: syncfs |
| 1101 | - name: mem.file_segment |
| 1102 | description: Monitor calls to sync_file_range(2). |
| 1103 | unit: "calls/s" |
| 1104 | chart_type: line |
| 1105 | dimensions: |
| 1106 | - name: sync_file_range |
| 1107 | - meta: |
| 1108 | plugin_name: ebpf.plugin |
| 1109 | module_name: mdflush |
| 1110 | monitored_instance: |
| 1111 | name: eBPF MDflush |
| 1112 | link: "https://kernel.org/" |
| 1113 | categories: |
| 1114 | - data-collection.storage |
| 1115 | icon_filename: "ebpf.jpg" |
| 1116 | related_resources: |
| 1117 | integrations: |
| 1118 | list: [] |
| 1119 | info_provided_to_referring_integrations: |
| 1120 | description: "" |
| 1121 | keywords: |
| 1122 | - MD |
| 1123 | - RAID |
| 1124 | - eBPF |
| 1125 | overview: |
| 1126 | data_collection: |
| 1127 | metrics_description: "Monitor when flush events happen between disks." |
| 1128 | method_description: "Attach tracing (kprobe, trampoline) to internal kernel functions according options used to compile kernel." |
| 1129 | supported_platforms: |
| 1130 | include: |
| 1131 | - Linux |
| 1132 | exclude: [] |
| 1133 | multi_instance: true |
| 1134 | additional_permissions: |
| 1135 | description: "The plugin needs setuid because it loads data inside kernel. Netada sets necessary permission during installation time." |
| 1136 | default_behavior: |
| 1137 | auto_detection: |
| 1138 | description: "The plugin checks kernel compilation flags (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) and presence of BTF files to decide which eBPF program will be attached." |
| 1139 | limits: |
| 1140 | description: "" |
| 1141 | performance_impact: |
| 1142 | description: "This thread will add overhead every time that `md_flush_request` is called. The estimated additional period of time is between 90-200ns per call on kernels that do not have BTF technology." |
| 1143 | setup: |
| 1144 | prerequisites: |
| 1145 | list: |
| 1146 | - title: Compile kernel |
| 1147 | description: | |
| 1148 | Check if your kernel was compiled with necessary options (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) in `/proc/config.gz` or inside /boot/config file. Some cited names can be different accoring preferences of Linux distributions. |
| 1149 | When you do not have options set, it is necessary to get the kernel source code from https://kernel.org or a kernel package from your distribution, this last is preferred. The kernel compilation has a well definedd pattern, but distributions can deliver their configuration files |
| 1150 | with different names. |
| 1151 | |
| 1152 | Now follow steps: |
| 1153 | 1. Copy the configuration file to /usr/src/linux/.config. |
| 1154 | 2. Select the necessary options: make oldconfig |
| 1155 | 3. Compile your kernel image: make bzImage |
| 1156 | 4. Compile your modules: make modules |
| 1157 | 5. Copy your new kernel image for boot loader directory |
| 1158 | 6. Install the new modules: make modules_install |
| 1159 | 7. Generate an initial ramdisk image (`initrd`) if it is necessary. |
| 1160 | 8. Update your boot loader |
| 1161 | configuration: |
| 1162 | file: |
| 1163 | name: "ebpf.d/mdflush.conf" |
| 1164 | description: "Overwrite default configuration reducing I/O events." |
| 1165 | options: |
| 1166 | description: | |
| 1167 | All options are defined inside section `[global]`. |
| 1168 | folding: |
| 1169 | title: "Config options" |
| 1170 | enabled: true |
| 1171 | list: |
| 1172 | - name: update every |
| 1173 | description: Data collection frequency. |
| 1174 | default_value: 10 |
| 1175 | required: false |
| 1176 | - name: ebpf load mode |
| 1177 | description: Define whether plugin will monitor the call (`entry`) for the functions or it will also monitor the return (`return`). |
| 1178 | default_value: entry |
| 1179 | required: false |
| 1180 | - name: lifetime |
| 1181 | description: Set default lifetime for thread when enabled by cloud. |
| 1182 | default_value: 300 |
| 1183 | required: false |
| 1184 | examples: |
| 1185 | folding: |
| 1186 | enabled: true |
| 1187 | title: "" |
| 1188 | list: [] |
| 1189 | troubleshooting: |
| 1190 | problems: |
| 1191 | list: [] |
| 1192 | alerts: [] |
| 1193 | metrics: |
| 1194 | folding: |
| 1195 | title: Metrics |
| 1196 | enabled: false |
| 1197 | description: "" |
| 1198 | availability: [] |
| 1199 | scopes: |
| 1200 | - name: global |
| 1201 | description: "Number of times md_flush_request was called since last time." |
| 1202 | labels: [] |
| 1203 | metrics: |
| 1204 | - name: mdstat.mdstat_flush |
| 1205 | description: MD flushes |
| 1206 | unit: "flushes" |
| 1207 | chart_type: stacked |
| 1208 | dimensions: |
| 1209 | - name: disk |
| 1210 | - meta: |
| 1211 | plugin_name: ebpf.plugin |
| 1212 | module_name: swap |
| 1213 | monitored_instance: |
| 1214 | name: eBPF SWAP |
| 1215 | link: "https://kernel.org/" |
| 1216 | categories: |
| 1217 | - data-collection.operating-systems |
| 1218 | icon_filename: "ebpf.jpg" |
| 1219 | related_resources: |
| 1220 | integrations: |
| 1221 | list: |
| 1222 | - plugin_name: apps.plugin |
| 1223 | module_name: apps |
| 1224 | - plugin_name: cgroups.plugin |
| 1225 | module_name: /sys/fs/cgroup |
| 1226 | monitored_instance_name: Containers |
| 1227 | info_provided_to_referring_integrations: |
| 1228 | description: "" |
| 1229 | keywords: |
| 1230 | - SWAP |
| 1231 | - memory |
| 1232 | - eBPF |
| 1233 | - Hard Disk |
| 1234 | overview: |
| 1235 | data_collection: |
| 1236 | metrics_description: "Monitors when swap has I/O events and applications executing events." |
| 1237 | method_description: "Attach tracing (kprobe, trampoline) to internal kernel functions according options used to compile kernel." |
| 1238 | supported_platforms: |
| 1239 | include: |
| 1240 | - Linux |
| 1241 | exclude: [] |
| 1242 | multi_instance: true |
| 1243 | additional_permissions: |
| 1244 | description: "The plugin needs setuid because it loads data inside kernel. Netada sets necessary permission during installation time." |
| 1245 | default_behavior: |
| 1246 | auto_detection: |
| 1247 | description: "The plugin checks kernel compilation flags (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) and presence of BTF files to decide which eBPF program will be attached." |
| 1248 | limits: |
| 1249 | description: "" |
| 1250 | performance_impact: |
| 1251 | description: "This thread will add overhead every time that an internal kernel function monitored by this thread is called. The estimated additional period of time is between 90-200ns per call on kernels that do not have BTF technology." |
| 1252 | setup: |
| 1253 | prerequisites: |
| 1254 | list: |
| 1255 | - title: Compile kernel |
| 1256 | description: | |
| 1257 | Check if your kernel was compiled with necessary options (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) in `/proc/config.gz` or inside /boot/config file. Some cited names can be different accoring preferences of Linux distributions. |
| 1258 | When you do not have options set, it is necessary to get the kernel source code from https://kernel.org or a kernel package from your distribution, this last is preferred. The kernel compilation has a well definedd pattern, but distributions can deliver their configuration files |
| 1259 | with different names. |
| 1260 | |
| 1261 | Now follow steps: |
| 1262 | 1. Copy the configuration file to /usr/src/linux/.config. |
| 1263 | 2. Select the necessary options: make oldconfig |
| 1264 | 3. Compile your kernel image: make bzImage |
| 1265 | 4. Compile your modules: make modules |
| 1266 | 5. Copy your new kernel image for boot loader directory |
| 1267 | 6. Install the new modules: make modules_install |
| 1268 | 7. Generate an initial ramdisk image (`initrd`) if it is necessary. |
| 1269 | 8. Update your boot loader |
| 1270 | configuration: |
| 1271 | file: |
| 1272 | name: "ebpf.d/swap.conf" |
| 1273 | description: "Overwrite default configuration helping to reduce memory usage. You can also select charts visible on dashboard." |
| 1274 | options: |
| 1275 | description: | |
| 1276 | All options are defined inside section `[global]`. |
| 1277 | folding: |
| 1278 | title: "Config options" |
| 1279 | enabled: true |
| 1280 | list: |
| 1281 | - name: update every |
| 1282 | description: Data collection frequency. |
| 1283 | default_value: 10 |
| 1284 | required: false |
| 1285 | - name: ebpf load mode |
| 1286 | description: Define whether plugin will monitor the call (`entry`) for the functions or it will also monitor the return (`return`). |
| 1287 | default_value: entry |
| 1288 | required: false |
| 1289 | - name: apps |
| 1290 | description: Enable or disable integration with apps.plugin |
| 1291 | default_value: no |
| 1292 | required: false |
| 1293 | - name: cgroups |
| 1294 | description: Enable or disable integration with cgroup.plugin |
| 1295 | default_value: no |
| 1296 | required: false |
| 1297 | - name: pid table size |
| 1298 | description: Number of elements stored inside hash tables used to monitor calls per PID. |
| 1299 | default_value: 32768 |
| 1300 | required: false |
| 1301 | - name: ebpf type format |
| 1302 | description: "Define the file type to load an eBPF program. Three options are available: `legacy` (Attach only `kprobe`), `co-re` (Plugin tries to use `trampoline` when available), and `auto` (plugin check OS configuration before to load)." |
| 1303 | default_value: auto |
| 1304 | required: false |
| 1305 | - name: ebpf co-re tracing |
| 1306 | description: "Select the attach method used by plugin when `co-re` is defined in previous option. Two options are available: `trampoline` (Option with lowest overhead), and `probe` (the same of legacy code)." |
| 1307 | default_value: trampoline |
| 1308 | required: false |
| 1309 | - name: maps per core |
| 1310 | description: Define how plugin will load their hash maps. When enabled (`yes`) plugin will load one hash table per core, instead to have centralized information. |
| 1311 | default_value: yes |
| 1312 | required: false |
| 1313 | - name: lifetime |
| 1314 | description: Set default lifetime for thread when enabled by cloud. |
| 1315 | default_value: 300 |
| 1316 | required: false |
| 1317 | examples: |
| 1318 | folding: |
| 1319 | enabled: true |
| 1320 | title: "" |
| 1321 | list: [] |
| 1322 | troubleshooting: |
| 1323 | problems: |
| 1324 | list: [] |
| 1325 | alerts: [] |
| 1326 | metrics: |
| 1327 | folding: |
| 1328 | title: Metrics |
| 1329 | enabled: false |
| 1330 | description: "" |
| 1331 | availability: [] |
| 1332 | scopes: |
| 1333 | - name: cgroup |
| 1334 | description: "These Metrics show grouped information per cgroup/service." |
| 1335 | labels: [] |
| 1336 | metrics: |
| 1337 | - name: cgroup.swap_read |
| 1338 | description: Calls to function swap_readpage. |
| 1339 | unit: "calls/s" |
| 1340 | chart_type: line |
| 1341 | dimensions: |
| 1342 | - name: read |
| 1343 | - name: cgroup.swap_write |
| 1344 | description: Calls to function swap_writepage. |
| 1345 | unit: "calls/s" |
| 1346 | chart_type: line |
| 1347 | dimensions: |
