Merging upstream version 1.41.0.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 588 insertions, 235 deletions

diff --git a/collectors/ebpf.plugin/ebpf.c b/collectors/ebpf.plugin/ebpf.c
index ffab37de3..72aedba6a 100644
--- a/collectors/ebpf.plugin/ebpf.c
+++ b/collectors/ebpf.plugin/ebpf.c
@@ -30,6 +30,8 @@ int ebpf_nprocs;
 int isrh = 0;
 int main_thread_id = 0;
 int process_pid_fd = -1;
+static size_t global_iterations_counter = 1;
+bool publish_internal_metrics = true;
 
 pthread_mutex_t lock;
 pthread_mutex_t ebpf_exit_cleanup;
@@ -47,7 +49,8 @@ struct netdata_static_thread cgroup_integration_thread = {
 };
 
 ebpf_module_t ebpf_modules[] = {
-    { .thread_name = "process", .config_name = "process", .enabled = 0, .start_routine = ebpf_process_thread,
+    { .thread_name = "process", .config_name = "process", .thread_description = NETDATA_EBPF_MODULE_PROCESS_DESC,
+      .enabled = 0, .start_routine = ebpf_process_thread,
       .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
       .apps_level = NETDATA_APPS_LEVEL_REAL_PARENT, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
       .apps_routine = ebpf_process_create_apps_charts, .maps = NULL,
@@ -56,8 +59,9 @@ ebpf_module_t ebpf_modules[] = {
       .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4 | NETDATA_V5_10 |
                   NETDATA_V5_14,
       .load = EBPF_LOAD_LEGACY, .targets = NULL, .probe_links = NULL, .objects = NULL,
-      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES},
-    { .thread_name = "socket", .config_name = "socket", .enabled = 0, .start_routine = ebpf_socket_thread,
+      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES, .lifetime = EBPF_DEFAULT_LIFETIME, .running_time = 0 },
+      { .thread_name = "socket", .config_name = "socket", .thread_description = NETDATA_EBPF_SOCKET_MODULE_DESC,
+      .enabled = 0, .start_routine = ebpf_socket_thread,
       .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
       .apps_level = NETDATA_APPS_LEVEL_REAL_PARENT, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
       .apps_routine = ebpf_socket_create_apps_charts, .maps = NULL,
@@ -65,8 +69,9 @@ ebpf_module_t ebpf_modules[] = {
       .config_file = NETDATA_NETWORK_CONFIG_FILE,
       .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4 | NETDATA_V5_14,
       .load = EBPF_LOAD_LEGACY, .targets = socket_targets, .probe_links = NULL, .objects = NULL,
-      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES},
-    { .thread_name = "cachestat", .config_name = "cachestat", .enabled = 0, .start_routine = ebpf_cachestat_thread,
+      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES, .lifetime = EBPF_DEFAULT_LIFETIME, .running_time = 0},
+    { .thread_name = "cachestat", .config_name = "cachestat", .thread_description = NETDATA_EBPF_CACHESTAT_MODULE_DESC,
+      .enabled = 0, .start_routine = ebpf_cachestat_thread,
       .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
       .apps_level = NETDATA_APPS_LEVEL_REAL_PARENT, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
       .apps_routine = ebpf_cachestat_create_apps_charts, .maps = cachestat_maps,
@@ -75,8 +80,9 @@ ebpf_module_t ebpf_modules[] = {
       .kernels = NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18|
                  NETDATA_V5_4 | NETDATA_V5_14 | NETDATA_V5_15 | NETDATA_V5_16,
       .load = EBPF_LOAD_LEGACY, .targets = cachestat_targets, .probe_links = NULL, .objects = NULL,
-      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES},
-    { .thread_name = "sync", .config_name = "sync", .enabled = 0, .start_routine = ebpf_sync_thread,
+      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES, .lifetime = EBPF_DEFAULT_LIFETIME, .running_time = 0},
+    { .thread_name = "sync", .config_name = "sync", .thread_description = NETDATA_EBPF_SYNC_MODULE_DESC,
+      .enabled = 0, .start_routine = ebpf_sync_thread,
       .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
       .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
       .apps_routine = NULL, .maps = NULL, .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &sync_config,
@@ -84,8 +90,9 @@ ebpf_module_t ebpf_modules[] = {
       // All syscalls have the same kernels
       .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4 | NETDATA_V5_14,
       .load = EBPF_LOAD_LEGACY, .targets = sync_targets, .probe_links = NULL, .objects = NULL,
-      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES},
-    { .thread_name = "dc", .config_name = "dc", .enabled = 0, .start_routine = ebpf_dcstat_thread,
+      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES, .lifetime = EBPF_DEFAULT_LIFETIME, .running_time = 0},
+    { .thread_name = "dc", .config_name = "dc", .thread_description = NETDATA_EBPF_DC_MODULE_DESC,
+      .enabled = 0, .start_routine = ebpf_dcstat_thread,
       .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
       .apps_level = NETDATA_APPS_LEVEL_REAL_PARENT, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
       .apps_routine = ebpf_dcstat_create_apps_charts, .maps = dcstat_maps,
@@ -93,8 +100,9 @@ ebpf_module_t ebpf_modules[] = {
       .config_file = NETDATA_DIRECTORY_DCSTAT_CONFIG_FILE,
       .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4 | NETDATA_V5_14,
       .load = EBPF_LOAD_LEGACY, .targets = dc_targets, .probe_links = NULL, .objects = NULL,
-      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES},
-    { .thread_name = "swap", .config_name = "swap", .enabled = 0, .start_routine = ebpf_swap_thread,
+      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES, .lifetime = EBPF_DEFAULT_LIFETIME, .running_time = 0},
+    { .thread_name = "swap", .config_name = "swap", .thread_description = NETDATA_EBPF_SWAP_MODULE_DESC,
+      .enabled = 0, .start_routine = ebpf_swap_thread,
       .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
       .apps_level = NETDATA_APPS_LEVEL_REAL_PARENT, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
       .apps_routine = ebpf_swap_create_apps_charts, .maps = NULL,
@@ -102,8 +110,9 @@ ebpf_module_t ebpf_modules[] = {
       .config_file = NETDATA_DIRECTORY_SWAP_CONFIG_FILE,
       .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4 | NETDATA_V5_14,
       .load = EBPF_LOAD_LEGACY, .targets = swap_targets, .probe_links = NULL, .objects = NULL,
-      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES},
-    { .thread_name = "vfs", .config_name = "vfs", .enabled = 0, .start_routine = ebpf_vfs_thread,
+      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES, .lifetime = EBPF_DEFAULT_LIFETIME, .running_time = 0},
+    { .thread_name = "vfs", .config_name = "vfs", .thread_description = NETDATA_EBPF_VFS_MODULE_DESC,
+      .enabled = 0, .start_routine = ebpf_vfs_thread,
       .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
       .apps_level = NETDATA_APPS_LEVEL_REAL_PARENT, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
       .apps_routine = ebpf_vfs_create_apps_charts, .maps = NULL,
@@ -111,32 +120,36 @@ ebpf_module_t ebpf_modules[] = {
       .config_file = NETDATA_DIRECTORY_VFS_CONFIG_FILE,
       .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4 | NETDATA_V5_14,
       .load = EBPF_LOAD_LEGACY, .targets = vfs_targets, .probe_links = NULL, .objects = NULL,
-      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES},
-    { .thread_name = "filesystem", .config_name = "filesystem", .enabled = 0, .start_routine = ebpf_filesystem_thread,
+      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES, .lifetime = EBPF_DEFAULT_LIFETIME, .running_time = 0},
+    { .thread_name = "filesystem", .config_name = "filesystem", .thread_description = NETDATA_EBPF_FS_MODULE_DESC,
+      .enabled = 0, .start_routine = ebpf_filesystem_thread,
       .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
       .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
       .apps_routine = NULL, .maps = NULL, .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &fs_config,
       .config_file = NETDATA_FILESYSTEM_CONFIG_FILE,
       //We are setting kernels as zero, because we load eBPF programs according the kernel running.
       .kernels = 0, .load = EBPF_LOAD_LEGACY, .targets = NULL, .probe_links = NULL, .objects = NULL,
-      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES },
-    { .thread_name = "disk", .config_name = "disk", .enabled = 0, .start_routine = ebpf_disk_thread,
+      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES, .lifetime = EBPF_DEFAULT_LIFETIME, .running_time = 0},
+    { .thread_name = "disk", .config_name = "disk", .thread_description = NETDATA_EBPF_DISK_MODULE_DESC,
+      .enabled = 0, .start_routine = ebpf_disk_thread,
       .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
       .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
       .apps_routine = NULL, .maps = NULL, .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &disk_config,
       .config_file = NETDATA_DISK_CONFIG_FILE,
       .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4 | NETDATA_V5_14,
       .load = EBPF_LOAD_LEGACY, .targets = NULL, .probe_links = NULL, .objects = NULL,
-      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES},
-    { .thread_name = "mount", .config_name = "mount", .enabled = 0, .start_routine = ebpf_mount_thread,
+      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES, .lifetime = EBPF_DEFAULT_LIFETIME, .running_time = 0},
+    { .thread_name = "mount", .config_name = "mount", .thread_description = NETDATA_EBPF_MOUNT_MODULE_DESC,
+      .enabled = 0, .start_routine = ebpf_mount_thread,
       .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
       .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
       .apps_routine = NULL, .maps = NULL, .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &mount_config,
       .config_file = NETDATA_MOUNT_CONFIG_FILE,
       .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4 | NETDATA_V5_14,
       .load = EBPF_LOAD_LEGACY, .targets = mount_targets, .probe_links = NULL, .objects = NULL,
-      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES},
-    { .thread_name = "fd", .config_name = "fd", .enabled = 0, .start_routine = ebpf_fd_thread,
+      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES, .lifetime = EBPF_DEFAULT_LIFETIME, .running_time = 0},
+    { .thread_name = "fd", .config_name = "fd", .thread_description = NETDATA_EBPF_FD_MODULE_DESC,
