eBPF plugin

Change eBPF plugin internal organization.

collectors/ebpf.plugin/Makefile.am

@@ -10,6 +10,12 @@ CLEANFILES = \
 include $(top_srcdir)/build/subst.inc
 SUFFIXES = .in
 
+userebpfconfigdir=$(configdir)/ebpf.d
+
+# Explicitly install directories to avoid permission issues due to umask
+install-exec-local:
+	$(INSTALL) -d $(DESTDIR)$(userebpfconfigdir)
+
 dist_plugins_SCRIPTS = \
     reset_netdata_trace.sh \
     $(NULL)
@@ -19,7 +25,15 @@ dist_noinst_DATA = \
     README.md \
     $(NULL)
 
+ebpfconfigdir=$(libconfigdir)/ebpf.d
 dist_libconfig_DATA = \
-    ebpf.conf \
-    ebpf_kernel_reject_list.txt \
+    ebpf.d.conf \
+    $(NULL)
+
+dist_ebpfconfig_DATA = \
+    ebpf.d/ebpf_kernel_reject_list.txt \
+    ebpf.d/cachestat.conf \
+    ebpf.d/network.conf \
+    ebpf.d/process.conf \
+    ebpf.d/sync.conf \
     $(NULL)

collectors/ebpf.plugin/README.md

@@ -148,6 +148,7 @@ accepts the following values: ​
 -   `return`: In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
     new charts for the return of these functions, such as errors. Monitoring function returns can help in debugging
     software, such as failing to close file descriptors or creating zombie processes.
+-   `update every`:  Number of seconds used for eBPF to send data for Netdata.   
     