| 1348 | - name: write |
| 1349 | - name: services.swap_read |
| 1350 | description: Calls to swap_readpage. |
| 1351 | unit: "calls/s" |
| 1352 | chart_type: stacked |
| 1353 | dimensions: |
| 1354 | - name: a dimension per systemd service |
| 1355 | - name: services.swap_write |
| 1356 | description: Calls to function swap_writepage. |
| 1357 | unit: "calls/s" |
| 1358 | chart_type: stacked |
| 1359 | dimensions: |
| 1360 | - name: a dimension per systemd service |
| 1361 | - name: apps |
| 1362 | description: "These Metrics show grouped information per apps group." |
| 1363 | labels: |
| 1364 | - name: app_group |
| 1365 | description: The name of the group defined in the configuration. |
| 1366 | metrics: |
| 1367 | - name: app.ebpf_call_swap_readpage |
| 1368 | description: Calls to function swap_readpage. |
| 1369 | unit: "calls/s" |
| 1370 | chart_type: stacked |
| 1371 | dimensions: |
| 1372 | - name: a dimension per app group |
| 1373 | - name: app.ebpf_call_swap_writepage |
| 1374 | description: Calls to function swap_writepage. |
| 1375 | unit: "calls/s" |
| 1376 | chart_type: stacked |
| 1377 | dimensions: |
| 1378 | - name: a dimension per app group |
| 1379 | - name: global |
| 1380 | description: "These metrics show total number of calls to functions inside kernel." |
| 1381 | labels: [] |
| 1382 | metrics: |
| 1383 | - name: mem.swapcalls |
| 1384 | description: Calls to access swap memory |
| 1385 | unit: "calls/s" |
| 1386 | chart_type: line |
| 1387 | dimensions: |
| 1388 | - name: write |
| 1389 | - name: read |
| 1390 | - meta: |
| 1391 | plugin_name: ebpf.plugin |
| 1392 | module_name: oomkill |
| 1393 | monitored_instance: |
| 1394 | name: eBPF OOMkill |
| 1395 | link: "https://kernel.org/" |
| 1396 | categories: |
| 1397 | - data-collection.operating-systems |
| 1398 | icon_filename: "ebpf.jpg" |
| 1399 | related_resources: |
| 1400 | integrations: |
| 1401 | list: |
| 1402 | - plugin_name: apps.plugin |
| 1403 | module_name: apps |
| 1404 | - plugin_name: cgroups.plugin |
| 1405 | module_name: /sys/fs/cgroup |
| 1406 | monitored_instance_name: Containers |
| 1407 | info_provided_to_referring_integrations: |
| 1408 | description: "" |
| 1409 | keywords: |
| 1410 | - application |
| 1411 | - memory |
| 1412 | overview: |
| 1413 | data_collection: |
| 1414 | metrics_description: "Monitor applications that reach out of memory." |
| 1415 | method_description: "Attach tracepoint to internal kernel functions." |
| 1416 | supported_platforms: |
| 1417 | include: |
| 1418 | - Linux |
| 1419 | exclude: [] |
| 1420 | multi_instance: true |
| 1421 | additional_permissions: |
| 1422 | description: "The plugin needs setuid because it loads data inside kernel. Netada sets necessary permission during installation time." |
| 1423 | default_behavior: |
| 1424 | auto_detection: |
| 1425 | description: "The plugin checks kernel compilation flags (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT), files inside debugfs, and presence of BTF files to decide which eBPF program will be attached." |
| 1426 | limits: |
| 1427 | description: "" |
| 1428 | performance_impact: |
| 1429 | description: "This thread will add overhead every time that an internal kernel function monitored by this thread is called." |
| 1430 | setup: |
| 1431 | prerequisites: |
| 1432 | list: |
| 1433 | - title: Compile kernel |
| 1434 | description: | |
| 1435 | Check if your kernel was compiled with necessary options (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) in `/proc/config.gz` or inside /boot/config file. Some cited names can be different accoring preferences of Linux distributions. |
| 1436 | When you do not have options set, it is necessary to get the kernel source code from https://kernel.org or a kernel package from your distribution, this last is preferred. The kernel compilation has a well definedd pattern, but distributions can deliver their configuration files |
| 1437 | with different names. |
| 1438 | |
| 1439 | Now follow steps: |
| 1440 | 1. Copy the configuration file to /usr/src/linux/.config. |
| 1441 | 2. Select the necessary options: make oldconfig |
| 1442 | 3. Compile your kernel image: make bzImage |
| 1443 | 4. Compile your modules: make modules |
| 1444 | 5. Copy your new kernel image for boot loader directory |
| 1445 | 6. Install the new modules: make modules_install |
| 1446 | 7. Generate an initial ramdisk image (`initrd`) if it is necessary. |
| 1447 | 8. Update your boot loader |
| 1448 | - title: Debug Filesystem |
| 1449 | description: | |
| 1450 | This thread needs to attach a tracepoint to monitor when a process schedule an exit event. To allow this specific feaure, it is necessary to mount `debugfs` (`mount -t debugfs none /sys/kernel/debug/`). |
| 1451 | configuration: |
| 1452 | file: |
| 1453 | name: "ebpf.d/oomkill.conf" |
| 1454 | description: "Overwrite default configuration reducing number of I/O events." |
| 1455 | options: |
| 1456 | description: | |
| 1457 | Overwrite default configuration reducing number of I/O events |
| 1458 | folding: |
| 1459 | title: "Config options" |
| 1460 | enabled: true |
| 1461 | list: [] |
| 1462 | examples: |
| 1463 | folding: |
| 1464 | enabled: true |
| 1465 | title: "" |
| 1466 | list: [] |
| 1467 | troubleshooting: |
| 1468 | problems: |
| 1469 | list: |
| 1470 | - name: update every |
| 1471 | description: Data collection frequency. |
| 1472 | default_value: 10 |
| 1473 | required: false |
| 1474 | - name: ebpf load mode |
| 1475 | description: Define whether plugin will monitor the call (`entry`) for the functions or it will also monitor the return (`return`). |
| 1476 | default_value: entry |
| 1477 | required: false |
| 1478 | - name: lifetime |
| 1479 | description: Set default lifetime for thread when enabled by cloud. |
| 1480 | default_value: 300 |
| 1481 | required: false |
| 1482 | alerts: [] |
| 1483 | metrics: |
| 1484 | folding: |
| 1485 | title: Metrics |
| 1486 | enabled: false |
| 1487 | description: "" |
| 1488 | availability: [] |
| 1489 | scopes: |
| 1490 | - name: cgroup |
| 1491 | description: "These metrics show cgroup/service that reached OOM." |
| 1492 | labels: [] |
| 1493 | metrics: |
| 1494 | - name: cgroup.oomkills |
| 1495 | description: OOM kills. This chart is provided by eBPF plugin. |
| 1496 | unit: "kills" |
| 1497 | chart_type: line |
| 1498 | dimensions: |
| 1499 | - name: cgroup name |
| 1500 | - name: services.oomkills |
| 1501 | description: OOM kills. This chart is provided by eBPF plugin. |
| 1502 | unit: "kills" |
| 1503 | chart_type: line |
| 1504 | dimensions: |
| 1505 | - name: a dimension per systemd service |
| 1506 | - name: apps |
| 1507 | description: "These metrics show cgroup/service that reached OOM." |
| 1508 | labels: |
| 1509 | - name: app_group |
| 1510 | description: The name of the group defined in the configuration. |
| 1511 | metrics: |
| 1512 | - name: app.oomkill |
| 1513 | description: OOM kills |
| 1514 | unit: "kills" |
| 1515 | chart_type: stacked |
| 1516 | dimensions: |
| 1517 | - name: kills |
| 1518 | - meta: |
| 1519 | plugin_name: ebpf.plugin |
| 1520 | module_name: socket |
| 1521 | monitored_instance: |
| 1522 | name: eBPF Socket |
| 1523 | link: "https://kernel.org/" |
| 1524 | categories: |
| 1525 | - data-collection.networking |
| 1526 | icon_filename: "ebpf.jpg" |
| 1527 | related_resources: |
| 1528 | integrations: |
| 1529 | list: |
| 1530 | - plugin_name: apps.plugin |
| 1531 | module_name: apps |
| 1532 | - plugin_name: cgroups.plugin |
| 1533 | module_name: /sys/fs/cgroup |
| 1534 | monitored_instance_name: Containers |
| 1535 | info_provided_to_referring_integrations: |
| 1536 | description: "" |
| 1537 | keywords: |
| 1538 | - TCP |
| 1539 | - UDP |
| 1540 | - bandwidth |
| 1541 | - server |
| 1542 | - connection |
| 1543 | - socket |
| 1544 | overview: |
| 1545 | data_collection: |
| 1546 | metrics_description: "Monitor bandwidth consumption per application for protocols TCP and UDP." |
| 1547 | method_description: "Attach tracing (kprobe, trampoline) to internal kernel functions according options used to compile kernel." |
| 1548 | supported_platforms: |
| 1549 | include: |
| 1550 | - Linux |
| 1551 | exclude: [] |
| 1552 | multi_instance: true |
| 1553 | additional_permissions: |
| 1554 | description: "The plugin needs setuid because it loads data inside kernel. Netada sets necessary permission during installation time." |
| 1555 | default_behavior: |
| 1556 | auto_detection: |
| 1557 | description: "The plugin checks kernel compilation flags (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) and presence of BTF files to decide which eBPF program will be attached." |
| 1558 | limits: |
| 1559 | description: "" |
| 1560 | performance_impact: |
| 1561 | description: "This thread will add overhead every time that an internal kernel function monitored by this thread is called. The estimated additional period of time is between 90-200ns per call on kernels that do not have BTF technology." |
| 1562 | setup: |
| 1563 | prerequisites: |
| 1564 | list: |
| 1565 | - title: Compile kernel |
| 1566 | description: | |
| 1567 | Check if your kernel was compiled with necessary options (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) in `/proc/config.gz` or inside /boot/config file. Some cited names can be different accoring preferences of Linux distributions. |
| 1568 | When you do not have options set, it is necessary to get the kernel source code from https://kernel.org or a kernel package from your distribution, this last is preferred. The kernel compilation has a well definedd pattern, but distributions can deliver their configuration files |
| 1569 | with different names. |
| 1570 | |
| 1571 | Now follow steps: |
| 1572 | 1. Copy the configuration file to /usr/src/linux/.config. |
| 1573 | 2. Select the necessary options: make oldconfig |
| 1574 | 3. Compile your kernel image: make bzImage |
| 1575 | 4. Compile your modules: make modules |
| 1576 | 5. Copy your new kernel image for boot loader directory |
| 1577 | 6. Install the new modules: make modules_install |
| 1578 | 7. Generate an initial ramdisk image (`initrd`) if it is necessary. |
| 1579 | 8. Update your boot loader |
| 1580 | configuration: |
| 1581 | file: |
| 1582 | name: "ebpf.d/network.conf" |
| 1583 | description: "Overwrite default configuration helping to reduce memory usage. You can also select charts visible on dashboard." |
| 1584 | options: |
| 1585 | description: | |
| 1586 | All options are defined inside section `[global]`. Options inside `network connections` are ignored for while. |
| 1587 | folding: |
| 1588 | title: "Config options" |
| 1589 | enabled: true |
| 1590 | list: |
| 1591 | - name: update every |
| 1592 | description: Data collection frequency. |
| 1593 | default_value: 10 |
| 1594 | required: false |
| 1595 | - name: ebpf load mode |
| 1596 | description: Define whether plugin will monitor the call (`entry`) for the functions or it will also monitor the return (`return`). |
| 1597 | default_value: entry |
| 1598 | required: false |