+      .enabled = 0, .start_routine = ebpf_fd_thread,
       .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
       .apps_level = NETDATA_APPS_LEVEL_REAL_PARENT, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
       .apps_routine = ebpf_fd_create_apps_charts, .maps = NULL,
@@ -145,24 +158,27 @@ ebpf_module_t ebpf_modules[] = {
       .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4 | NETDATA_V5_11 |
                   NETDATA_V5_14,
       .load = EBPF_LOAD_LEGACY, .targets = fd_targets, .probe_links = NULL, .objects = NULL,
-      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES},
-    { .thread_name = "hardirq", .config_name = "hardirq", .enabled = 0, .start_routine = ebpf_hardirq_thread,
+      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES, .lifetime = EBPF_DEFAULT_LIFETIME, .running_time = 0},
+    { .thread_name = "hardirq", .config_name = "hardirq", .thread_description = NETDATA_EBPF_HARDIRQ_MODULE_DESC,
+      .enabled = 0, .start_routine = ebpf_hardirq_thread,
       .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
       .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
       .apps_routine = NULL, .maps = NULL, .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &hardirq_config,
       .config_file = NETDATA_HARDIRQ_CONFIG_FILE,
       .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4 | NETDATA_V5_14,
       .load = EBPF_LOAD_LEGACY, .targets = NULL, .probe_links = NULL, .objects = NULL,
-      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES},
-    { .thread_name = "softirq", .config_name = "softirq", .enabled = 0, .start_routine = ebpf_softirq_thread,
+      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES, .lifetime = EBPF_DEFAULT_LIFETIME, .running_time = 0},
+    { .thread_name = "softirq", .config_name = "softirq", .thread_description = NETDATA_EBPF_SOFTIRQ_MODULE_DESC,
+      .enabled = 0, .start_routine = ebpf_softirq_thread,
       .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
       .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
       .apps_routine = NULL, .maps = NULL, .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &softirq_config,
       .config_file = NETDATA_SOFTIRQ_CONFIG_FILE,
       .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4 | NETDATA_V5_14,
       .load = EBPF_LOAD_LEGACY, .targets = NULL, .probe_links = NULL, .objects = NULL,
-      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES},
-    { .thread_name = "oomkill", .config_name = "oomkill", .enabled = 0, .start_routine = ebpf_oomkill_thread,
+      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES, .lifetime = EBPF_DEFAULT_LIFETIME, .running_time = 0},
+    { .thread_name = "oomkill", .config_name = "oomkill", .thread_description = NETDATA_EBPF_OOMKILL_MODULE_DESC,
+      .enabled = 0, .start_routine = ebpf_oomkill_thread,
       .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
       .apps_level = NETDATA_APPS_LEVEL_REAL_PARENT, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
       .apps_routine = ebpf_oomkill_create_apps_charts, .maps = NULL,
@@ -170,8 +186,9 @@ ebpf_module_t ebpf_modules[] = {
       .config_file = NETDATA_OOMKILL_CONFIG_FILE,
       .kernels =  NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4 | NETDATA_V5_14,
       .load = EBPF_LOAD_LEGACY, .targets = NULL, .probe_links = NULL, .objects = NULL,
-      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES},
-    { .thread_name = "shm", .config_name = "shm", .enabled = 0, .start_routine = ebpf_shm_thread,
+      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES, .lifetime = EBPF_DEFAULT_LIFETIME, .running_time = 0},
+    { .thread_name = "shm", .config_name = "shm", .thread_description = NETDATA_EBPF_SHM_MODULE_DESC,
+      .enabled = 0, .start_routine = ebpf_shm_thread,
       .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
       .apps_level = NETDATA_APPS_LEVEL_REAL_PARENT, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
       .apps_routine = ebpf_shm_create_apps_charts, .maps = NULL,
@@ -179,15 +196,25 @@ ebpf_module_t ebpf_modules[] = {
       .config_file = NETDATA_DIRECTORY_SHM_CONFIG_FILE,
       .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4 | NETDATA_V5_14,
       .load = EBPF_LOAD_LEGACY, .targets = shm_targets, .probe_links = NULL, .objects = NULL,
-      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES},
-    { .thread_name = "mdflush", .config_name = "mdflush", .enabled = 0, .start_routine = ebpf_mdflush_thread,
+      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES, .lifetime = EBPF_DEFAULT_LIFETIME, .running_time = 0},
+    { .thread_name = "mdflush", .config_name = "mdflush", .thread_description = NETDATA_EBPF_MD_MODULE_DESC,
+      .enabled = 0, .start_routine = ebpf_mdflush_thread,
       .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
       .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
       .apps_routine = NULL, .maps = NULL, .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = &mdflush_config,
       .config_file = NETDATA_DIRECTORY_MDFLUSH_CONFIG_FILE,
       .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4 | NETDATA_V5_14,
+      .load = EBPF_LOAD_LEGACY, .targets = mdflush_targets, .probe_links = NULL, .objects = NULL,
+      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES, .lifetime = EBPF_DEFAULT_LIFETIME, .running_time = 0},
+    { .thread_name = "functions", .config_name = "functions", .thread_description = NETDATA_EBPF_FUNCTIONS_MODULE_DESC,
+      .enabled = 1, .start_routine = ebpf_function_thread,
+      .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
+      .apps_level = NETDATA_APPS_NOT_SET, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
+      .apps_routine = NULL, .maps = NULL, .pid_map_size = ND_EBPF_DEFAULT_PID_SIZE, .names = NULL, .cfg = NULL,
+      .config_file = NETDATA_DIRECTORY_FUNCTIONS_CONFIG_FILE,
+      .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4 | NETDATA_V5_14,
       .load = EBPF_LOAD_LEGACY, .targets = NULL, .probe_links = NULL, .objects = NULL,
-      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES},
+      .thread = NULL, .maps_per_core = CONFIG_BOOLEAN_YES, .lifetime = EBPF_DEFAULT_LIFETIME, .running_time = 0},
     { .thread_name = NULL, .enabled = 0, .start_routine = NULL, .update_every = EBPF_DEFAULT_UPDATE_EVERY,
       .global_charts = 0, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO, .apps_level = NETDATA_APPS_NOT_SET,
       .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0, .apps_routine = NULL, .maps = NULL,
@@ -357,6 +384,20 @@ struct netdata_static_thread ebpf_threads[] = {
         .start_routine = NULL
     },
     {
+        .name = "EBPF FUNCTIONS",
+        .config_section = NULL,
+        .config_name = NULL,
+        .env_name = NULL,
+#ifdef NETDATA_DEV_MODE
+        .enabled = 1,
+#else
+        .enabled = 0,
+#endif
+        .thread = NULL,
+        .init_routine = NULL,
+        .start_routine = NULL
+    },
+    {
         .name = NULL,
         .config_section = NULL,
         .config_name = NULL,
@@ -378,7 +419,13 @@ ebpf_filesystem_partitions_t localfs[] =
       .enabled = CONFIG_BOOLEAN_YES,
       .addresses = {.function = NULL, .addr = 0},
       .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4,
-      .fs_maps = NULL},
+      .fs_maps = NULL,
+      .fs_obj = NULL,
+      .functions = {  "ext4_file_read_iter",
+                      "ext4_file_write_iter",
+                      "ext4_file_open",
+                      "ext4_sync_file",
+                      NULL }},
      {.filesystem = "xfs",
       .optional_filesystem = NULL,
       .family = "xfs",
@@ -388,7 +435,13 @@ ebpf_filesystem_partitions_t localfs[] =
       .enabled = CONFIG_BOOLEAN_YES,
       .addresses = {.function = NULL, .addr = 0},
       .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4,
-      .fs_maps = NULL},
+      .fs_maps = NULL,
+      .fs_obj = NULL,
+      .functions = {  "xfs_file_read_iter",
+                      "xfs_file_write_iter",
+                      "xfs_file_open",
+                      "xfs_file_fsync",
+                      NULL }},
      {.filesystem = "nfs",
       .optional_filesystem = "nfs4",
       .family = "nfs",
@@ -398,7 +451,13 @@ ebpf_filesystem_partitions_t localfs[] =
       .enabled = CONFIG_BOOLEAN_YES,
       .addresses = {.function = NULL, .addr = 0},
       .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4,
-      .fs_maps = NULL},
+      .fs_maps = NULL,
+      .fs_obj = NULL,
+      .functions = {  "nfs_file_read",
+                      "nfs_file_write",
+                      "nfs_open",
+                      "nfs_getattr",
+                      NULL }}, // // "nfs4_file_open" - not present on all kernels
      {.filesystem = "zfs",
       .optional_filesystem = NULL,
       .family = "zfs",
@@ -408,7 +467,13 @@ ebpf_filesystem_partitions_t localfs[] =
       .enabled = CONFIG_BOOLEAN_YES,
       .addresses = {.function = NULL, .addr = 0},
       .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4,
-      .fs_maps = NULL},
+      .fs_maps = NULL,
+      .fs_obj = NULL,
+      .functions = {  "zpl_iter_read",
+                      "zpl_iter_write",
+                      "zpl_open",
+                      "zpl_fsync",
+                      NULL }},
      {.filesystem = "btrfs",
       .optional_filesystem = NULL,
       .family = "btrfs",
@@ -418,7 +483,13 @@ ebpf_filesystem_partitions_t localfs[] =
       .enabled = CONFIG_BOOLEAN_YES,
       .addresses = {.function = "btrfs_file_operations", .addr = 0},
       .kernels =  NETDATA_V3_10 | NETDATA_V4_14 | NETDATA_V4_16 | NETDATA_V4_18 | NETDATA_V5_4 | NETDATA_V5_10,
-      .fs_maps = NULL},
+      .fs_maps = NULL,
+      .fs_obj = NULL,
+      .functions = {  "btrfs_file_read_iter",
+                      "btrfs_file_write_iter",
+                      "btrfs_file_open",
+                      "btrfs_sync_file",
+                      NULL }},
      {.filesystem = NULL,
       .optional_filesystem = NULL,
       .family = NULL,
@@ -427,7 +498,7 @@ ebpf_filesystem_partitions_t localfs[] =
       .flags = NETDATA_FILESYSTEM_FLAG_NO_PARTITION,
       .enabled = CONFIG_BOOLEAN_YES,
       .addresses = {.function = NULL, .addr = 0},
-      .kernels = 0, .fs_maps = NULL}};
+      .kernels = 0, .fs_maps = NULL, .fs_obj = NULL}};
 
