# The `ebpf load mode` option accepts the following values : # `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors. # `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates # new charts for the return of these functions, such as errors. # # The eBPF collector also creates charts for each running application through an integration with the `apps.plugin` # or `cgroups.plugin`. # If you want to disable the integration with `apps.plugin` or `cgroups.plugin` along with the above charts, change # the setting `apps` and `cgroups` to 'no'. # # The following options change the hash table size: # `bandwidth table size`: Maximum number of connections monitored # `ipv4 connection table size`: Maximum number of IPV4 connections monitored # `ipv6 connection table size`: Maximum number of IPV6 connections monitored # `udp connection table size`: Maximum number of UDP connections monitored # # The `ebpf type format` option accepts the following values : # `auto` : The eBPF collector will investigate hardware and select between the two next options. # `legacy`: The eBPF collector will load the legacy code. Note: This has a bigger overload. # `co-re` : The eBPF collector will use latest tracing method. Note: This is not available on all platforms. # # The `ebpf co-re tracing` option accepts the following values: # `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host. # `tracepoint`: When available, the eBPF collector will use kernel tracepoint to monitor syscall. # `probe` : This is the same as legacy code. # # The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6. # # The `collect pid` option defines the PID stored inside hash tables and accepts the following options: # `real parent`: Only stores real parent inside PID # `parent` : Only stores parent PID. # `all` : Stores all PIDs used by software. This is the most expensive option. # # The `lifetime` defines the time length a thread will run when it is enabled by a function. # # Uncomment lines to define specific options for thread. [global] # ebpf load mode = entry # apps = yes # cgroups = no # update every = 10 bandwidth table size = 16384 socket monitoring table size = 16384 udp connection table size = 4096 ebpf type format = auto ebpf co-re tracing = probe maps per core = no collect pid = all lifetime = 300 # # Network Connection # # This is a feature with status WIP(Work in Progress) # [network connections] enabled = yes resolve hostnames = no resolve service names = yes ports = * # ips = !127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 fc00::/7 !::1/128 ips = * hostnames = * [service name] 19999 = Netdata