| 1599 | - name: apps |
| 1600 | description: Enable or disable integration with apps.plugin |
| 1601 | default_value: no |
| 1602 | required: false |
| 1603 | - name: cgroups |
| 1604 | description: Enable or disable integration with cgroup.plugin |
| 1605 | default_value: no |
| 1606 | required: false |
| 1607 | - name: bandwidth table size |
| 1608 | description: Number of elements stored inside hash tables used to monitor calls per PID. |
| 1609 | default_value: 16384 |
| 1610 | required: false |
| 1611 | - name: ipv4 connection table size |
| 1612 | description: Number of elements stored inside hash tables used to monitor calls per IPV4 connections. |
| 1613 | default_value: 16384 |
| 1614 | required: false |
| 1615 | - name: ipv6 connection table size |
| 1616 | description: Number of elements stored inside hash tables used to monitor calls per IPV6 connections. |
| 1617 | default_value: 16384 |
| 1618 | required: false |
| 1619 | - name: udp connection table size |
| 1620 | description: Number of temporary elements stored inside hash tables used to monitor UDP connections. |
| 1621 | default_value: 4096 |
| 1622 | required: false |
| 1623 | - name: ebpf type format |
| 1624 | description: "Define the file type to load an eBPF program. Three options are available: `legacy` (Attach only `kprobe`), `co-re` (Plugin tries to use `trampoline` when available), and `auto` (plugin check OS configuration before to load)." |
| 1625 | default_value: auto |
| 1626 | required: false |
| 1627 | - name: ebpf co-re tracing |
| 1628 | description: "Select the attach method used by plugin when `co-re` is defined in previous option. Two options are available: `trampoline` (Option with lowest overhead), and `probe` (the same of legacy code)." |
| 1629 | default_value: trampoline |
| 1630 | required: false |
| 1631 | - name: maps per core |
| 1632 | description: Define how plugin will load their hash maps. When enabled (`yes`) plugin will load one hash table per core, instead to have centralized information. |
| 1633 | default_value: yes |
| 1634 | required: false |
| 1635 | - name: lifetime |
| 1636 | description: Set default lifetime for thread when enabled by cloud. |
| 1637 | default_value: 300 |
| 1638 | required: false |
| 1639 | examples: |
| 1640 | folding: |
| 1641 | enabled: true |
| 1642 | title: "" |
| 1643 | list: [] |
| 1644 | troubleshooting: |
| 1645 | problems: |
| 1646 | list: [] |
| 1647 | alerts: [] |
| 1648 | metrics: |
| 1649 | folding: |
| 1650 | title: Metrics |
| 1651 | enabled: false |
| 1652 | description: "" |
| 1653 | availability: [] |
| 1654 | scopes: |
| 1655 | - name: global |
| 1656 | description: "These metrics show total number of calls to functions inside kernel." |
| 1657 | labels: [] |
| 1658 | metrics: |
| 1659 | - name: ip.inbound_conn |
| 1660 | description: Inbound connections. |
| 1661 | unit: "connections/s" |
| 1662 | chart_type: line |
| 1663 | dimensions: |
| 1664 | - name: connected_tcp |
| 1665 | - name: connected_udp |
| 1666 | - name: ip.tcp_outbound_conn |
| 1667 | description: TCP outbound connections. |
| 1668 | unit: "connections/s" |
| 1669 | chart_type: line |
| 1670 | dimensions: |
| 1671 | - name: received |
| 1672 | - name: ip.tcp_functions |
| 1673 | description: Calls to internal functions |
| 1674 | unit: "calls/s" |
| 1675 | chart_type: line |
| 1676 | dimensions: |
| 1677 | - name: received |
| 1678 | - name: send |
| 1679 | - name: closed |
| 1680 | - name: ip.total_tcp_bandwidth |
| 1681 | description: TCP bandwidth |
| 1682 | unit: "kilobits/s" |
| 1683 | chart_type: line |
| 1684 | dimensions: |
| 1685 | - name: received |
| 1686 | - name: send |
| 1687 | - name: ip.tcp_error |
| 1688 | description: TCP errors |
| 1689 | unit: "calls/s" |
| 1690 | chart_type: line |
| 1691 | dimensions: |
| 1692 | - name: received |
| 1693 | - name: send |
| 1694 | - name: ip.tcp_retransmit |
| 1695 | description: Packages retransmitted |
| 1696 | unit: "calls/s" |
| 1697 | chart_type: line |
| 1698 | dimensions: |
| 1699 | - name: retransmitted |
| 1700 | - name: ip.udp_functions |
| 1701 | description: UDP calls |
| 1702 | unit: "calls/s" |
| 1703 | chart_type: line |
| 1704 | dimensions: |
| 1705 | - name: received |
| 1706 | - name: send |
| 1707 | - name: ip.total_udp_bandwidth |
| 1708 | description: UDP bandwidth |
| 1709 | unit: "kilobits/s" |
| 1710 | chart_type: line |
| 1711 | dimensions: |
| 1712 | - name: received |
| 1713 | - name: send |
| 1714 | - name: ip.udp_error |
| 1715 | description: UDP errors |
| 1716 | unit: "calls/s" |
| 1717 | chart_type: line |
| 1718 | dimensions: |
| 1719 | - name: received |
| 1720 | - name: send |
| 1721 | - name: apps |
| 1722 | description: "These metrics show grouped information per apps group." |
| 1723 | labels: |
| 1724 | - name: app_group |
| 1725 | description: The name of the group defined in the configuration. |
| 1726 | metrics: |
| 1727 | - name: app.ebpf_call_tcp_v4_connection |
| 1728 | description: Calls to tcp_v4_connection |
| 1729 | unit: "connections/s" |
| 1730 | chart_type: stacked |
| 1731 | dimensions: |
| 1732 | - name: connections |
| 1733 | - name: app.ebpf_call_tcp_v6_connection |
| 1734 | description: Calls to tcp_v6_connection |
| 1735 | unit: "connections/s" |
| 1736 | chart_type: stacked |
| 1737 | dimensions: |
| 1738 | - name: connections |
| 1739 | - name: app.ebpf_sock_total_bandwidth |
| 1740 | description: Bytes sent |
| 1741 | unit: "kilobits/s" |
| 1742 | chart_type: stacked |
| 1743 | dimensions: |
| 1744 | - name: received |
| 1745 | - name: sent |
| 1746 | - name: app.ebpf_call_tcp_sendmsg |
| 1747 | description: Calls for tcp_sendmsg |
| 1748 | unit: "calls/s" |
| 1749 | chart_type: stacked |
| 1750 | dimensions: |
| 1751 | - name: calls |
| 1752 | - name: app.ebpf_call_tcp_cleanup_rbuf |
| 1753 | description: Calls for tcp_cleanup_rbuf |
| 1754 | unit: "calls/s" |
| 1755 | chart_type: stacked |
| 1756 | dimensions: |
| 1757 | - name: calls |
| 1758 | - name: app.ebpf_call_tcp_retransmit |
| 1759 | description: Calls for tcp_retransmit |
| 1760 | unit: "calls/s" |
| 1761 | chart_type: stacked |
| 1762 | dimensions: |
| 1763 | - name: calls |
| 1764 | - name: app.ebpf_call_udp_sendmsg |
| 1765 | description: Calls for udp_sendmsg |
| 1766 | unit: "calls/s" |
| 1767 | chart_type: stacked |
| 1768 | dimensions: |
| 1769 | - name: calls |
| 1770 | - name: app.ebpf_call_udp_recvmsg |
| 1771 | description: Calls for udp_recvmsg |
| 1772 | unit: "calls/s" |
| 1773 | chart_type: stacked |
| 1774 | dimensions: |
| 1775 | - name: calls |
| 1776 | - name: cgroup |
| 1777 | description: "" |
| 1778 | labels: [] |
| 1779 | metrics: |
| 1780 | - name: cgroup.net_conn_ipv4 |
| 1781 | description: Calls to tcp_v4_connection |
| 1782 | unit: "connections/s" |
| 1783 | chart_type: line |
| 1784 | dimensions: |
| 1785 | - name: connections |
| 1786 | - name: cgroup.net_conn_ipv6 |
| 1787 | description: Calls to tcp_v6_connection |
| 1788 | unit: "connections/s" |
| 1789 | chart_type: line |
| 1790 | dimensions: |
| 1791 | - name: connections |
| 1792 | - name: cgroup.net_total_bandwidth |
| 1793 | description: Bytes received |
| 1794 | unit: "kilobits/s" |
| 1795 | chart_type: line |
| 1796 | dimensions: |
| 1797 | - name: received |
| 1798 | - name: sent |
| 1799 | - name: cgroup.net_tcp_recv |
| 1800 | description: Calls to tcp_cleanup_rbuf. |
| 1801 | unit: "calls/s" |
| 1802 | chart_type: line |
| 1803 | dimensions: |
| 1804 | - name: calls |
| 1805 | - name: cgroup.net_tcp_send |
| 1806 | description: Calls to tcp_sendmsg. |
| 1807 | unit: "calls/s" |
| 1808 | chart_type: line |
| 1809 | dimensions: |
| 1810 | - name: calls |
| 1811 | - name: cgroup.net_retransmit |
| 1812 | description: Calls to tcp_retransmit. |
| 1813 | unit: "calls/s" |
| 1814 | chart_type: line |
| 1815 | dimensions: |
| 1816 | - name: calls |
| 1817 | - name: cgroup.net_udp_send |
| 1818 | description: Calls to udp_sendmsg |
| 1819 | unit: "calls/s" |
| 1820 | chart_type: line |
| 1821 | dimensions: |
| 1822 | - name: calls |
| 1823 | - name: cgroup.net_udp_recv |
| 1824 | description: Calls to udp_recvmsg |
| 1825 | unit: "calls/s" |
| 1826 | chart_type: line |
| 1827 | dimensions: |
| 1828 | - name: calls |
| 1829 | - name: services.net_conn_ipv4 |
| 1830 | description: Calls to tcp_v4_connection |
| 1831 | unit: "connections/s" |
| 1832 | chart_type: stacked |
| 1833 | dimensions: |
| 1834 | - name: connections |
| 1835 | - name: services.net_conn_ipv6 |
| 1836 | description: Calls to tcp_v6_connection |
| 1837 | unit: "connections/s" |
| 1838 | chart_type: stacked |
| 1839 | dimensions: |
| 1840 | - name: connections |
| 1841 | - name: services.net_total_bandwidth |
| 1842 | description: Bytes received |
| 1843 | unit: "kilobits/s" |
| 1844 | chart_type: stacked |
| 1845 | dimensions: |
| 1846 | - name: received |
| 1847 | - name: sent |
| 1848 | - name: services.net_tcp_recv |
| 1849 | description: Calls to tcp_cleanup_rbuf. |
| 1850 | unit: "calls/s" |
| 1851 | chart_type: stacked |
| 1852 | dimensions: |
| 1853 | - name: calls |
| 1854 | - name: services.net_tcp_send |
| 1855 | description: Calls to tcp_sendmsg. |
| 1856 | unit: "calls/s" |
| 1857 | chart_type: stacked |
| 1858 | dimensions: |
| 1859 | - name: calls |
| 1860 | - name: services.net_tcp_retransmit |
| 1861 | description: Calls to tcp_retransmit |
| 1862 | unit: "calls/s" |
| 1863 | chart_type: stacked |
| 1864 | dimensions: |
| 1865 | - name: calls |
| 1866 | - name: services.net_udp_send |
| 1867 | description: Calls to udp_sendmsg |
| 1868 | unit: "calls/s" |
| 1869 | chart_type: stacked |
| 1870 | dimensions: |
| 1871 | - name: calls |
| 1872 | - name: services.net_udp_recv |
| 1873 | description: Calls to udp_recvmsg |
| 1874 | unit: "calls/s" |
| 1875 | chart_type: stacked |
| 1876 | dimensions: |
| 1877 | - name: calls |
| 1878 | - meta: |
| 1879 | plugin_name: ebpf.plugin |
| 1880 | module_name: dcstat |
| 1881 | monitored_instance: |
| 1882 | name: eBPF DCstat |
| 1883 | link: "https://kernel.org/" |
| 1884 | categories: |
| 1885 | - data-collection.operating-systems |
| 1886 | icon_filename: "ebpf.jpg" |
| 1887 | related_resources: |
| 1888 | integrations: |
| 1889 | list: |
| 1890 | - plugin_name: apps.plugin |
| 1891 | module_name: apps |
| 1892 | - plugin_name: cgroups.plugin |
| 1893 | module_name: /sys/fs/cgroup |
| 1894 | monitored_instance_name: Containers |
| 1895 | info_provided_to_referring_integrations: |
| 1896 | description: "" |
| 1897 | keywords: |
| 1898 | - Directory Cache |
| 1899 | - File system |
| 1900 | - eBPF |
| 1901 | overview: |
| 1902 | data_collection: |
| 1903 | metrics_description: "Monitor directory cache events per application given an overall vision about files on memory or storage device." |
| 1904 | method_description: "Attach tracing (kprobe, trampoline) to internal kernel functions according options used to compile kernel." |
| 1905 | supported_platforms: |
| 1906 | include: |
| 1907 | - Linux |
| 1908 | exclude: [] |
| 1909 | multi_instance: true |