 ebpf_sync_syscalls_t local_syscalls[] = {
     {.syscall = NETDATA_SYSCALLS_SYNC, .enabled = CONFIG_BOOLEAN_YES, .objects = NULL, .probe_links = NULL,
@@ -493,7 +564,10 @@ ebpf_plugin_stats_t plugin_statistics = {.core = 0, .legacy = 0, .running = 0, .
 struct btf *default_btf = NULL;
 struct cachestat_bpf *cachestat_bpf_obj = NULL;
 struct dc_bpf *dc_bpf_obj = NULL;
+struct disk_bpf *disk_bpf_obj = NULL;
 struct fd_bpf *fd_bpf_obj = NULL;
+struct hardirq_bpf *hardirq_bpf_obj = NULL;
+struct mdflush_bpf *mdflush_bpf_obj = NULL;
 struct mount_bpf *mount_bpf_obj = NULL;
 struct shm_bpf *shm_bpf_obj = NULL;
 struct socket_bpf *socket_bpf_obj = NULL;
@@ -524,7 +598,7 @@ ARAL *ebpf_allocate_pid_aral(char *name, size_t size)
 {
     static size_t max_elements = NETDATA_EBPF_ALLOC_MAX_PID;
     if (max_elements < NETDATA_EBPF_ALLOC_MIN_ELEMENTS) {
-        error("Number of elements given is too small, adjusting it for %d", NETDATA_EBPF_ALLOC_MIN_ELEMENTS);
+        netdata_log_error("Number of elements given is too small, adjusting it for %d", NETDATA_EBPF_ALLOC_MIN_ELEMENTS);
         max_elements = NETDATA_EBPF_ALLOC_MIN_ELEMENTS;
     }
 
@@ -553,14 +627,14 @@ static inline void ebpf_check_before2go()
         int j;
         pthread_mutex_lock(&ebpf_exit_cleanup);
         for (j = 0; ebpf_modules[j].thread_name != NULL; j++) {
-            if (ebpf_modules[j].enabled == NETDATA_THREAD_EBPF_RUNNING)
+            if (ebpf_modules[j].enabled < NETDATA_THREAD_EBPF_STOPPING)
                 i++;
         }
         pthread_mutex_unlock(&ebpf_exit_cleanup);
     }
 
     if (i) {
-        error("eBPF cannot unload all threads on time, but it will go away");
+        netdata_log_error("eBPF cannot unload all threads on time, but it will go away");
     }
 }
 
@@ -581,10 +655,10 @@ static void ebpf_exit()
     char filename[FILENAME_MAX + 1];
     ebpf_pid_file(filename, FILENAME_MAX);
     if (unlink(filename))
-        error("Cannot remove PID file %s", filename);
+        netdata_log_error("Cannot remove PID file %s", filename);
 
 #ifdef NETDATA_INTERNAL_CHECKS
-    error("Good bye world! I was PID %d", main_thread_id);
+    netdata_log_error("Good bye world! I was PID %d", main_thread_id);
 #endif
     fprintf(stdout, "EXIT\n");
     fflush(stdout);
@@ -632,12 +706,12 @@ static void ebpf_unload_unique_maps()
     int i;
     for (i = 0; ebpf_modules[i].thread_name; i++) {
         // These threads are cleaned with other functions
-        if (i > EBPF_MODULE_SOCKET_IDX)
+        if (i != EBPF_MODULE_SOCKET_IDX)
             continue;
 
         if (ebpf_modules[i].enabled != NETDATA_THREAD_EBPF_STOPPED) {
             if (ebpf_modules[i].enabled != NETDATA_THREAD_EBPF_NOT_RUNNING)
-                error("Cannot unload maps for thread %s, because it is not stopped.", ebpf_modules[i].thread_name);
+                netdata_log_error("Cannot unload maps for thread %s, because it is not stopped.", ebpf_modules[i].thread_name);
 
             continue;
         }
@@ -647,13 +721,10 @@ static void ebpf_unload_unique_maps()
             continue;
         }
 