 #### Integration with `apps.plugin`
 
@@ -186,17 +187,44 @@ If you want to _disable_ the integration with `apps.plugin` along with the above
    apps = yes
 ```
 
-### `[ebpf programs]`
+#### `[ebpf programs]`
 
 The eBPF collector enables and runs the following eBPF programs by default:
 
+-   `cachestat`: Netdata's eBPF data collector creates charts about the memory page cache. When the integration with
+    [`apps.plugin`](/collectors/apps.plugin/README.md) is enabled, this collector creates charts for the whole host _and_
+    for each application.
 -   `process`: This eBPF program creates charts that show information about process creation, VFS IO, and files removed.
     When in `return` mode, it also creates charts showing errors when these operations are executed.
 -   `network viewer`: This eBPF program creates charts with information about `TCP` and `UDP` functions, including the
     bandwidth consumed by each.
 -   `sync`: Montitor calls for syscall sync(2).
 
-### `[network connections]`
+## Thread configuration
+
+You can configure each thread of the eBPF data collector by editing either the `cachestat.conf`, `process.conf`, 
+or `network.conf` files. Use [`edit-config`](/docs/configure/nodes.md) from your Netdata config directory:
+
+```bash
+cd /etc/netdata/   # Replace with your Netdata configuration directory, if not /etc/netdata/
+./edit-config ebpf.d/process.conf
+```
+
+### Configuration files
+
+The following configuration files are available:
+
+- `cachestat.conf`: Configuration for the `cachestat` thread.
+- `process.conf`: Configuration for the `process` thread.
+- `network.conf`: Configuration for the `network viewer` thread. This config file overwrites the global options and
+  also lets you specify which network the eBPF collector monitors.
+
+### Network configuration
+
+The network configuration has specific options to configure which network(s) the eBPF collector monitors. These options
+are divided in the following sections:
+
+#### `[network connections]`
 
 You can configure the information shown on `outbound` and `inbound` charts with the settings in this section. 
 

collectors/ebpf.plugin/ebpf.conf → collectors/ebpf.plugin/ebpf.d.conf

@@ -10,9 +10,11 @@
 # If you want to disable the integration with `apps.plugin` along with the above charts, change the setting `apps` to
 # 'no'.
 #
+# The `update every` option defines the number of seconds used to read data from kernel and send to netdata
 [global]
     ebpf load mode = entry
     apps = yes
+    update every = 1
 
 #
 # eBPF Programs
@@ -32,18 +34,3 @@
     sync = yes
     network connections = no
 
-#
-# Network Connection
-#
-# This is a feature with status WIP(Work in Progress)
-#
-[network connections]
-    maximum dimensions = 50
-    resolve hostnames = no
-    resolve service names = no
-    ports = *
-    ips = !127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 fc00::/7 !::1/128
-    hostnames = *
-
-[service name]
-    19999 = Netdata

collectors/ebpf.plugin/ebpf.d/cachestat.conf

@@ -0,0 +1,14 @@
+# The `ebpf load mode` option accepts the following values :
+#  `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
+#  `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
+#            new charts for the return of these functions, such as errors.
+#
+# The eBPF collector also creates charts for each running application through an integration with the `apps plugin`.
+# If you want to disable the integration with `apps.plugin` along with the above charts, change the setting `apps` to
+# 'no'.
+#
+#  
+[global]
+    ebpf load mode = entry
+    apps = yes
+    update every = 2

collectors/ebpf.plugin/ebpf.d/network.conf

@@ -0,0 +1,30 @@
+# The `ebpf load mode` option accepts the following values :
+#  `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
+#  `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
+#            new charts for the return of these functions, such as errors.
+#
+# The eBPF collector also creates charts for each running application through an integration with the `apps plugin`.
+# If you want to disable the integration with `apps.plugin` along with the above charts, change the setting `apps` to
+# 'no'.
+#
+#  
+[global]
+    ebpf load mode = entry
+    apps = yes
+    update every = 1
+
+#
+# Network Connection
+#
+# This is a feature with status WIP(Work in Progress)
+#
+[network connections]
+    maximum dimensions = 50
+    resolve hostnames = no
+    resolve service names = no
+    ports = *
+    ips = !127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 fc00::/7 !::1/128
+    hostnames = *
+
+[service name]
+    19999 = Netdata

collectors/ebpf.plugin/ebpf.d/process.conf

@@ -0,0 +1,14 @@
+# The `ebpf load mode` option accepts the following values :
+#  `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
+#  `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
+#            new charts for the return of these functions, such as errors.
+#
+# The eBPF collector also creates charts for each running application through an integration with the `apps plugin`.
+# If you want to disable the integration with `apps.plugin` along with the above charts, change the setting `apps` to
+# 'no'.
+#
+#  
+[global]
+    ebpf load mode = entry
+    apps = yes
+    update every = 1

collectors/ebpf.plugin/ebpf.d/sync.conf

@@ -0,0 +1,14 @@
+# The `ebpf load mode` option accepts the following values :
+#  `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
+#  `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
+#            new charts for the return of these functions, such as errors.
+#
+# The eBPF collector also creates charts for each running application through an integration with the `apps plugin`.
+# If you want to disable the integration with `apps.plugin` along with the above charts, change the setting `apps` to
+# 'no'.
+#
+#  
+[global]
+    ebpf load mode = entry
+    apps = yes
+    update every = 2

collectors/ebpf.plugin/ebpf.h

@@ -31,6 +31,9 @@
 
 #include "ebpf_apps.h"
 
+#define NETDATA_EBPF_OLD_CONFIG_FILE "ebpf.conf"
+#define NETDATA_EBPF_CONFIG_FILE "ebpf.d.conf"
+
 typedef struct netdata_syscall_stat {
     unsigned long bytes;               // total number of bytes
     uint64_t call;                     // total number of calls
@@ -88,6 +91,8 @@ enum ebpf_module_indexes {
 
 // Chart defintions
 #define NETDATA_EBPF_FAMILY "ebpf"
+#define NETDATA_EBPF_CHART_TYPE_LINE "line"
+#define NETDATA_EBPF_CHART_TYPE_STACKED "stacked"
 #define NETDATA_EBPF_MEMORY_GROUP "mem"
 
 // Log file
@@ -151,6 +156,7 @@ extern void ebpf_create_chart(char *type,
                               char *units,
                               char *family,
                               char *context,
+                              char *charttype,
                               int order,
                               void (*ncd)(void *, int),
                               void *move,
@@ -173,6 +179,7 @@ extern void ebpf_create_charts_on_apps(char *name,
                                        char *title,
                                        char *units,
                                        char *family,
+                                       char *charttype,
                                        int order,
                                        char *algorithm,
                                        struct target *root);
@@ -181,10 +188,7 @@ extern void write_end_chart();
 
 extern void ebpf_cleanup_publish_syscall(netdata_publish_syscall_t *nps);
 
-#define EBPF_GLOBAL_SECTION "global"
 #define EBPF_PROGRAMS_SECTION "ebpf programs"
-#define EBPF_NETWORK_VIEWER_SECTION "network connections"
-#define EBPF_SERVICE_NAME_SECTION "service name"
 
 #define EBPF_COMMON_DIMENSION_PERCENTAGE "%"
 #define EBPF_COMMON_DIMENSION_CALL "calls/s"
@@ -194,11 +198,15 @@ extern void ebpf_cleanup_publish_syscall(netdata_publish_syscall_t *nps);
 #define EBPF_COMMON_DIMENSION_PACKETS "packets"
 
 // Common variables
-extern char *ebpf_user_config_dir;
-extern char *ebpf_stock_config_dir;
 extern int debug_enabled;
 extern struct pid_stat *root_of_pids;
 extern char *ebpf_algorithms[];
+extern struct config collector_config;
+extern struct pid_stat *root_of_pids;
+extern ebpf_process_stat_t *global_process_stat;
+extern size_t all_pids_count;
+extern int update_every;
+extern uint32_t finalized_threads;
 
 // Socket functions and variables
 // Common functions
@@ -207,11 +215,6 @@ extern void ebpf_socket_create_apps_charts(struct ebpf_module *em, void *ptr);
 extern void ebpf_cachestat_create_apps_charts(struct ebpf_module *em, void *root);
 extern void ebpf_one_dimension_write_charts(char *family, char *chart, char *dim, long long v1);
 extern collected_number get_value_from_structure(char *basis, size_t offset);
-extern struct pid_stat *root_of_pids;
-extern ebpf_process_stat_t *global_process_stat;
-extern size_t all_pids_count;
-extern int update_every;
-extern uint32_t finalized_threads;
 
 #define EBPF_MAX_SYNCHRONIZATION_TIME 300