| 1910 | additional_permissions: |
| 1911 | description: "The plugin needs setuid because it loads data inside kernel. Netada sets necessary permission during installation time." |
| 1912 | default_behavior: |
| 1913 | auto_detection: |
| 1914 | description: "The plugin checks kernel compilation flags (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) and presence of BTF files to decide which eBPF program will be attached." |
| 1915 | limits: |
| 1916 | description: "" |
| 1917 | performance_impact: |
| 1918 | description: "This thread will add overhead every time that an internal kernel function monitored by this thread is called. The estimated additional period of time is between 90-200ns per call on kernels that do not have BTF technology." |
| 1919 | setup: |
| 1920 | prerequisites: |
| 1921 | list: |
| 1922 | - title: Compile kernel |
| 1923 | description: | |
| 1924 | Check if your kernel was compiled with necessary options (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) in `/proc/config.gz` or inside /boot/config file. Some cited names can be different accoring preferences of Linux distributions. |
| 1925 | When you do not have options set, it is necessary to get the kernel source code from https://kernel.org or a kernel package from your distribution, this last is preferred. The kernel compilation has a well definedd pattern, but distributions can deliver their configuration files |
| 1926 | with different names. |
| 1927 | |
| 1928 | Now follow steps: |
| 1929 | 1. Copy the configuration file to /usr/src/linux/.config. |
| 1930 | 2. Select the necessary options: make oldconfig |
| 1931 | 3. Compile your kernel image: make bzImage |
| 1932 | 4. Compile your modules: make modules |
| 1933 | 5. Copy your new kernel image for boot loader directory |
| 1934 | 6. Install the new modules: make modules_install |
| 1935 | 7. Generate an initial ramdisk image (`initrd`) if it is necessary. |
| 1936 | 8. Update your boot loader |
| 1937 | configuration: |
| 1938 | file: |
| 1939 | name: "ebpf.d/dcstat.conf" |
| 1940 | description: "Overwrite default configuration helping to reduce memory usage. You can also select charts visible on dashboard." |
| 1941 | options: |
| 1942 | description: | |
| 1943 | All options are defined inside section `[global]`. |
| 1944 | folding: |
| 1945 | title: "Config option" |
| 1946 | enabled: true |
| 1947 | list: |
| 1948 | - name: update every |
| 1949 | description: Data collection frequency. |
| 1950 | default_value: 10 |
| 1951 | required: false |
| 1952 | - name: ebpf load mode |
| 1953 | description: Define whether plugin will monitor the call (`entry`) for the functions or it will also monitor the return (`return`). |
| 1954 | default_value: entry |
| 1955 | required: false |
| 1956 | - name: apps |
| 1957 | description: Enable or disable integration with apps.plugin |
| 1958 | default_value: no |
| 1959 | required: false |
| 1960 | - name: cgroups |
| 1961 | description: Enable or disable integration with cgroup.plugin |
| 1962 | default_value: no |
| 1963 | required: false |
| 1964 | - name: pid table size |
| 1965 | description: Number of elements stored inside hash tables used to monitor calls per PID. |
| 1966 | default_value: 32768 |
| 1967 | required: false |
| 1968 | - name: ebpf type format |
| 1969 | description: "Define the file type to load an eBPF program. Three options are available: `legacy` (Attach only `kprobe`), `co-re` (Plugin tries to use `trampoline` when available), and `auto` (plugin check OS configuration before to load)." |
| 1970 | default_value: auto |
| 1971 | required: false |
| 1972 | - name: ebpf co-re tracing |
| 1973 | description: "Select the attach method used by plugin when `co-re` is defined in previous option. Two options are available: `trampoline` (Option with lowest overhead), and `probe` (the same of legacy code)." |
| 1974 | default_value: trampoline |
| 1975 | required: false |
| 1976 | - name: maps per core |
| 1977 | description: Define how plugin will load their hash maps. When enabled (`yes`) plugin will load one hash table per core, instead to have centralized information. |
| 1978 | default_value: yes |
| 1979 | required: false |
| 1980 | - name: lifetime |
| 1981 | description: Set default lifetime for thread when enabled by cloud. |
| 1982 | default_value: 300 |
| 1983 | required: false |
| 1984 | examples: |
| 1985 | folding: |
| 1986 | enabled: true |
| 1987 | title: "" |
| 1988 | list: [] |
| 1989 | troubleshooting: |
| 1990 | problems: |
| 1991 | list: [] |
| 1992 | alerts: [] |
| 1993 | metrics: |
| 1994 | folding: |
| 1995 | title: Metrics |
| 1996 | enabled: false |
| 1997 | description: "" |
| 1998 | availability: [] |
| 1999 | scopes: |
| 2000 | - name: apps |
| 2001 | description: "These Metrics show grouped information per apps group." |
| 2002 | labels: |
| 2003 | - name: app_group |
| 2004 | description: The name of the group defined in the configuration. |
| 2005 | metrics: |
| 2006 | - name: app.ebpf_dc_ratio |
| 2007 | description: Percentage of files inside directory cache |
| 2008 | unit: "%" |
| 2009 | chart_type: line |
| 2010 | dimensions: |
| 2011 | - name: ratio |
| 2012 | - name: app.ebpf_dc_reference |
| 2013 | description: Count file access |
| 2014 | unit: "files" |
| 2015 | chart_type: stacked |
| 2016 | dimensions: |
| 2017 | - name: files |
| 2018 | - name: app.ebpf_dc_not_cache |
| 2019 | description: Files not present inside directory cache |
| 2020 | unit: "files" |
| 2021 | chart_type: stacked |
| 2022 | dimensions: |
| 2023 | - name: files |
| 2024 | - name: app.ebpf_dc_not_found |
| 2025 | description: Files not found |
| 2026 | unit: "files" |
| 2027 | chart_type: stacked |
| 2028 | dimensions: |
| 2029 | - name: files |
| 2030 | - name: filesystem |
| 2031 | description: "These metrics show total number of calls to functions inside kernel." |
| 2032 | labels: [] |
| 2033 | metrics: |
| 2034 | - name: filesystem.dc_reference |
| 2035 | description: Variables used to calculate hit ratio. |
| 2036 | unit: "files" |
| 2037 | chart_type: line |
| 2038 | dimensions: |
| 2039 | - name: reference |
| 2040 | - name: slow |
| 2041 | - name: miss |
| 2042 | - name: filesystem.dc_hit_ratio |
| 2043 | description: Percentage of files inside directory cache |
| 2044 | unit: "%" |
| 2045 | chart_type: line |
| 2046 | dimensions: |
| 2047 | - name: ratio |
| 2048 | - name: cgroup |
| 2049 | description: "" |
| 2050 | labels: [] |
| 2051 | metrics: |
| 2052 | - name: cgroup.dc_ratio |
| 2053 | description: Percentage of files inside directory cache |
| 2054 | unit: "%" |
| 2055 | chart_type: line |
| 2056 | dimensions: |
| 2057 | - name: ratio |
| 2058 | - name: cgroup.dc_reference |
| 2059 | description: Count file access |
| 2060 | unit: "files" |
| 2061 | chart_type: line |
| 2062 | dimensions: |
| 2063 | - name: reference |
| 2064 | - name: cgroup.dc_not_cache |
| 2065 | description: Files not present inside directory cache |
| 2066 | unit: "files" |
| 2067 | chart_type: line |
| 2068 | dimensions: |
| 2069 | - name: slow |
| 2070 | - name: cgroup.dc_not_found |
| 2071 | description: Files not found |
| 2072 | unit: "files" |
| 2073 | chart_type: line |
| 2074 | dimensions: |
| 2075 | - name: miss |
| 2076 | - name: services.dc_ratio |
| 2077 | description: Percentage of files inside directory cache |
| 2078 | unit: "%" |
| 2079 | chart_type: line |
| 2080 | dimensions: |
| 2081 | - name: a dimension per systemd service |
| 2082 | - name: services.dc_reference |
| 2083 | description: Count file access |
| 2084 | unit: "files" |
| 2085 | chart_type: line |
| 2086 | dimensions: |
| 2087 | - name: a dimension per systemd service |
| 2088 | - name: services.dc_not_cache |
| 2089 | description: Files not present inside directory cache |
| 2090 | unit: "files" |
| 2091 | chart_type: line |
| 2092 | dimensions: |
| 2093 | - name: a dimension per systemd service |
| 2094 | - name: services.dc_not_found |
| 2095 | description: Files not found |
| 2096 | unit: "files" |
| 2097 | chart_type: line |
| 2098 | dimensions: |
| 2099 | - name: a dimension per systemd service |
| 2100 | - meta: |
| 2101 | plugin_name: ebpf.plugin |
| 2102 | module_name: filesystem |
| 2103 | monitored_instance: |
| 2104 | name: eBPF Filesystem |
| 2105 | link: "https://kernel.org/" |
| 2106 | categories: |
| 2107 | - data-collection.storage |
| 2108 | icon_filename: "ebpf.jpg" |
| 2109 | related_resources: |
| 2110 | integrations: |
| 2111 | list: [] |
| 2112 | info_provided_to_referring_integrations: |
| 2113 | description: "" |
| 2114 | keywords: |
| 2115 | - Filesystem |
| 2116 | - ext4 |
| 2117 | - btrfs |
| 2118 | - nfs |
| 2119 | - xfs |
| 2120 | - zfs |
| 2121 | - eBPF |
| 2122 | - latency |
| 2123 | - I/O |
| 2124 | overview: |
| 2125 | data_collection: |
| 2126 | metrics_description: "Monitor latency for main actions on filesystem like I/O events." |
| 2127 | method_description: "Attach tracing (kprobe, trampoline) to internal kernel functions according options used to compile kernel." |
| 2128 | supported_platforms: |
| 2129 | include: |
| 2130 | - Linux |
| 2131 | exclude: [] |
| 2132 | multi_instance: true |
| 2133 | additional_permissions: |
| 2134 | description: "The plugin needs setuid because it loads data inside kernel. Netada sets necessary permission during installation time." |
| 2135 | default_behavior: |
| 2136 | auto_detection: |
| 2137 | description: "The plugin checks kernel compilation flags (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT), files inside debugfs, and presence of BTF files to decide which eBPF program will be attached." |
| 2138 | limits: |
| 2139 | description: "" |
| 2140 | performance_impact: |
| 2141 | description: "" |
| 2142 | setup: |
| 2143 | prerequisites: |
| 2144 | list: |
| 2145 | - title: Compile kernel |
| 2146 | description: | |
| 2147 | Check if your kernel was compiled with necessary options (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) in `/proc/config.gz` or inside /boot/config file. Some cited names can be different accoring preferences of Linux distributions. |
| 2148 | When you do not have options set, it is necessary to get the kernel source code from https://kernel.org or a kernel package from your distribution, this last is preferred. The kernel compilation has a well definedd pattern, but distributions can deliver their configuration files |
| 2149 | with different names. |
| 2150 | |
| 2151 | Now follow steps: |
| 2152 | 1. Copy the configuration file to /usr/src/linux/.config. |
| 2153 | 2. Select the necessary options: make oldconfig |
| 2154 | 3. Compile your kernel image: make bzImage |
| 2155 | 4. Compile your modules: make modules |
| 2156 | 5. Copy your new kernel image for boot loader directory |
| 2157 | 6. Install the new modules: make modules_install |
| 2158 | 7. Generate an initial ramdisk image (`initrd`) if it is necessary. |
| 2159 | 8. Update your boot loader |
| 2160 | configuration: |
| 2161 | file: |
| 2162 | name: "ebpf.d/filesystem.conf" |