-        if (i == EBPF_MODULE_SOCKET_IDX) {
 #ifdef LIBBPF_MAJOR_VERSION
-            if (socket_bpf_obj)
-                socket_bpf__destroy(socket_bpf_obj);
+        if (socket_bpf_obj)
+            socket_bpf__destroy(socket_bpf_obj);
 #endif
-        }
-
     }
 }
 
@@ -665,7 +736,7 @@ static void ebpf_unload_unique_maps()
 static void ebpf_unload_filesystems()
 {
     if (ebpf_modules[EBPF_MODULE_FILESYSTEM_IDX].enabled == NETDATA_THREAD_EBPF_NOT_RUNNING ||
-        ebpf_modules[EBPF_MODULE_FILESYSTEM_IDX].enabled == NETDATA_THREAD_EBPF_RUNNING ||
+        ebpf_modules[EBPF_MODULE_FILESYSTEM_IDX].enabled < NETDATA_THREAD_EBPF_STOPPING ||
         ebpf_modules[EBPF_MODULE_FILESYSTEM_IDX].load != EBPF_LOAD_LEGACY)
         return;
 
@@ -686,7 +757,7 @@ static void ebpf_unload_filesystems()
 static void ebpf_unload_sync()
 {
     if (ebpf_modules[EBPF_MODULE_SYNC_IDX].enabled == NETDATA_THREAD_EBPF_NOT_RUNNING ||
-        ebpf_modules[EBPF_MODULE_SYNC_IDX].enabled == NETDATA_THREAD_EBPF_RUNNING)
+    ebpf_modules[EBPF_MODULE_SYNC_IDX].enabled < NETDATA_THREAD_EBPF_STOPPING)
         return;
 
     int i;
@@ -724,10 +795,10 @@ static void ebpf_stop_threads(int sig)
     only_one = 1;
     int i;
     for (i = 0; ebpf_modules[i].thread_name != NULL; i++) {
-        if (ebpf_modules[i].enabled == NETDATA_THREAD_EBPF_RUNNING) {
+        if (ebpf_modules[i].enabled < NETDATA_THREAD_EBPF_STOPPING) {
             netdata_thread_cancel(*ebpf_modules[i].thread->thread);
 #ifdef NETDATA_DEV_MODE
-            info("Sending cancel for thread %s", ebpf_modules[i].thread_name);
+            netdata_log_info("Sending cancel for thread %s", ebpf_modules[i].thread_name);
 #endif
         }
     }
@@ -736,7 +807,7 @@ static void ebpf_stop_threads(int sig)
     pthread_mutex_lock(&mutex_cgroup_shm);
     netdata_thread_cancel(*cgroup_integration_thread.thread);
 #ifdef NETDATA_DEV_MODE
-    info("Sending cancel for thread %s", cgroup_integration_thread.name);
+    netdata_log_info("Sending cancel for thread %s", cgroup_integration_thread.name);
 #endif
     pthread_mutex_unlock(&mutex_cgroup_shm);
 
@@ -760,6 +831,19 @@ static void ebpf_stop_threads(int sig)
  *****************************************************************/
 
 /**
+ * Create apps for module
+ *
+ * Create apps chart that will be used with specific module
+ *
+ * @param em     the module main structure.
+ * @param root   a pointer for the targets.
+ */
+static inline void ebpf_create_apps_for_module(ebpf_module_t *em, struct ebpf_target *root) {
+    if (em->enabled < NETDATA_THREAD_EBPF_STOPPING && em->apps_charts && em->apps_routine)
+        em->apps_routine(em, root);
+}
+
+/**
  * Create apps charts
  *
  * Call ebpf_create_chart to create the charts on apps submenu.
@@ -800,14 +884,21 @@ static void ebpf_create_apps_charts(struct ebpf_target *root)
         }
     }
 
-    if (!newly_added)
+    int i;
+    if (!newly_added) {
+        for (i = 0; i < EBPF_MODULE_FUNCTION_IDX ; i++) {
+            ebpf_module_t *current = &ebpf_modules[i];
+            if (current->apps_charts & NETDATA_EBPF_APPS_FLAG_CHART_CREATED)
+                continue;
+
+            ebpf_create_apps_for_module(current, root);
+        }
         return;
+    }
 
-    int counter;
-    for (counter = 0; ebpf_modules[counter].thread_name; counter++) {
-        ebpf_module_t *current = &ebpf_modules[counter];
-        if (current->enabled == NETDATA_THREAD_EBPF_RUNNING && current->apps_charts && current->apps_routine)
-            current->apps_routine(current, root);
+    for (i = 0; i < EBPF_MODULE_FUNCTION_IDX ; i++) {
+        ebpf_module_t *current = &ebpf_modules[i];
+        ebpf_create_apps_for_module(current, root);
     }
 }
 
@@ -1136,7 +1227,7 @@ void write_histogram_chart(char *family, char *name, const netdata_idx_t *hist,
  * @param name    the name used to create aral
  * @param em      a pointer to the structure with the default values.
  */
-void ebpf_statistic_create_aral_chart(char *name, ebpf_module_t *em)
+int ebpf_statistic_create_aral_chart(char *name, ebpf_module_t *em)
 {
     static int priority = 140100;
     char *mem = { NETDATA_EBPF_STAT_DIMENSION_MEMORY };
@@ -1174,6 +1265,40 @@ void ebpf_statistic_create_aral_chart(char *name, ebpf_module_t *em)
     ebpf_write_global_dimension(aral,
                                 aral,
                                 ebpf_algorithms[NETDATA_EBPF_ABSOLUTE_IDX]);
+
+    return priority - 2;
+}
+
+/**
+ * ARAL Charts
+ *
+ * Add chart to monitor ARAL usage
+ * Caller must call this function with mutex locked.
+ *
+ * @param em      a pointer to the structure with the default values.
+ * @param prio    the initial priority used to disable charts.
+ */
+void ebpf_statistic_obsolete_aral_chart(ebpf_module_t *em, int prio)
+{
+    ebpf_write_chart_obsolete(NETDATA_MONITORING_FAMILY,
+                              em->memory_allocations,
+                              "Calls to allocate memory.",
+                              "calls",
+                              NETDATA_EBPF_FAMILY,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              "netdata.ebpf_aral_stat_alloc",
+                              prio++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_MONITORING_FAMILY,
+                              em->memory_allocations,
+                              "Calls to allocate memory.",
+                              "calls",
+                              NETDATA_EBPF_FAMILY,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              "netdata.ebpf_aral_stat_alloc",
+                              prio++,
+                              em->update_every);
 }
 
 /**
@@ -1247,7 +1372,7 @@ void ebpf_global_labels(netdata_syscall_stat_t *is, netdata_publish_syscall_t *p
 static inline void ebpf_set_thread_mode(netdata_run_mode_t lmode)
 {
     int i;
-    for (i = 0; ebpf_modules[i].thread_name; i++) {
+    for (i = 0; i < EBPF_MODULE_FUNCTION_IDX; i++) {
         ebpf_modules[i].mode = lmode;
     }
 }
@@ -1256,16 +1381,15 @@ static inline void ebpf_set_thread_mode(netdata_run_mode_t lmode)
  * Enable specific charts selected by user.
  *
  * @param em             the structure that will be changed
- * @param disable_apps   the status about the apps charts.
  * @param disable_cgroup the status about the cgroups charts.
  */
-static inline void ebpf_enable_specific_chart(struct ebpf_module *em, int disable_apps, int disable_cgroup)
+static inline void ebpf_enable_specific_chart(struct ebpf_module *em, int disable_cgroup)
 {
     em->enabled = CONFIG_BOOLEAN_YES;
 
     // oomkill stores data inside apps submenu, so it always need to have apps_enabled for plugin to create
     // its chart, without this comparison eBPF.plugin will try to store invalid data when apps is disabled.
-    if (!disable_apps || !strcmp(em->thread_name, "oomkill")) {
+    if (!strcmp(em->thread_name, "oomkill")) {
         em->apps_charts = NETDATA_EBPF_APPS_FLAG_YES;
     }
 
