| 1 | # |
| 2 | # Global options |
| 3 | # |
| 4 | # The `ebpf load mode` option accepts the following values : |
| 5 | # `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors. |
| 6 | # `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates |
| 7 | # new charts for the return of these functions, such as errors. |
| 8 | # |
| 9 | # The eBPF collector also creates charts for each running application through an integration with the `apps.plugin` |
| 10 | # or `cgroups.plugin`. |
| 11 | # If you want to disable the integration with `apps.plugin` or `cgroups.plugin` along with the above charts, change the setting |
| 12 | # `apps` and `cgroups` to 'no'. |
| 13 | # |
| 14 | # The `update every` option defines the number of seconds used to read data from kernel and send to netdata |
| 15 | # |
| 16 | # The `pid table size` defines the maximum number of PIDs stored in the application hash tables. |
| 17 | # |
| 18 | # The `btf path` specifies where to find the BTF files. |
| 19 | # |
| 20 | # The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.15. |
| 21 | # |
| 22 | # The `lifetime` defines the time length a thread will run when it is enabled by a function. |
| 23 | # |
| 24 | [global] |
| 25 | ebpf load mode = entry |
| 26 | apps = no |
| 27 | cgroups = no |
| 28 | update every = 10 |
| 29 | pid table size = 32768 |
| 30 | btf path = /sys/kernel/btf/ |
| 31 | maps per core = yes |
| 32 | lifetime = 300 |
| 33 | |
| 34 | # |
| 35 | # eBPF Programs |
| 36 | # |
| 37 | # The eBPF collector has the following eBPF programs: |
| 38 | # |
| 39 | # `cachestat` : Make charts for kernel functions related to page cache. |
| 40 | # `dcstat` : Make charts for kernel functions related to directory cache. |
| 41 | # `disk` : Monitor I/O latencies for disks |
| 42 | # `fd` : This eBPF program creates charts that show information about file manipulation. |
| 43 | # `filesystem`: Monitor calls for functions used to manipulate specific filesystems |
| 44 | # `hardirq` : Monitor latency of serving hardware interrupt requests (hard IRQs). |
| 45 | # `mdflush` : Monitors flush counts for multi-devices. |
| 46 | # `mount` : Monitor calls for syscalls mount and umount |
| 47 | # `oomkill` : This eBPF program creates a chart that shows which process got OOM killed and when. |
| 48 | # `process` : This eBPF program creates charts that show information about process life. |
| 49 | # `shm` : Monitor calls for syscalls shmget, shmat, shmdt and shmctl. |
| 50 | # `socket` : This eBPF program creates charts with information about `TCP` and `UDP` functions, including the |
| 51 | # bandwidth consumed by each. |
| 52 | # `softirq` : Monitor latency of serving software interrupt requests (soft IRQs). |
| 53 | # `sync` : Monitor calls for syscall sync(2). |
| 54 | # `swap` : Monitor calls for internal swap functions. |
| 55 | # `vfs` : This eBPF program creates charts that show information about process VFS IO, VFS file manipulation and |
| 56 | # files removed. |
| 57 | # |
| 58 | # When plugin detects that system has support to BTF, it enables integration with apps.plugin. |
| 59 | # |
| 60 | [ebpf programs] |
| 61 | cachestat = no |
| 62 | dcstat = no |
| 63 | disk = no |
| 64 | fd = no |
| 65 | filesystem = no |
| 66 | hardirq = no |
| 67 | mdflush = no |
| 68 | mount = yes |
| 69 | oomkill = yes |
| 70 | process = no |
| 71 | shm = no |
| 72 | socket = no |
| 73 | softirq = no |
| 74 | sync = no |
| 75 | swap = no |
| 76 | vfs = no |
| 77 | network connections = no |
| 78 | |
| 79 | # |
| 80 | # Inter-Process Communication (IPC) |
| 81 | # |
| 82 | # Configurations for communication between different plugins. |
| 83 | # |
| 84 | # Available `integration` options: |
| 85 | # `shm` : Shared Memory. Collectors will use the same shared memory |
| 86 | # to avoid duplication. |
| 87 | # `socket` : Unix socket. The eBPF plugin will not store data in the user ring; |
| 88 | # it will only read data from the kernel and send it to requesting clients. |
| 89 | # `disabled`: Disables data sharing between collectors. |
| 90 | # |
| 91 | # The `backlog` option defines the maximum number of concurrent connections that |
| 92 | # can be queued for acceptance. |
| 93 | # |
| 94 | # The `bind to` option defines the path for unix socket |
| 95 | # |
| 96 | [ipc] |
| 97 | integration = disabled |
| 98 | bind to = unix:/tmp/netdata_ebpf_sock |
| 99 | backlog = 20 |