| 2163 | description: "Overwrite default configuration and allows user to select charts visible on dashboard." |
| 2164 | options: |
| 2165 | description: | |
| 2166 | This configuration file have two different sections. The `[global]` overwrites default options, while `[filesystem]` allow user to select the filesystems to monitor. |
| 2167 | folding: |
| 2168 | title: "Config options" |
| 2169 | enabled: true |
| 2170 | list: |
| 2171 | - name: update every |
| 2172 | description: Data collection frequency. |
| 2173 | default_value: 10 |
| 2174 | required: false |
| 2175 | - name: ebpf load mode |
| 2176 | description: Define whether plugin will monitor the call (`entry`) for the functions or it will also monitor the return (`return`). |
| 2177 | default_value: entry |
| 2178 | required: false |
| 2179 | - name: lifetime |
| 2180 | description: Set default lifetime for thread when enabled by cloud. |
| 2181 | default_value: 300 |
| 2182 | required: false |
| 2183 | - name: btrfsdist |
| 2184 | description: Enable or disable latency monitoring for functions associated with btrfs filesystem. |
| 2185 | default_value: yes |
| 2186 | required: false |
| 2187 | - name: ext4dist |
| 2188 | description: Enable or disable latency monitoring for functions associated with ext4 filesystem. |
| 2189 | default_value: yes |
| 2190 | required: false |
| 2191 | - name: nfsdist |
| 2192 | description: Enable or disable latency monitoring for functions associated with nfs filesystem. |
| 2193 | default_value: yes |
| 2194 | required: false |
| 2195 | - name: xfsdist |
| 2196 | description: Enable or disable latency monitoring for functions associated with xfs filesystem. |
| 2197 | default_value: yes |
| 2198 | required: false |
| 2199 | - name: zfsdist |
| 2200 | description: Enable or disable latency monitoring for functions associated with zfs filesystem. |
| 2201 | default_value: yes |
| 2202 | required: false |
| 2203 | examples: |
| 2204 | folding: |
| 2205 | enabled: true |
| 2206 | title: "" |
| 2207 | list: [] |
| 2208 | troubleshooting: |
| 2209 | problems: |
| 2210 | list: [] |
| 2211 | alerts: [] |
| 2212 | metrics: |
| 2213 | folding: |
| 2214 | title: Metrics |
| 2215 | enabled: false |
| 2216 | description: "" |
| 2217 | availability: [] |
| 2218 | scopes: |
| 2219 | - name: filesystem |
| 2220 | description: "Latency charts associate with filesystem actions." |
| 2221 | labels: [] |
| 2222 | metrics: |
| 2223 | - name: filesystem.read_latency |
| 2224 | description: ext4 latency for each read request. |
| 2225 | unit: "calls/s" |
| 2226 | chart_type: stacked |
| 2227 | dimensions: |
| 2228 | - name: latency period |
| 2229 | - name: filesystem.open_latency |
| 2230 | description: ext4 latency for each open request. |
| 2231 | unit: "calls/s" |
| 2232 | chart_type: stacked |
| 2233 | dimensions: |
| 2234 | - name: latency period |
| 2235 | - name: filesystem.sync_latency |
| 2236 | description: ext4 latency for each sync request. |
| 2237 | unit: "calls/s" |
| 2238 | chart_type: stacked |
| 2239 | dimensions: |
| 2240 | - name: latency period |
| 2241 | - name: iilesystem |
| 2242 | description: "" |
| 2243 | labels: [] |
| 2244 | metrics: |
| 2245 | - name: filesystem.write_latency |
| 2246 | description: ext4 latency for each write request. |
| 2247 | unit: "calls/s" |
| 2248 | chart_type: stacked |
| 2249 | dimensions: |
| 2250 | - name: latency period |
| 2251 | - name: global |
| 2252 | description: "" |
| 2253 | labels: [] |
| 2254 | metrics: |
| 2255 | - name: filesystem.attributte_latency |
| 2256 | description: nfs latency for each attribute request. |
| 2257 | unit: "calls/s" |
| 2258 | chart_type: stacked |
| 2259 | dimensions: |
| 2260 | - name: latency period |
| 2261 | - meta: |
| 2262 | plugin_name: ebpf.plugin |
| 2263 | module_name: shm |
| 2264 | monitored_instance: |
| 2265 | name: eBPF SHM |
| 2266 | link: "https://kernel.org/" |
| 2267 | categories: |
| 2268 | - data-collection.operating-systems |
| 2269 | icon_filename: "ebpf.jpg" |
| 2270 | related_resources: |
| 2271 | integrations: |
| 2272 | list: |
| 2273 | - plugin_name: apps.plugin |
| 2274 | module_name: apps |
| 2275 | - plugin_name: cgroups.plugin |
| 2276 | module_name: /sys/fs/cgroup |
| 2277 | monitored_instance_name: Containers |
| 2278 | info_provided_to_referring_integrations: |
| 2279 | description: "" |
| 2280 | keywords: |
| 2281 | - syscall |
| 2282 | - shared memory |
| 2283 | - eBPF |
| 2284 | overview: |
| 2285 | data_collection: |
| 2286 | metrics_description: "Monitor syscall responsible to manipulate shared memory." |
| 2287 | method_description: "Attach tracing (kprobe, trampoline) to internal kernel functions according options used to compile kernel." |
| 2288 | supported_platforms: |
| 2289 | include: |
| 2290 | - Linux |
| 2291 | exclude: [] |
| 2292 | multi_instance: true |
| 2293 | additional_permissions: |
| 2294 | description: "The plugin needs setuid because it loads data inside kernel. Netada sets necessary permission during installation time." |
| 2295 | default_behavior: |
| 2296 | auto_detection: |
| 2297 | description: "The plugin checks kernel compilation flags (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) and presence of BTF files to decide which eBPF program will be attached." |
| 2298 | limits: |
| 2299 | description: "" |
| 2300 | performance_impact: |
| 2301 | description: "This thread will add overhead every time that an internal kernel function monitored by this thread is called. The estimated additional period of time is between 90-200ns per call on kernels that do not have BTF technology." |
| 2302 | setup: |
| 2303 | prerequisites: |
| 2304 | list: |
| 2305 | - title: Compile kernel |
| 2306 | description: | |
| 2307 | Check if your kernel was compiled with necessary options (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) in `/proc/config.gz` or inside /boot/config file. Some cited names can be different accoring preferences of Linux distributions. |
| 2308 | When you do not have options set, it is necessary to get the kernel source code from https://kernel.org or a kernel package from your distribution, this last is preferred. The kernel compilation has a well definedd pattern, but distributions can deliver their configuration files |
| 2309 | with different names. |
| 2310 | |
| 2311 | Now follow steps: |
| 2312 | 1. Copy the configuration file to /usr/src/linux/.config. |
| 2313 | 2. Select the necessary options: make oldconfig |
| 2314 | 3. Compile your kernel image: make bzImage |
| 2315 | 4. Compile your modules: make modules |
| 2316 | 5. Copy your new kernel image for boot loader directory |
| 2317 | 6. Install the new modules: make modules_install |
| 2318 | 7. Generate an initial ramdisk image (`initrd`) if it is necessary. |
| 2319 | 8. Update your boot loader |
| 2320 | - title: Debug Filesystem |
| 2321 | description: | |
| 2322 | This thread needs to attach a tracepoint to monitor when a process schedule an exit event. To allow this specific feaure, it is necessary to mount `debugfs` (`mount -t debugfs none /sys/kernel/debug/`).` |
| 2323 | configuration: |
| 2324 | file: |
| 2325 | name: "ebpf.d/shm.conf" |
| 2326 | description: "Overwrite default configuration and allows user to select charts visible on dashboard." |
| 2327 | options: |
| 2328 | description: | |
| 2329 | This configuration file have two different sections. The `[global]` overwrites all default options, while `[syscalls]` allow user to select the syscall to monitor. |
| 2330 | folding: |
| 2331 | title: "Config options" |
| 2332 | enabled: true |
| 2333 | list: |
| 2334 | - name: update every |
| 2335 | description: Data collection frequency. |
| 2336 | default_value: 10 |
| 2337 | required: false |
| 2338 | - name: ebpf load mode |
| 2339 | description: Define whether plugin will monitor the call (`entry`) for the functions or it will also monitor the return (`return`). |
| 2340 | default_value: entry |
| 2341 | required: false |
| 2342 | - name: apps |
| 2343 | description: Enable or disable integration with apps.plugin |
| 2344 | default_value: no |
| 2345 | required: false |
| 2346 | - name: cgroups |
| 2347 | description: Enable or disable integration with cgroup.plugin |
| 2348 | default_value: no |
| 2349 | required: false |
| 2350 | - name: pid table size |
| 2351 | description: Number of elements stored inside hash tables used to monitor calls per PID. |
| 2352 | default_value: 32768 |
| 2353 | required: false |
| 2354 | - name: ebpf type format |
| 2355 | description: "Define the file type to load an eBPF program. Three options are available: `legacy` (Attach only `kprobe`), `co-re` (Plugin tries to use `trampoline` when available), and `auto` (plugin check OS configuration before to load)." |
| 2356 | default_value: auto |
| 2357 | required: false |
| 2358 | - name: ebpf co-re tracing |
| 2359 | description: "Select the attach method used by plugin when `co-re` is defined in previous option. Two options are available: `trampoline` (Option with lowest overhead), and `probe` (the same of legacy code)." |
| 2360 | default_value: trampoline |
| 2361 | required: false |
| 2362 | - name: maps per core |
| 2363 | description: Define how plugin will load their hash maps. When enabled (`yes`) plugin will load one hash table per core, instead to have centralized information. |
| 2364 | default_value: yes |
| 2365 | required: false |
| 2366 | - name: lifetime |
| 2367 | description: Set default lifetime for thread when enabled by cloud. |
| 2368 | default_value: 300 |
| 2369 | required: false |
| 2370 | - name: shmget |
| 2371 | description: Enable or disable monitoring for syscall `shmget` |
| 2372 | default_value: yes |
| 2373 | required: false |
| 2374 | - name: shmat |
| 2375 | description: Enable or disable monitoring for syscall `shmat` |
| 2376 | default_value: yes |
| 2377 | required: false |
| 2378 | - name: shmdt |
| 2379 | description: Enable or disable monitoring for syscall `shmdt` |
| 2380 | default_value: yes |
| 2381 | required: false |
| 2382 | - name: shmctl |
| 2383 | description: Enable or disable monitoring for syscall `shmctl` |
| 2384 | default_value: yes |
| 2385 | required: false |
| 2386 | examples: |
| 2387 | folding: |
| 2388 | enabled: true |
| 2389 | title: "" |
| 2390 | list: [] |
| 2391 | troubleshooting: |
| 2392 | problems: |
| 2393 | list: [] |
| 2394 | alerts: [] |
| 2395 | metrics: |
| 2396 | folding: |
| 2397 | title: Metrics |
| 2398 | enabled: false |
| 2399 | description: "" |
| 2400 | availability: [] |
| 2401 | scopes: |
| 2402 | - name: cgroup |
| 2403 | description: "These Metrics show grouped information per cgroup/service." |
| 2404 | labels: [] |
| 2405 | metrics: |
| 2406 | - name: cgroup.shmget |
| 2407 | description: Calls to syscall shmget(2). |
| 2408 | unit: "calls/s" |
| 2409 | chart_type: line |
| 2410 | dimensions: |
| 2411 | - name: get |
| 2412 | - name: cgroup.shmat |
| 2413 | description: Calls to syscall shmat(2). |
| 2414 | unit: "calls/s" |
| 2415 | chart_type: line |
| 2416 | dimensions: |
| 2417 | - name: at |
| 2418 | - name: cgroup.shmdt |