@@ -1277,20 +1401,6 @@ static inline void ebpf_enable_specific_chart(struct ebpf_module *em, int disabl
 }
 
 /**
- * Enable all charts
- *
- * @param apps    what is the current status of apps
- * @param cgroups what is the current status of cgroups
- */
-static inline void ebpf_enable_all_charts(int apps, int cgroups)
-{
-    int i;
-    for (i = 0; ebpf_modules[i].thread_name; i++) {
-        ebpf_enable_specific_chart(&ebpf_modules[i], apps, cgroups);
-    }
-}
-
-/**
  * Disable all Global charts
  *
  * Disable charts
@@ -1304,38 +1414,23 @@ static inline void disable_all_global_charts()
     }
 }
 
-
 /**
  * Enable the specified chart group
  *
  * @param idx            the index of ebpf_modules that I am enabling
- * @param disable_apps   should I keep apps charts?
  */
-static inline void ebpf_enable_chart(int idx, int disable_apps, int disable_cgroup)
+static inline void ebpf_enable_chart(int idx, int disable_cgroup)
 {
     int i;
     for (i = 0; ebpf_modules[i].thread_name; i++) {
         if (i == idx) {
-            ebpf_enable_specific_chart(&ebpf_modules[i], disable_apps, disable_cgroup);
+            ebpf_enable_specific_chart(&ebpf_modules[i], disable_cgroup);
             break;
         }
     }
 }
 
 /**
- * Disable APPs
- *
- * Disable charts for apps loading only global charts.
- */
-static inline void ebpf_disable_apps()
-{
-    int i;
-    for (i = 0; ebpf_modules[i].thread_name; i++) {
-        ebpf_modules[i].apps_charts = NETDATA_EBPF_APPS_FLAG_NO;
-    }
-}
-
-/**
  * Disable Cgroups
  *
  * Disable charts for apps loading only global charts.
@@ -1508,8 +1603,7 @@ uint32_t ebpf_enable_tracepoints(ebpf_tracepoint_t *tps)
     uint32_t cnt = 0;
     for (int i = 0; tps[i].class != NULL; i++) {
         if (ebpf_enable_tracepoint(&tps[i]) == -1) {
-            infoerr("failed to enable tracepoint %s:%s",
-                tps[i].class, tps[i].event);
+            netdata_log_error("Failed to enable tracepoint %s:%s", tps[i].class, tps[i].event);
         }
         else {
             cnt += 1;
@@ -1572,7 +1666,7 @@ static void read_local_addresses()
 {
     struct ifaddrs *ifaddr, *ifa;
     if (getifaddrs(&ifaddr) == -1) {
-        error("Cannot get the local IP addresses, it is no possible to do separation between inbound and outbound connections");
+        netdata_log_error("Cannot get the local IP addresses, it is no possible to do separation between inbound and outbound connections");
         return;
     }
 
@@ -1639,32 +1733,10 @@ void ebpf_start_pthread_variables()
 }
 
 /**
- * Am I collecting PIDs?
- *
- * Test if eBPF plugin needs to collect PID information.
- *
- * @return It returns 1 if at least one thread needs to collect the data, or zero otherwise.
- */
-static inline uint32_t ebpf_am_i_collect_pids()
-{
-    uint32_t ret = 0;
-    int i;
-    for (i = 0; ebpf_modules[i].thread_name; i++) {
-        ret |= ebpf_modules[i].cgroup_charts | (ebpf_modules[i].apps_charts & NETDATA_EBPF_APPS_FLAG_YES);
-    }
-
-    return ret;
-}
-
-/**
  * Allocate the vectors used for all threads.
  */
 static void ebpf_allocate_common_vectors()
 {
-    if (unlikely(!ebpf_am_i_collect_pids())) {
-        return;
-    }
-
     ebpf_all_pids = callocz((size_t)pid_max, sizeof(struct ebpf_pid_stat *));
     ebpf_aral_init();
 }
@@ -1674,17 +1746,31 @@ static void ebpf_allocate_common_vectors()
  *
  * @param ptr the option given by users
  */
-static inline void how_to_load(char *ptr)
+static inline void ebpf_how_to_load(char *ptr)
 {
     if (!strcasecmp(ptr, EBPF_CFG_LOAD_MODE_RETURN))
         ebpf_set_thread_mode(MODE_RETURN);
     else if (!strcasecmp(ptr, EBPF_CFG_LOAD_MODE_DEFAULT))
         ebpf_set_thread_mode(MODE_ENTRY);
     else
-        error("the option %s for \"ebpf load mode\" is not a valid option.", ptr);
+        netdata_log_error("the option %s for \"ebpf load mode\" is not a valid option.", ptr);
 }
 
 /**
+ * Define whether we should have charts for apps
+ *
+ * @param lmode  the mode that will be used for them.
+ */
+static inline void ebpf_set_apps_mode(netdata_apps_integration_flags_t value)
+{
+    int i;
+    for (i = 0; i < EBPF_MODULE_FUNCTION_IDX; i++) {
+        ebpf_modules[i].apps_charts = value;
+    }
+}
+
+
+/**
  * Update interval
  *
  * Update default interval with value from user
@@ -1717,6 +1803,21 @@ static void ebpf_update_table_size()
 }
 
 /**
+ * Update lifetime
+ *
+ * Update the period of time that specific thread will run
+ */
+static void ebpf_update_lifetime()
+{
+    int i;
+    uint32_t value = (uint32_t) appconfig_get_number(&collector_config, EBPF_GLOBAL_SECTION,
+                                                     EBPF_CFG_LIFETIME, EBPF_DEFAULT_LIFETIME);
+    for (i = 0; ebpf_modules[i].thread_name; i++) {
+        ebpf_modules[i].lifetime = value;
+    }
+}
+
+/**
  * Set Load mode
  *
  * @param origin specify the configuration file loaded
@@ -1761,12 +1862,11 @@ static void ebpf_update_map_per_core()
 /**
  * Read collector values
  *
- * @param disable_apps    variable to store information related to apps.
  * @param disable_cgroups variable to store information related to cgroups.
  * @param update_every    value to overwrite the update frequency set by the server.
  * @param origin          specify the configuration file loaded
  */
-static void read_collector_values(int *disable_apps, int *disable_cgroups,
+static void read_collector_values(int *disable_cgroups,
                                   int update_every, netdata_ebpf_load_mode_t origin)
 {
     // Read global section
@@ -1778,7 +1878,7 @@ static void read_collector_values(int *disable_apps, int *disable_cgroups,
         value = appconfig_get(&collector_config, EBPF_GLOBAL_SECTION, EBPF_CFG_LOAD_MODE,
                               EBPF_CFG_LOAD_MODE_DEFAULT);
 
-    how_to_load(value);
+    ebpf_how_to_load(value);
 
     btf_path = appconfig_get(&collector_config, EBPF_GLOBAL_SECTION, EBPF_CFG_PROGRAM_PATH,
                              EBPF_DEFAULT_BTF_PATH);
@@ -1795,6 +1895,8 @@ static void read_collector_values(int *disable_apps, int *disable_cgroups,
 
     ebpf_update_table_size();
 
+    ebpf_update_lifetime();
+
     // This is kept to keep compatibility
     uint32_t enabled = appconfig_get_boolean(&collector_config, EBPF_GLOBAL_SECTION, "disable apps",
                                              CONFIG_BOOLEAN_NO);
@@ -1804,7 +1906,8 @@ static void read_collector_values(int *disable_apps, int *disable_cgroups,
                                         CONFIG_BOOLEAN_YES);
         enabled =  (enabled == CONFIG_BOOLEAN_NO)?CONFIG_BOOLEAN_YES:CONFIG_BOOLEAN_NO;
     }
-    *disable_apps = (int)enabled;
+
+    ebpf_set_apps_mode(!enabled);
 
     // Cgroup is a positive sentence, so we need to invert the values to disable apps.
     // We are using the same pattern for cgroup and apps
@@ -1816,10 +1919,8 @@ static void read_collector_values(int *disable_apps, int *disable_cgroups,
     // Read ebpf programs section
     enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION,
                                     ebpf_modules[EBPF_MODULE_PROCESS_IDX].config_name, CONFIG_BOOLEAN_YES);
-    int started = 0;
     if (enabled) {
-        ebpf_enable_chart(EBPF_MODULE_PROCESS_IDX, *disable_apps, *disable_cgroups);
-        started++;
+        ebpf_enable_chart(EBPF_MODULE_PROCESS_IDX, *disable_cgroups);
     }
 
     // This is kept to keep compatibility
@@ -1830,8 +1931,7 @@ static void read_collector_values(int *disable_apps, int *disable_cgroups,
                                         ebpf_modules[EBPF_MODULE_SOCKET_IDX].config_name,
                                         CONFIG_BOOLEAN_NO);
     if (enabled) {
-        ebpf_enable_chart(EBPF_MODULE_SOCKET_IDX, *disable_apps, *disable_cgroups);
-        started++;
+        ebpf_enable_chart(EBPF_MODULE_SOCKET_IDX, *disable_cgroups);
     }
 
     // This is kept to keep compatibility
@@ -1843,123 +1943,98 @@ static void read_collector_values(int *disable_apps, int *disable_cgroups,
     network_viewer_opt.enabled = enabled;
     if (enabled) {
         if (!ebpf_modules[EBPF_MODULE_SOCKET_IDX].enabled)
-            ebpf_enable_chart(EBPF_MODULE_SOCKET_IDX, *disable_apps, *disable_cgroups);
+            ebpf_enable_chart(EBPF_MODULE_SOCKET_IDX, *disable_cgroups);
 
         // Read network viewer section if network viewer is enabled
         // This is kept here to keep backward compatibility
         parse_network_viewer_section(&collector_config);
         parse_service_name_section(&collector_config);
-        started++;
     }
 
     enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, "cachestat",
                                     CONFIG_BOOLEAN_NO);
 
     if (enabled) {
-        ebpf_enable_chart(EBPF_MODULE_CACHESTAT_IDX, *disable_apps, *disable_cgroups);
-        started++;
+        ebpf_enable_chart(EBPF_MODULE_CACHESTAT_IDX, *disable_cgroups);
     }
 
     enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, "sync",
                                     CONFIG_BOOLEAN_YES);
 
     if (enabled) {
-        ebpf_enable_chart(EBPF_MODULE_SYNC_IDX, *disable_apps, *disable_cgroups);
-        started++;
+        ebpf_enable_chart(EBPF_MODULE_SYNC_IDX, *disable_cgroups);
     }
 
     enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, "dcstat",
                                     CONFIG_BOOLEAN_NO);
     if (enabled) {
-        ebpf_enable_chart(EBPF_MODULE_DCSTAT_IDX, *disable_apps, *disable_cgroups);
-        started++;
+        ebpf_enable_chart(EBPF_MODULE_DCSTAT_IDX, *disable_cgroups);
     }
 
     enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, "swap",
                                     CONFIG_BOOLEAN_NO);
     if (enabled) {
-        ebpf_enable_chart(EBPF_MODULE_SWAP_IDX, *disable_apps, *disable_cgroups);
-        started++;
+        ebpf_enable_chart(EBPF_MODULE_SWAP_IDX, *disable_cgroups);
     }
 
     enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, "vfs",
                                     CONFIG_BOOLEAN_NO);
     if (enabled) {
-        ebpf_enable_chart(EBPF_MODULE_VFS_IDX, *disable_apps, *disable_cgroups);
-        started++;
+        ebpf_enable_chart(EBPF_MODULE_VFS_IDX, *disable_cgroups);
     }
 
     enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, "filesystem",
                                     CONFIG_BOOLEAN_NO);
     if (enabled) {
-        ebpf_enable_chart(EBPF_MODULE_FILESYSTEM_IDX, *disable_apps, *disable_cgroups);
-        started++;
+        ebpf_enable_chart(EBPF_MODULE_FILESYSTEM_IDX, *disable_cgroups);
     }
 
     enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, "disk",
                                     CONFIG_BOOLEAN_NO);
     if (enabled) {
-        ebpf_enable_chart(EBPF_MODULE_DISK_IDX, *disable_apps, *disable_cgroups);
-        started++;
+        ebpf_enable_chart(EBPF_MODULE_DISK_IDX, *disable_cgroups);
     }
 
     enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, "mount",
                                     CONFIG_BOOLEAN_YES);
     if (enabled) {
-        ebpf_enable_chart(EBPF_MODULE_MOUNT_IDX, *disable_apps, *disable_cgroups);
-        started++;
+        ebpf_enable_chart(EBPF_MODULE_MOUNT_IDX, *disable_cgroups);
     }
 
     enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, "fd",
                                     CONFIG_BOOLEAN_YES);
     if (enabled) {
-        ebpf_enable_chart(EBPF_MODULE_FD_IDX, *disable_apps, *disable_cgroups);
-        started++;
+        ebpf_enable_chart(EBPF_MODULE_FD_IDX, *disable_cgroups);
     }
 
     enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, "hardirq",
                                     CONFIG_BOOLEAN_YES);
     if (enabled) {
-        ebpf_enable_chart(EBPF_MODULE_HARDIRQ_IDX, *disable_apps, *disable_cgroups);
-        started++;
+        ebpf_enable_chart(EBPF_MODULE_HARDIRQ_IDX, *disable_cgroups);
     }
 
     enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, "softirq",
                                     CONFIG_BOOLEAN_YES);
     if (enabled) {
-        ebpf_enable_chart(EBPF_MODULE_SOFTIRQ_IDX, *disable_apps, *disable_cgroups);
-        started++;
+        ebpf_enable_chart(EBPF_MODULE_SOFTIRQ_IDX, *disable_cgroups);
     }
 
     enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, "oomkill",
                                     CONFIG_BOOLEAN_YES);
     if (enabled) {
-        ebpf_enable_chart(EBPF_MODULE_OOMKILL_IDX, *disable_apps, *disable_cgroups);
-        started++;
+        ebpf_enable_chart(EBPF_MODULE_OOMKILL_IDX, *disable_cgroups);
     }
 
     enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, "shm",
                                     CONFIG_BOOLEAN_YES);
     if (enabled) {
-        ebpf_enable_chart(EBPF_MODULE_SHM_IDX, *disable_apps, *disable_cgroups);
-        started++;
+        ebpf_enable_chart(EBPF_MODULE_SHM_IDX, *disable_cgroups);
     }
 
     enabled = appconfig_get_boolean(&collector_config, EBPF_PROGRAMS_SECTION, "mdflush",
                                     CONFIG_BOOLEAN_NO);
     if (enabled) {
-        ebpf_enable_chart(EBPF_MODULE_MDFLUSH_IDX, *disable_apps, *disable_cgroups);
-        started++;
-    }
-
-    if (!started){
-        ebpf_enable_all_charts(*disable_apps, *disable_cgroups);
-        // Read network viewer section
-        // This is kept here to keep backward compatibility
-        if (network_viewer_opt.enabled) {
-            parse_network_viewer_section(&collector_config);
-            parse_service_name_section(&collector_config);
-        }
+        ebpf_enable_chart(EBPF_MODULE_MDFLUSH_IDX, *disable_cgroups);
     }
 }
 
@@ -1967,13 +2042,12 @@ static void read_collector_values(int *disable_apps, int *disable_cgroups,
  * Load collector config
  *
  * @param path             the path where the file ebpf.conf is stored.
- * @param disable_apps     variable to store the information about apps plugin status.
  * @param disable_cgroups  variable to store the information about cgroups plugin status.
  * @param update_every value to overwrite the update frequency set by the server.
  *
  * @return 0 on success and -1 otherwise.
  */
-static int load_collector_config(char *path, int *disable_apps, int *disable_cgroups, int update_every)
+static int ebpf_load_collector_config(char *path, int *disable_cgroups, int update_every)
 {
     char lpath[4096];
     netdata_ebpf_load_mode_t origin;
@@ -1988,7 +2062,7 @@ static int load_collector_config(char *path, int *disable_apps, int *disable_cgr
     } else
         origin = EBPF_LOADED_FROM_USER;
 