| 2419 | description: Calls to syscall shmdt(2). |
| 2420 | unit: "calls/s" |
| 2421 | chart_type: line |
| 2422 | dimensions: |
| 2423 | - name: dt |
| 2424 | - name: cgroup.shmctl |
| 2425 | description: Calls to syscall shmctl(2). |
| 2426 | unit: "calls/s" |
| 2427 | chart_type: line |
| 2428 | dimensions: |
| 2429 | - name: ctl |
| 2430 | - name: services.shmget |
| 2431 | description: Calls to syscall shmget(2). |
| 2432 | unit: "calls/s" |
| 2433 | chart_type: stacked |
| 2434 | dimensions: |
| 2435 | - name: a dimension per systemd service |
| 2436 | - name: services.shmat |
| 2437 | description: Calls to syscall shmat(2). |
| 2438 | unit: "calls/s" |
| 2439 | chart_type: stacked |
| 2440 | dimensions: |
| 2441 | - name: a dimension per systemd service |
| 2442 | - name: services.shmdt |
| 2443 | description: Calls to syscall shmdt(2). |
| 2444 | unit: "calls/s" |
| 2445 | chart_type: stacked |
| 2446 | dimensions: |
| 2447 | - name: a dimension per systemd service |
| 2448 | - name: services.shmctl |
| 2449 | description: Calls to syscall shmctl(2). |
| 2450 | unit: "calls/s" |
| 2451 | chart_type: stacked |
| 2452 | dimensions: |
| 2453 | - name: a dimension per systemd service |
| 2454 | - name: apps |
| 2455 | description: "These Metrics show grouped information per apps group." |
| 2456 | labels: |
| 2457 | - name: app_group |
| 2458 | description: The name of the group defined in the configuration. |
| 2459 | metrics: |
| 2460 | - name: app.ebpf_shmget_call |
| 2461 | description: Calls to syscall shmget(2). |
| 2462 | unit: "calls/s" |
| 2463 | chart_type: stacked |
| 2464 | dimensions: |
| 2465 | - name: calls |
| 2466 | - name: app.ebpf_shmat_call |
| 2467 | description: Calls to syscall shmat(2). |
| 2468 | unit: "calls/s" |
| 2469 | chart_type: stacked |
| 2470 | dimensions: |
| 2471 | - name: calls |
| 2472 | - name: app.ebpf_shmdt_call |
| 2473 | description: Calls to syscall shmdt(2). |
| 2474 | unit: "calls/s" |
| 2475 | chart_type: stacked |
| 2476 | dimensions: |
| 2477 | - name: calls |
| 2478 | - name: app.ebpf_shmctl_call |
| 2479 | description: Calls to syscall shmctl(2). |
| 2480 | unit: "calls/s" |
| 2481 | chart_type: stacked |
| 2482 | dimensions: |
| 2483 | - name: calls |
| 2484 | - name: global |
| 2485 | description: "These Metrics show number of calls for specified syscall." |
| 2486 | labels: [] |
| 2487 | metrics: |
| 2488 | - name: system.shared_memory_calls |
| 2489 | description: Calls to shared memory system calls |
| 2490 | unit: "calls/s" |
| 2491 | chart_type: line |
| 2492 | dimensions: |
| 2493 | - name: get |
| 2494 | - name: at |
| 2495 | - name: dt |
| 2496 | - name: ctl |
| 2497 | - meta: |
| 2498 | plugin_name: ebpf.plugin |
| 2499 | module_name: softirq |
| 2500 | monitored_instance: |
| 2501 | name: eBPF SoftIRQ |
| 2502 | link: "https://kernel.org/" |
| 2503 | categories: |
| 2504 | - data-collection.operating-systems |
| 2505 | icon_filename: "ebpf.jpg" |
| 2506 | related_resources: |
| 2507 | integrations: |
| 2508 | list: [] |
| 2509 | info_provided_to_referring_integrations: |
| 2510 | description: "" |
| 2511 | keywords: |
| 2512 | - SoftIRQ |
| 2513 | - eBPF |
| 2514 | overview: |
| 2515 | data_collection: |
| 2516 | metrics_description: "Monitor latency for each SoftIRQ available." |
| 2517 | method_description: "Attach kprobe to internal kernel functions." |
| 2518 | supported_platforms: |
| 2519 | include: |
| 2520 | - Linux |
| 2521 | exclude: [] |
| 2522 | multi_instance: true |
| 2523 | additional_permissions: |
| 2524 | description: "The plugin needs setuid because it loads data inside kernel. Netada sets necessary permission during installation time." |
| 2525 | default_behavior: |
| 2526 | auto_detection: |
| 2527 | description: "The plugin checks kernel compilation flags (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT), files inside debugfs, and presence of BTF files to decide which eBPF program will be attached." |
| 2528 | limits: |
| 2529 | description: "" |
| 2530 | performance_impact: |
| 2531 | description: "This thread will add overhead every time that an internal kernel function monitored by this thread is called." |
| 2532 | setup: |
| 2533 | prerequisites: |
| 2534 | list: |
| 2535 | - title: Compile kernel |
| 2536 | description: | |
| 2537 | Check if your kernel was compiled with necessary options (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) in `/proc/config.gz` or inside /boot/config file. Some cited names can be different accoring preferences of Linux distributions. |
| 2538 | When you do not have options set, it is necessary to get the kernel source code from https://kernel.org or a kernel package from your distribution, this last is preferred. The kernel compilation has a well definedd pattern, but distributions can deliver their configuration files |
| 2539 | with different names. |
| 2540 | |
| 2541 | Now follow steps: |
| 2542 | 1. Copy the configuration file to /usr/src/linux/.config. |
| 2543 | 2. Select the necessary options: make oldconfig |
| 2544 | 3. Compile your kernel image: make bzImage |
| 2545 | 4. Compile your modules: make modules |
| 2546 | 5. Copy your new kernel image for boot loader directory |
| 2547 | 6. Install the new modules: make modules_install |
| 2548 | 7. Generate an initial ramdisk image (`initrd`) if it is necessary. |
| 2549 | 8. Update your boot loader |
| 2550 | - title: Debug Filesystem |
| 2551 | description: | |
| 2552 | This thread needs to attach a tracepoint to monitor when a process schedule an exit event. To allow this specific feaure, it is necessary to mount `debugfs` (`mount -t debugfs none /sys/kernel/debug/`).` |
| 2553 | configuration: |
| 2554 | file: |
| 2555 | name: "ebpf.d/softirq.conf" |
| 2556 | description: "Overwrite default configuration reducing number of I/O events." |
| 2557 | options: |
| 2558 | description: | |
| 2559 | All options are defined inside section `[global]`. |
| 2560 | folding: |
| 2561 | title: "Config options" |
| 2562 | enabled: true |
| 2563 | list: |
| 2564 | - name: update every |
| 2565 | description: Data collection frequency. |
| 2566 | default_value: 10 |
| 2567 | required: false |
| 2568 | - name: ebpf load mode |
| 2569 | description: Define whether plugin will monitor the call (`entry`) for the functions or it will also monitor the return (`return`). |
| 2570 | default_value: entry |
| 2571 | required: false |
| 2572 | - name: lifetime |
| 2573 | description: Set default lifetime for thread when enabled by cloud. |
| 2574 | default_value: 300 |
| 2575 | required: false |
| 2576 | examples: |
| 2577 | folding: |
| 2578 | enabled: true |
| 2579 | title: "" |
| 2580 | list: [] |
| 2581 | troubleshooting: |
| 2582 | problems: |
| 2583 | list: [] |
| 2584 | alerts: [] |
| 2585 | metrics: |
| 2586 | folding: |
| 2587 | title: Metrics |
| 2588 | enabled: false |
| 2589 | description: "" |
| 2590 | availability: [] |
| 2591 | scopes: |
| 2592 | - name: global |
| 2593 | description: "These metrics show latest timestamp for each softIRQ available on host." |
| 2594 | labels: [] |
| 2595 | metrics: |
| 2596 | - name: system.softirq_latency |
| 2597 | description: Soft IRQ latency |
| 2598 | unit: "milliseconds" |
| 2599 | chart_type: stacked |
| 2600 | dimensions: |
| 2601 | - name: soft IRQs |
| 2602 | - meta: |
| 2603 | plugin_name: ebpf.plugin |
| 2604 | module_name: mount |
| 2605 | monitored_instance: |
| 2606 | name: eBPF Mount |
| 2607 | link: "https://kernel.org/" |
| 2608 | categories: |
| 2609 | - data-collection.storage |
| 2610 | icon_filename: "ebpf.jpg" |
| 2611 | related_resources: |
| 2612 | integrations: |
| 2613 | list: [] |
| 2614 | info_provided_to_referring_integrations: |
| 2615 | description: "" |
| 2616 | keywords: |
| 2617 | - mount |
| 2618 | - umount |
| 2619 | - device |
| 2620 | - eBPF |
| 2621 | overview: |
| 2622 | data_collection: |
| 2623 | metrics_description: "Monitor calls for mount and umount syscall." |
| 2624 | method_description: "Attach tracing (kprobe, trampoline) to internal kernel functions according options used to compile kernel." |
| 2625 | supported_platforms: |
| 2626 | include: |
| 2627 | - Linux |
| 2628 | exclude: [] |
| 2629 | multi_instance: true |
| 2630 | additional_permissions: |
| 2631 | description: "The plugin needs setuid because it loads data inside kernel. Netada sets necessary permission during installation time." |
| 2632 | default_behavior: |
| 2633 | auto_detection: |
| 2634 | description: "The plugin checks kernel compilation flags (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT, CONFIG_HAVE_SYSCALL_TRACEPOINTS), files inside debugfs, and presence of BTF files to decide which eBPF program will be attached." |
| 2635 | limits: |
| 2636 | description: "" |
| 2637 | performance_impact: |
| 2638 | description: "This thread will add overhead every time that an internal kernel function monitored by this thread is called. The estimated additional period of time is between 90-200ns per call on kernels that do not have BTF technology." |
| 2639 | setup: |
| 2640 | prerequisites: |
| 2641 | list: |
| 2642 | - title: Compile kernel |
| 2643 | description: | |
| 2644 | Check if your kernel was compiled with necessary options (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) in `/proc/config.gz` or inside /boot/config file. Some cited names can be different accoring preferences of Linux distributions. |
| 2645 | When you do not have options set, it is necessary to get the kernel source code from https://kernel.org or a kernel package from your distribution, this last is preferred. The kernel compilation has a well definedd pattern, but distributions can deliver their configuration files |
| 2646 | with different names. |
| 2647 | |
| 2648 | Now follow steps: |
| 2649 | 1. Copy the configuration file to /usr/src/linux/.config. |
| 2650 | 2. Select the necessary options: make oldconfig |
| 2651 | 3. Compile your kernel image: make bzImage |
| 2652 | 4. Compile your modules: make modules |
| 2653 | 5. Copy your new kernel image for boot loader directory |
| 2654 | 6. Install the new modules: make modules_install |
| 2655 | 7. Generate an initial ramdisk image (`initrd`) if it is necessary. |
| 2656 | 8. Update your boot loader |
| 2657 | - title: Debug Filesystem |
| 2658 | description: | |
| 2659 | This thread needs to attach a tracepoint to monitor when a process schedule an exit event. To allow this specific feaure, it is necessary to mount `debugfs` (`mount -t debugfs none /sys/kernel/debug/`).` |
| 2660 | configuration: |
| 2661 | file: |
| 2662 | name: "ebpf.d/mount.conf" |
| 2663 | description: "Overwrite default configuration." |
| 2664 | options: |
| 2665 | description: | |
| 2666 | All options are defined inside section `[global]`. |
| 2667 | folding: |
| 2668 | title: "Config options" |
| 2669 | enabled: true |
| 2670 | list: |
| 2671 | - name: update every |
| 2672 | description: Data collection frequency. |
| 2673 | default_value: 10 |
| 2674 | required: false |
| 2675 | - name: ebpf load mode |