-    read_collector_values(disable_apps, disable_cgroups, update_every, origin);
+    read_collector_values(disable_cgroups, update_every, origin);
 
     return 0;
 }
@@ -2018,7 +2092,7 @@ void set_global_variables()
     ebpf_nprocs = (int)sysconf(_SC_NPROCESSORS_ONLN);
     if (ebpf_nprocs < 0) {
         ebpf_nprocs = NETDATA_MAX_PROCESSOR;
-        error("Cannot identify number of process, using default value %d", ebpf_nprocs);
+        netdata_log_error("Cannot identify number of process, using default value %d", ebpf_nprocs);
     }
 
     isrh = get_redhat_release();
@@ -2032,7 +2106,7 @@ void set_global_variables()
 static inline void ebpf_load_thread_config()
 {
     int i;
-    for (i = 0; ebpf_modules[i].thread_name; i++) {
+    for (i = 0; i < EBPF_MODULE_FUNCTION_IDX; i++) {
         ebpf_update_module(&ebpf_modules[i], default_btf, running_on_kernel, isrh);
     }
 }
@@ -2047,12 +2121,12 @@ static inline void ebpf_load_thread_config()
 int ebpf_check_conditions()
 {
     if (!has_condition_to_run(running_on_kernel)) {
-        error("The current collector cannot run on this kernel.");
+        netdata_log_error("The current collector cannot run on this kernel.");
         return -1;
     }
 
     if (!am_i_running_as_root()) {
-        error(
+        netdata_log_error(
             "ebpf.plugin should either run as root (now running with uid %u, euid %u) or have special capabilities..",
             (unsigned int)getuid(), (unsigned int)geteuid());
         return -1;
@@ -2072,7 +2146,7 @@ int ebpf_adjust_memory_limit()
 {
     struct rlimit r = { RLIM_INFINITY, RLIM_INFINITY };
     if (setrlimit(RLIMIT_MEMLOCK, &r)) {
-        error("Setrlimit(RLIMIT_MEMLOCK)");
+        netdata_log_error("Setrlimit(RLIMIT_MEMLOCK)");
         return -1;
     }
 
@@ -2087,7 +2161,6 @@ int ebpf_adjust_memory_limit()
  */
 static void ebpf_parse_args(int argc, char **argv)
 {
-    int disable_apps = 0;
     int disable_cgroups = 1;
     int freq = 0;
     int option_index = 0;
@@ -2134,12 +2207,12 @@ static void ebpf_parse_args(int argc, char **argv)
     if (!freq)
         freq = EBPF_DEFAULT_UPDATE_EVERY;
 
-    if (load_collector_config(ebpf_user_config_dir, &disable_apps, &disable_cgroups, freq)) {
-        info(
+    if (ebpf_load_collector_config(ebpf_user_config_dir, &disable_cgroups, freq)) {
+        netdata_log_info(
             "Does not have a configuration file inside `%s/ebpf.d.conf. It will try to load stock file.",
             ebpf_user_config_dir);
-        if (load_collector_config(ebpf_stock_config_dir, &disable_apps, &disable_cgroups, freq)) {
-            info("Does not have a stock file. It is starting with default options.");
+        if (ebpf_load_collector_config(ebpf_stock_config_dir, &disable_cgroups, freq)) {
+            netdata_log_info("Does not have a stock file. It is starting with default options.");
         }
     }
 
@@ -2154,120 +2227,120 @@ static void ebpf_parse_args(int argc, char **argv)
             case EBPF_MODULE_PROCESS_IDX: {
                 select_threads |= 1<<EBPF_MODULE_PROCESS_IDX;
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF enabling \"PROCESS\" charts, because it was started with the option \"[-]-process\".");
+                netdata_log_info("EBPF enabling \"PROCESS\" charts, because it was started with the option \"[-]-process\".");
 #endif
                 break;
             }
             case EBPF_MODULE_SOCKET_IDX: {
                 select_threads |= 1<<EBPF_MODULE_SOCKET_IDX;
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF enabling \"NET\" charts, because it was started with the option \"[-]-net\".");
+                netdata_log_info("EBPF enabling \"NET\" charts, because it was started with the option \"[-]-net\".");
 #endif
                 break;
             }
             case EBPF_MODULE_CACHESTAT_IDX: {
                 select_threads |= 1<<EBPF_MODULE_CACHESTAT_IDX;
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF enabling \"CACHESTAT\" charts, because it was started with the option \"[-]-cachestat\".");
+                netdata_log_info("EBPF enabling \"CACHESTAT\" charts, because it was started with the option \"[-]-cachestat\".");
 #endif
                 break;
             }
             case EBPF_MODULE_SYNC_IDX: {
                 select_threads |= 1<<EBPF_MODULE_SYNC_IDX;
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF enabling \"SYNC\" chart, because it was started with the option \"[-]-sync\".");
+                netdata_log_info("EBPF enabling \"SYNC\" chart, because it was started with the option \"[-]-sync\".");
 #endif
                 break;
             }
             case EBPF_MODULE_DCSTAT_IDX: {
                 select_threads |= 1<<EBPF_MODULE_DCSTAT_IDX;
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF enabling \"DCSTAT\" charts, because it was started with the option \"[-]-dcstat\".");
+                netdata_log_info("EBPF enabling \"DCSTAT\" charts, because it was started with the option \"[-]-dcstat\".");
 #endif
                 break;
             }
             case EBPF_MODULE_SWAP_IDX: {
                 select_threads |= 1<<EBPF_MODULE_SWAP_IDX;
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF enabling \"SWAP\" chart, because it was started with the option \"[-]-swap\".");
+                netdata_log_info("EBPF enabling \"SWAP\" chart, because it was started with the option \"[-]-swap\".");
 #endif
                 break;
             }
             case EBPF_MODULE_VFS_IDX: {
                 select_threads |= 1<<EBPF_MODULE_VFS_IDX;
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF enabling \"VFS\" chart, because it was started with the option \"[-]-vfs\".");
+                netdata_log_info("EBPF enabling \"VFS\" chart, because it was started with the option \"[-]-vfs\".");
 #endif
                 break;
             }
             case EBPF_MODULE_FILESYSTEM_IDX: {
                 select_threads |= 1<<EBPF_MODULE_FILESYSTEM_IDX;
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF enabling \"FILESYSTEM\" chart, because it was started with the option \"[-]-filesystem\".");
+                netdata_log_info("EBPF enabling \"FILESYSTEM\" chart, because it was started with the option \"[-]-filesystem\".");
 #endif
                 break;
             }
             case EBPF_MODULE_DISK_IDX: {
                 select_threads |= 1<<EBPF_MODULE_DISK_IDX;
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF enabling \"DISK\" chart, because it was started with the option \"[-]-disk\".");
+                netdata_log_info("EBPF enabling \"DISK\" chart, because it was started with the option \"[-]-disk\".");
 #endif
                 break;
             }
             case EBPF_MODULE_MOUNT_IDX: {
                 select_threads |= 1<<EBPF_MODULE_MOUNT_IDX;
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF enabling \"MOUNT\" chart, because it was started with the option \"[-]-mount\".");
+                netdata_log_info("EBPF enabling \"MOUNT\" chart, because it was started with the option \"[-]-mount\".");
 #endif
                 break;
             }
             case EBPF_MODULE_FD_IDX: {
                 select_threads |= 1<<EBPF_MODULE_FD_IDX;
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF enabling \"FILEDESCRIPTOR\" chart, because it was started with the option \"[-]-filedescriptor\".");
+                netdata_log_info("EBPF enabling \"FILEDESCRIPTOR\" chart, because it was started with the option \"[-]-filedescriptor\".");
 #endif
                 break;
             }
             case EBPF_MODULE_HARDIRQ_IDX: {
                 select_threads |= 1<<EBPF_MODULE_HARDIRQ_IDX;
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF enabling \"HARDIRQ\" chart, because it was started with the option \"[-]-hardirq\".");
+                netdata_log_info("EBPF enabling \"HARDIRQ\" chart, because it was started with the option \"[-]-hardirq\".");
 #endif
                 break;
             }
             case EBPF_MODULE_SOFTIRQ_IDX: {
                 select_threads |= 1<<EBPF_MODULE_SOFTIRQ_IDX;
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF enabling \"SOFTIRQ\" chart, because it was started with the option \"[-]-softirq\".");
+                netdata_log_info("EBPF enabling \"SOFTIRQ\" chart, because it was started with the option \"[-]-softirq\".");
 #endif
                 break;
             }
             case EBPF_MODULE_OOMKILL_IDX: {
                 select_threads |= 1<<EBPF_MODULE_OOMKILL_IDX;
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF enabling \"OOMKILL\" chart, because it was started with the option \"[-]-oomkill\".");
+                netdata_log_info("EBPF enabling \"OOMKILL\" chart, because it was started with the option \"[-]-oomkill\".");
 #endif
                 break;
             }
             case EBPF_MODULE_SHM_IDX: {
                 select_threads |= 1<<EBPF_MODULE_SHM_IDX;
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF enabling \"SHM\" chart, because it was started with the option \"[-]-shm\".");
+                netdata_log_info("EBPF enabling \"SHM\" chart, because it was started with the option \"[-]-shm\".");
 #endif
                 break;
             }
             case EBPF_MODULE_MDFLUSH_IDX: {
                 select_threads |= 1<<EBPF_MODULE_MDFLUSH_IDX;
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF enabling \"MDFLUSH\" chart, because it was started with the option \"[-]-mdflush\".");
+                netdata_log_info("EBPF enabling \"MDFLUSH\" chart, because it was started with the option \"[-]-mdflush\".");
 #endif
                 break;
             }
             case EBPF_OPTION_ALL_CHARTS: {
-                disable_apps = 0;
+                ebpf_set_apps_mode(NETDATA_EBPF_APPS_FLAG_YES);
                 disable_cgroups = 0;
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF running with all chart groups, because it was started with the option \"[-]-all\".");
+                netdata_log_info("EBPF running with all chart groups, because it was started with the option \"[-]-all\".");
 #endif
                 break;
             }
@@ -2280,31 +2353,30 @@ static void ebpf_parse_args(int argc, char **argv)
                 exit(0);
             }
             case EBPF_OPTION_GLOBAL_CHART: {
-                disable_apps = 1;
                 disable_cgroups = 1;
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF running with global chart group, because it was started with the option  \"[-]-global\".");
+                netdata_log_info("EBPF running with global chart group, because it was started with the option  \"[-]-global\".");
 #endif
                 break;
             }
             case EBPF_OPTION_RETURN_MODE: {
                 ebpf_set_thread_mode(MODE_RETURN);
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF running in \"RETURN\" mode, because it was started with the option \"[-]-return\".");
+                netdata_log_info("EBPF running in \"RETURN\" mode, because it was started with the option \"[-]-return\".");
 #endif
                 break;
             }
             case EBPF_OPTION_LEGACY: {
                 ebpf_set_load_mode(EBPF_LOAD_LEGACY, EBPF_LOADED_FROM_USER);
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF running with \"LEGACY\" code, because it was started with the option \"[-]-legacy\".");
+                netdata_log_info("EBPF running with \"LEGACY\" code, because it was started with the option \"[-]-legacy\".");
 #endif
                 break;
             }
             case EBPF_OPTION_CORE: {
                 ebpf_set_load_mode(EBPF_LOAD_CORE, EBPF_LOADED_FROM_USER);
 #ifdef NETDATA_INTERNAL_CHECKS
-                info("EBPF running with \"CO-RE\" code, because it was started with the option \"[-]-core\".");
+                netdata_log_info("EBPF running with \"CO-RE\" code, because it was started with the option \"[-]-core\".");
 #endif
                 break;
             }
@@ -2341,10 +2413,7 @@ unittest:
         }
     }
 