| 2676 | description: Define whether plugin will monitor the call (`entry`) for the functions or it will also monitor the return (`return`). |
| 2677 | default_value: entry |
| 2678 | required: false |
| 2679 | - name: ebpf type format |
| 2680 | description: "Define the file type to load an eBPF program. Three options are available: `legacy` (Attach only `kprobe`), `co-re` (Plugin tries to use `trampoline` when available), and `auto` (plugin check OS configuration before to load)." |
| 2681 | default_value: auto |
| 2682 | required: false |
| 2683 | - name: ebpf co-re tracing |
| 2684 | description: "Select the attach method used by plugin when `co-re` is defined in previous option. Two options are available: `trampoline` (Option with lowest overhead), and `probe` (the same of legacy code)." |
| 2685 | default_value: trampoline |
| 2686 | required: false |
| 2687 | - name: lifetime |
| 2688 | description: Set default lifetime for thread when enabled by cloud. |
| 2689 | default_value: 300 |
| 2690 | required: false |
| 2691 | examples: |
| 2692 | folding: |
| 2693 | enabled: true |
| 2694 | title: "" |
| 2695 | list: [] |
| 2696 | troubleshooting: |
| 2697 | problems: |
| 2698 | list: [] |
| 2699 | alerts: [] |
| 2700 | metrics: |
| 2701 | folding: |
| 2702 | title: Metrics |
| 2703 | enabled: false |
| 2704 | description: "" |
| 2705 | availability: [] |
| 2706 | scopes: |
| 2707 | - name: global |
| 2708 | description: "Calls for syscalls mount an umount." |
| 2709 | labels: [] |
| 2710 | metrics: |
| 2711 | - name: mount_points.call |
| 2712 | description: Calls to mount and umount syscalls |
| 2713 | unit: "calls/s" |
| 2714 | chart_type: line |
| 2715 | dimensions: |
| 2716 | - name: mount |
| 2717 | - name: umount |
| 2718 | - name: mount_points.error |
| 2719 | description: Errors to mount and umount file systems |
| 2720 | unit: "calls/s" |
| 2721 | chart_type: line |
| 2722 | dimensions: |
| 2723 | - name: mount |
| 2724 | - name: umount |
| 2725 | - meta: |
| 2726 | plugin_name: ebpf.plugin |
| 2727 | module_name: vfs |
| 2728 | monitored_instance: |
| 2729 | name: eBPF VFS |
| 2730 | link: "https://kernel.org/" |
| 2731 | categories: |
| 2732 | - data-collection.storage |
| 2733 | icon_filename: "ebpf.jpg" |
| 2734 | related_resources: |
| 2735 | integrations: |
| 2736 | list: |
| 2737 | - plugin_name: apps.plugin |
| 2738 | module_name: apps |
| 2739 | - plugin_name: cgroups.plugin |
| 2740 | module_name: /sys/fs/cgroup |
| 2741 | monitored_instance_name: Containers |
| 2742 | info_provided_to_referring_integrations: |
| 2743 | description: "" |
| 2744 | keywords: |
| 2745 | - virtual |
| 2746 | - filesystem |
| 2747 | - eBPF |
| 2748 | - I/O |
| 2749 | - files |
| 2750 | overview: |
| 2751 | data_collection: |
| 2752 | metrics_description: "Monitor I/O events on Linux Virtual Filesystem." |
| 2753 | method_description: "Attach tracing (kprobe, trampoline) to internal kernel functions according options used to compile kernel." |
| 2754 | supported_platforms: |
| 2755 | include: |
| 2756 | - Linux |
| 2757 | exclude: [] |
| 2758 | multi_instance: true |
| 2759 | additional_permissions: |
| 2760 | description: "The plugin needs setuid because it loads data inside kernel. Netada sets necessary permission during installation time." |
| 2761 | default_behavior: |
| 2762 | auto_detection: |
| 2763 | description: "The plugin checks kernel compilation flags (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) and presence of BTF files to decide which eBPF program will be attached." |
| 2764 | limits: |
| 2765 | description: "" |
| 2766 | performance_impact: |
| 2767 | description: "This thread will add overhead every time that an internal kernel function monitored by this thread is called. The estimated additional period of time is between 90-200ns per call on kernels that do not have BTF technology." |
| 2768 | setup: |
| 2769 | prerequisites: |
| 2770 | list: |
| 2771 | - title: Compile kernel |
| 2772 | description: | |
| 2773 | Check if your kernel was compiled with necessary options (CONFIG_KPROBES, CONFIG_BPF, CONFIG_BPF_SYSCALL, CONFIG_BPF_JIT) in `/proc/config.gz` or inside /boot/config file. Some cited names can be different accoring preferences of Linux distributions. |
| 2774 | When you do not have options set, it is necessary to get the kernel source code from https://kernel.org or a kernel package from your distribution, this last is preferred. The kernel compilation has a well definedd pattern, but distributions can deliver their configuration files |
| 2775 | with different names. |
| 2776 | |
| 2777 | Now follow steps: |
| 2778 | 1. Copy the configuration file to /usr/src/linux/.config. |
| 2779 | 2. Select the necessary options: make oldconfig |
| 2780 | 3. Compile your kernel image: make bzImage |
| 2781 | 4. Compile your modules: make modules |
| 2782 | 5. Copy your new kernel image for boot loader directory |
| 2783 | 6. Install the new modules: make modules_install |
| 2784 | 7. Generate an initial ramdisk image (`initrd`) if it is necessary. |
| 2785 | 8. Update your boot loader |
| 2786 | configuration: |
| 2787 | file: |
| 2788 | name: "ebpf.d/vfs.conf" |
| 2789 | description: "Overwrite default configuration helping to reduce memory usage." |
| 2790 | options: |
| 2791 | description: | |
| 2792 | All options are defined inside section `[global]`. |
| 2793 | folding: |
| 2794 | title: "Config options" |
| 2795 | enabled: true |
| 2796 | list: |
| 2797 | - name: update every |
| 2798 | description: Data collection frequency. |
| 2799 | default_value: 10 |
| 2800 | required: false |
| 2801 | - name: ebpf load mode |
| 2802 | description: Define whether plugin will monitor the call (`entry`) for the functions or it will also monitor the return (`return`). |
| 2803 | default_value: entry |
| 2804 | required: false |
| 2805 | - name: apps |
| 2806 | description: Enable or disable integration with apps.plugin |
| 2807 | default_value: no |
| 2808 | required: false |
| 2809 | - name: cgroups |
| 2810 | description: Enable or disable integration with cgroup.plugin |
| 2811 | default_value: no |
| 2812 | required: false |
| 2813 | - name: pid table size |
| 2814 | description: Number of elements stored inside hash tables used to monitor calls per PID. |
| 2815 | default_value: 32768 |
| 2816 | required: false |
| 2817 | - name: ebpf type format |
| 2818 | description: "Define the file type to load an eBPF program. Three options are available: `legacy` (Attach only `kprobe`), `co-re` (Plugin tries to use `trampoline` when available), and `auto` (plugin check OS configuration before to load)." |
| 2819 | default_value: auto |
| 2820 | required: false |
| 2821 | - name: ebpf co-re tracing |
| 2822 | description: "Select the attach method used by plugin when `co-re` is defined in previous option. Two options are available: `trampoline` (Option with lowest overhead), and `probe` (the same of legacy code)." |
| 2823 | default_value: trampoline |
| 2824 | required: false |
| 2825 | - name: maps per core |
| 2826 | description: Define how plugin will load their hash maps. When enabled (`yes`) plugin will load one hash table per core, instead to have centralized information. |
| 2827 | default_value: yes |
| 2828 | required: false |
| 2829 | - name: lifetime |
| 2830 | description: Set default lifetime for thread when enabled by cloud. |
| 2831 | default_value: 300 |
| 2832 | required: false |
| 2833 | examples: |
| 2834 | folding: |
| 2835 | enabled: true |
| 2836 | title: "" |
| 2837 | list: [] |
| 2838 | troubleshooting: |
| 2839 | problems: |
| 2840 | list: [] |
| 2841 | alerts: [] |
| 2842 | metrics: |
| 2843 | folding: |
| 2844 | title: Metrics |
| 2845 | enabled: false |
| 2846 | description: "" |
| 2847 | availability: [] |
| 2848 | scopes: |
| 2849 | - name: cgroup |
| 2850 | description: "These Metrics show grouped information per cgroup/service." |
| 2851 | labels: [] |
| 2852 | metrics: |
| 2853 | - name: cgroup.vfs_unlink |
| 2854 | description: Files deleted |
| 2855 | unit: "calls/s" |
| 2856 | chart_type: line |
| 2857 | dimensions: |
| 2858 | - name: delete |
| 2859 | - name: cgroup.vfs_write |
| 2860 | description: Write to disk |
| 2861 | unit: "calls/s" |
| 2862 | chart_type: line |
| 2863 | dimensions: |
| 2864 | - name: write |
| 2865 | - name: cgroup.vfs_write_error |
| 2866 | description: Fails to write |
| 2867 | unit: "calls/s" |
| 2868 | chart_type: line |
| 2869 | dimensions: |
| 2870 | - name: write |
| 2871 | - name: cgroup.vfs_read |
| 2872 | description: Read from disk |
| 2873 | unit: "calls/s" |
| 2874 | chart_type: line |
| 2875 | dimensions: |
| 2876 | - name: read |
| 2877 | - name: cgroup.vfs_read_error |
| 2878 | description: Fails to read |
| 2879 | unit: "calls/s" |
| 2880 | chart_type: line |
| 2881 | dimensions: |
| 2882 | - name: read |
| 2883 | - name: cgroup.vfs_write_bytes |
| 2884 | description: Bytes written on disk |
| 2885 | unit: "bytes/s" |
| 2886 | chart_type: line |
| 2887 | dimensions: |
| 2888 | - name: write |
| 2889 | - name: cgroup.vfs_read_bytes |
| 2890 | description: Bytes read from disk |
| 2891 | unit: "bytes/s" |
| 2892 | chart_type: line |
| 2893 | dimensions: |
| 2894 | - name: read |
| 2895 | - name: cgroup.vfs_fsync |
| 2896 | description: Calls to vfs_fsync. |
| 2897 | unit: "calls/s" |
| 2898 | chart_type: line |
| 2899 | dimensions: |
| 2900 | - name: fsync |
| 2901 | - name: cgroup.vfs_fsync_error |
| 2902 | description: Sync error |
| 2903 | unit: "calls/s" |
| 2904 | chart_type: line |
| 2905 | dimensions: |
| 2906 | - name: fsync |
| 2907 | - name: cgroup.vfs_open |
| 2908 | description: Calls to vfs_open. |
| 2909 | unit: "calls/s" |
| 2910 | chart_type: line |
| 2911 | dimensions: |
| 2912 | - name: open |
| 2913 | - name: cgroup.vfs_open_error |
| 2914 | description: Open error |
| 2915 | unit: "calls/s" |
| 2916 | chart_type: line |
| 2917 | dimensions: |
| 2918 | - name: open |
| 2919 | - name: cgroup.vfs_create |
| 2920 | description: Calls to vfs_create. |
| 2921 | unit: "calls/s" |
| 2922 | chart_type: line |
| 2923 | dimensions: |
| 2924 | - name: create |
| 2925 | - name: cgroup.vfs_create_error |
| 2926 | description: Create error |
| 2927 | unit: "calls/s" |
| 2928 | chart_type: line |
| 2929 | dimensions: |
| 2930 | - name: create |
| 2931 | - name: services.vfs_unlink |
| 2932 | description: Files deleted |
| 2933 | unit: "calls/s" |
| 2934 | chart_type: stacked |
| 2935 | dimensions: |
| 2936 | - name: a dimension per systemd service |
| 2937 | - name: services.vfs_write |
| 2938 | description: Write to disk |
| 2939 | unit: "calls/s" |
| 2940 | chart_type: stacked |
| 2941 | dimensions: |
| 2942 | - name: a dimension per systemd service |
| 2943 | - name: services.vfs_write_error |
| 2944 | description: Fails to write |
| 2945 | unit: "calls/s" |
| 2946 | chart_type: stacked |
| 2947 | dimensions: |
| 2948 | - name: a dimension per systemd service |
| 2949 | - name: services.vfs_read |
| 2950 | description: Read from disk |
| 2951 | unit: "calls/s" |
| 2952 | chart_type: stacked |
| 2953 | dimensions: |
| 2954 | - name: a dimension per systemd service |
| 2955 | - name: services.vfs_read_error |
| 2956 | description: Fails to read |
| 2957 | unit: "calls/s" |
| 2958 | chart_type: stacked |
| 2959 | dimensions: |
| 2960 | - name: a dimension per systemd service |
| 2961 | - name: services.vfs_write_bytes |
| 2962 | description: Bytes written on disk |
| 2963 | unit: "bytes/s" |
| 2964 | chart_type: stacked |
| 2965 | dimensions: |
| 2966 | - name: a dimension per systemd service |
| 2967 | - name: services.vfs_read_bytes |
| 2968 | description: Bytes read from disk |
| 2969 | unit: "bytes/s" |
| 2970 | chart_type: stacked |
| 2971 | dimensions: |
| 2972 | - name: a dimension per systemd service |
| 2973 | - name: services.vfs_fsync |
| 2974 | description: Calls to vfs_fsync. |
| 2975 | unit: "calls/s" |
| 2976 | chart_type: stacked |
| 2977 | dimensions: |
| 2978 | - name: a dimension per systemd service |
| 2979 | - name: services.vfs_fsync_error |
| 2980 | description: Sync error |
| 2981 | unit: "calls/s" |
| 2982 | chart_type: stacked |
| 2983 | dimensions: |
| 2984 | - name: a dimension per systemd service |
| 2985 | - name: services.vfs_open |
| 2986 | description: Calls to vfs_open. |
| 2987 | unit: "calls/s" |
| 2988 | chart_type: stacked |
| 2989 | dimensions: |
| 2990 | - name: a dimension per systemd service |
| 2991 | - name: services.vfs_open_error |
| 2992 | description: Open error |
| 2993 | unit: "calls/s" |
| 2994 | chart_type: stacked |
| 2995 | dimensions: |
| 2996 | - name: a dimension per systemd service |
| 2997 | - name: services.vfs_create |
| 2998 | description: Calls to vfs_create. |
| 2999 | unit: "calls/s" |
| 3000 | chart_type: stacked |
| 3001 | dimensions: |
| 3002 | - name: a dimension per systemd service |
| 3003 | - name: services.vfs_create_error |
| 3004 | description: Create error |
| 3005 | unit: "calls/s" |
| 3006 | chart_type: stacked |
| 3007 | dimensions: |
| 3008 | - name: a dimension per systemd service |
| 3009 | - name: global |
| 3010 | description: "These Metrics show grouped information per cgroup/service." |
| 3011 | labels: [] |
| 3012 | metrics: |
| 3013 | - name: filesystem.vfs_deleted_objects |
| 3014 | description: Remove files |
| 3015 | unit: "calls/s" |
| 3016 | chart_type: line |
| 3017 | dimensions: |
| 3018 | - name: delete |
| 3019 | - name: filesystem.vfs_io |
| 3020 | description: Calls to IO |
| 3021 | unit: "calls/s" |
| 3022 | chart_type: line |
| 3023 | dimensions: |
| 3024 | - name: read |
| 3025 | - name: write |
| 3026 | - name: filesystem.vfs_io_bytes |
| 3027 | description: Bytes written and read |
| 3028 | unit: "bytes/s" |
| 3029 | chart_type: line |
| 3030 | dimensions: |
| 3031 | - name: read |
| 3032 | - name: write |
| 3033 | - name: filesystem.vfs_io_error |
| 3034 | description: Fails to write or read |
| 3035 | unit: "calls/s" |
| 3036 | chart_type: line |
| 3037 | dimensions: |
| 3038 | - name: read |
| 3039 | - name: write |
| 3040 | - name: filesystem.vfs_fsync |
| 3041 | description: Calls to vfs_fsync. |
| 3042 | unit: "calls/s" |
| 3043 | chart_type: line |
| 3044 | dimensions: |
| 3045 | - name: fsync |
| 3046 | - name: filesystem.vfs_fsync_error |
| 3047 | description: Fails to synchronize |
| 3048 | unit: "calls/s" |
| 3049 | chart_type: line |
| 3050 | dimensions: |
| 3051 | - name: fsync |
| 3052 | - name: filesystem.vfs_open |
| 3053 | description: Calls to vfs_open. |
| 3054 | unit: "calls/s" |
| 3055 | chart_type: line |
| 3056 | dimensions: |
| 3057 | - name: open |
| 3058 | - name: filesystem.vfs_open_error |
| 3059 | description: Fails to open a file |
| 3060 | unit: "calls/s" |
| 3061 | chart_type: line |
| 3062 | dimensions: |
| 3063 | - name: open |
| 3064 | - name: filesystem.vfs_create |
| 3065 | description: Calls to vfs_create. |
| 3066 | unit: "calls/s" |
| 3067 | chart_type: line |
| 3068 | dimensions: |
| 3069 | - name: create |
| 3070 | - name: filesystem.vfs_create_error |
| 3071 | description: Fails to create a file. |
| 3072 | unit: "calls/s" |
| 3073 | chart_type: line |
| 3074 | dimensions: |
| 3075 | - name: create |
| 3076 | - name: apps |
| 3077 | description: "These Metrics show grouped information per apps group." |
| 3078 | labels: |
| 3079 | - name: app_group |
| 3080 | description: The name of the group defined in the configuration. |
| 3081 | metrics: |
| 3082 | - name: app.ebpf_call_vfs_unlink |
| 3083 | description: Files deleted |
| 3084 | unit: "calls/s" |
| 3085 | chart_type: stacked |
| 3086 | dimensions: |
| 3087 | - name: calls |
| 3088 | - name: app.ebpf_call_vfs_write |
| 3089 | description: Write to disk |
| 3090 | unit: "calls/s" |
| 3091 | chart_type: stacked |
| 3092 | dimensions: |
| 3093 | - name: calls |
| 3094 | - name: app.ebpf_call_vfs_write_error |
| 3095 | description: Fails to write |
| 3096 | unit: "calls/s" |
| 3097 | chart_type: stacked |
| 3098 | dimensions: |
| 3099 | - name: calls |
| 3100 | - name: app.ebpf_call_vfs_read |
| 3101 | description: Read from disk |
| 3102 | unit: "calls/s" |
| 3103 | chart_type: stacked |
| 3104 | dimensions: |
| 3105 | - name: calls |
| 3106 | - name: app.ebpf_call_vfs_read_error |
| 3107 | description: Fails to read |
| 3108 | unit: "calls/s" |
| 3109 | chart_type: stacked |
| 3110 | dimensions: |
| 3111 | - name: calls |
| 3112 | - name: app.ebpf_call_vfs_write_bytes |
| 3113 | description: Bytes written on disk |
| 3114 | unit: "bytes/s" |
| 3115 | chart_type: stacked |
| 3116 | dimensions: |
| 3117 | - name: writes |
| 3118 | - name: app.ebpf_call_vfs_read_bytes |
| 3119 | description: Bytes read on disk |
| 3120 | unit: "bytes/s" |
| 3121 | chart_type: stacked |
| 3122 | dimensions: |
| 3123 | - name: reads |
| 3124 | - name: app.ebpf_call_vfs_fsync |
| 3125 | description: Calls to vfs_fsync. |
| 3126 | unit: "calls/s" |
| 3127 | chart_type: stacked |
| 3128 | dimensions: |
| 3129 | - name: calls |
| 3130 | - name: app.ebpf_call_vfs_fsync_error |
| 3131 | description: Sync error |
| 3132 | unit: "calls/s" |
| 3133 | chart_type: stacked |
| 3134 | dimensions: |
| 3135 | - name: calls |
| 3136 | - name: app.ebpf_call_vfs_open |
| 3137 | description: Calls to vfs_open. |
| 3138 | unit: "calls/s" |
| 3139 | chart_type: stacked |
| 3140 | dimensions: |
| 3141 | - name: calls |
| 3142 | - name: app.ebpf_call_vfs_open_error |
| 3143 | description: Open error |
| 3144 | unit: "calls/s" |
| 3145 | chart_type: stacked |
| 3146 | dimensions: |
| 3147 | - name: calls |
| 3148 | - name: app.ebpf_call_vfs_create |
| 3149 | description: Calls to vfs_create. |
| 3150 | unit: "calls/s" |
| 3151 | chart_type: stacked |
| 3152 | dimensions: |
| 3153 | - name: calls |
| 3154 | - name: app.ebpf_call_vfs_create_error |
| 3155 | description: Create error |
| 3156 | unit: "calls/s" |
| 3157 | chart_type: stacked |
| 3158 | dimensions: |
| 3159 | - name: calls |
| 3160 | - meta: |
| 3161 | plugin_name: ebpf.plugin |
| 3162 | module_name: process |
| 3163 | monitored_instance: |
| 3164 | name: eBPF Process |
| 3165 | link: "https://github.com/netdata/netdata/" |
| 3166 | categories: |
| 3167 | - data-collection.operating-systems |
| 3168 | icon_filename: "ebpf.jpg" |
| 3169 | related_resources: |
| 3170 | integrations: |
| 3171 | list: [] |
| 3172 | info_provided_to_referring_integrations: |
| 3173 | description: "" |
| 3174 | keywords: |
| 3175 | - Memory |
| 3176 | - plugin |
| 3177 | - eBPF |
| 3178 | overview: |
| 3179 | data_collection: |
| 3180 | metrics_description: "Monitor internal memory usage." |
| 3181 | method_description: "Uses netdata internal statistic to monitor memory management by plugin." |
| 3182 | supported_platforms: |
| 3183 | include: |
| 3184 | - Linux |
| 3185 | exclude: [] |
| 3186 | multi_instance: true |
| 3187 | additional_permissions: |
| 3188 | description: "" |
| 3189 | default_behavior: |
| 3190 | auto_detection: |
| 3191 | description: "" |
| 3192 | limits: |
| 3193 | description: "" |
| 3194 | performance_impact: |
| 3195 | description: "" |
| 3196 | setup: |
| 3197 | prerequisites: |
| 3198 | list: |
| 3199 | - title: Netdata flags. |
| 3200 | description: "To have these charts you need to compile netdata with flag `NETDATA_DEV_MODE`." |
| 3201 | configuration: |
| 3202 | file: |
| 3203 | name: "" |
| 3204 | description: "" |
| 3205 | options: |
| 3206 | description: "" |
| 3207 | folding: |
| 3208 | title: "" |
| 3209 | enabled: true |
| 3210 | list: [] |
| 3211 | examples: |
| 3212 | folding: |
| 3213 | enabled: true |
| 3214 | title: "" |
| 3215 | list: [] |
| 3216 | troubleshooting: |
| 3217 | problems: |
| 3218 | list: [] |
| 3219 | alerts: [] |
| 3220 | metrics: |
| 3221 | folding: |
| 3222 | title: Metrics |
| 3223 | enabled: false |
| 3224 | description: "" |
| 3225 | availability: [] |
| 3226 | scopes: |
| 3227 | - name: global |
| 3228 | description: "How plugin is allocating memory." |
| 3229 | labels: [] |
| 3230 | metrics: |
| 3231 | - name: netdata.ebpf_aral_stat_size |
| 3232 | description: Bytes allocated for ARAL. |
| 3233 | unit: "bytes" |
| 3234 | chart_type: stacked |
| 3235 | dimensions: |
| 3236 | - name: memory |
| 3237 | - name: netdata.ebpf_aral_stat_alloc |
| 3238 | description: Calls to allocate memory. |
| 3239 | unit: "calls" |
| 3240 | chart_type: stacked |
| 3241 | dimensions: |
| 3242 | - name: aral |
| 3243 | - name: netdata.ebpf_threads |
| 3244 | description: Threads info |
| 3245 | unit: "threads" |
| 3246 | chart_type: line |
| 3247 | dimensions: |
| 3248 | - name: total |
| 3249 | - name: running |
| 3250 | - name: netdata.ebpf_pids |
| 3251 | description: Total number of monitored PIDs |
| 3252 | unit: "pids" |
| 3253 | chart_type: line |
| 3254 | dimensions: |
| 3255 | - name: user |
| 3256 | - name: kernel |
| 3257 | - name: netdata.ebpf_load_methods |
| 3258 | description: Load info |
| 3259 | unit: "methods" |
| 3260 | chart_type: line |
| 3261 | dimensions: |
| 3262 | - name: legacy |
| 3263 | - name: co-re |
| 3264 | - name: netdata.ebpf_kernel_memory |
| 3265 | description: Memory allocated for hash tables. |
| 3266 | unit: "bytes" |
| 3267 | chart_type: line |
| 3268 | dimensions: |
| 3269 | - name: memory_locked |
| 3270 | - name: netdata.ebpf_hash_tables_count |
| 3271 | description: Number of hash tables loaded |
| 3272 | unit: "hash tables" |
| 3273 | chart_type: line |
| 3274 | dimensions: |
| 3275 | - name: hash_table |
| 3276 | - name: netdata.ebpf_hash_tables_insert_pid_elements |
| 3277 | description: Number of times an element was inserted in a hash table. |
| 3278 | unit: "rows" |
| 3279 | chart_type: line |
| 3280 | dimensions: |
| 3281 | - name: thread |
| 3282 | - name: netdata.ebpf_hash_tables_remove_pid_elements |
| 3283 | description: Number of times an element was removed in a hash table. |
| 3284 | unit: "rows" |
| 3285 | chart_type: line |
| 3286 | dimensions: |
| 3287 | - name: thread |
| 3288 | - name: netdata.ebpf_ipc_usage |
| 3289 | description: IPC used array positions |
| 3290 | unit: "%" |
| 3291 | chart_type: line |
| 3292 | dimensions: |
| 3293 | - name: positions |