-    if (disable_apps || disable_cgroups) {
-        if (disable_apps)
-            ebpf_disable_apps();
-
+    if (disable_cgroups) {
         if (disable_cgroups)
             ebpf_disable_cgroups();
     }
@@ -2354,23 +2423,301 @@ unittest:
         uint64_t idx;
         for (idx = 0; idx < EBPF_OPTION_ALL_CHARTS; idx++) {
             if (select_threads & 1<<idx)
-                ebpf_enable_specific_chart(&ebpf_modules[idx], disable_apps, disable_cgroups);
+                ebpf_enable_specific_chart(&ebpf_modules[idx], disable_cgroups);
         }
     }
 
     // Load apps_groups.conf
     if (ebpf_read_apps_groups_conf(
             &apps_groups_default_target, &apps_groups_root_target, ebpf_user_config_dir, "groups")) {
-        info("Cannot read process groups configuration file '%s/apps_groups.conf'. Will try '%s/apps_groups.conf'",
+        netdata_log_info("Cannot read process groups configuration file '%s/apps_groups.conf'. Will try '%s/apps_groups.conf'",
              ebpf_user_config_dir, ebpf_stock_config_dir);
         if (ebpf_read_apps_groups_conf(
                 &apps_groups_default_target, &apps_groups_root_target, ebpf_stock_config_dir, "groups")) {
-            error("Cannot read process groups '%s/apps_groups.conf'. There are no internal defaults. Failing.",
+            netdata_log_error("Cannot read process groups '%s/apps_groups.conf'. There are no internal defaults. Failing.",
                   ebpf_stock_config_dir);
             ebpf_exit();
         }
     } else
-        info("Loaded config file '%s/apps_groups.conf'", ebpf_user_config_dir);
+        netdata_log_info("Loaded config file '%s/apps_groups.conf'", ebpf_user_config_dir);
+}
+
+/*****************************************************************
+ *
+ *  Collector charts
+ *
+ *****************************************************************/
+
+static char *load_event_stat[NETDATA_EBPF_LOAD_STAT_END] = {"legacy", "co-re"};
+static char *memlock_stat = {"memory_locked"};
+static char *hash_table_stat = {"hash_table"};
+static char *hash_table_core[NETDATA_EBPF_LOAD_STAT_END] = {"per_core", "unique"};
+
+/**
+ * Send Statistic Data
+ *
+ * Send statistic information to netdata.
+ */
+void ebpf_send_statistic_data()
+{
+    if (!publish_internal_metrics)
+        return;
+
+    write_begin_chart(NETDATA_MONITORING_FAMILY, NETDATA_EBPF_THREADS);
+    int i;
+    for (i = 0; i < EBPF_MODULE_FUNCTION_IDX; i++) {
+        ebpf_module_t *wem = &ebpf_modules[i];
+        write_chart_dimension((char *)wem->thread_name, (wem->enabled < NETDATA_THREAD_EBPF_STOPPING) ? 1 : 0);
+    }
+    write_end_chart();
+
+    write_begin_chart(NETDATA_MONITORING_FAMILY, NETDATA_EBPF_LIFE_TIME);
+    for (i = 0; i < EBPF_MODULE_FUNCTION_IDX ; i++) {
+        ebpf_module_t *wem = &ebpf_modules[i];
+        // Threads like VFS is slow to load and this can create an invalid number, this is the motive
+        // we are also testing wem->lifetime value.
+        write_chart_dimension((char *)wem->thread_name,
+                              (wem->lifetime && wem->enabled < NETDATA_THREAD_EBPF_STOPPING) ?
+                              (long long) (wem->lifetime - wem->running_time):
+                              0) ;
+    }
+    write_end_chart();
+
+    write_begin_chart(NETDATA_MONITORING_FAMILY, NETDATA_EBPF_LOAD_METHOD);
+    write_chart_dimension(load_event_stat[NETDATA_EBPF_LOAD_STAT_LEGACY], (long long)plugin_statistics.legacy);
+    write_chart_dimension(load_event_stat[NETDATA_EBPF_LOAD_STAT_CORE], (long long)plugin_statistics.core);
+    write_end_chart();
+
+    write_begin_chart(NETDATA_MONITORING_FAMILY, NETDATA_EBPF_KERNEL_MEMORY);
+    write_chart_dimension(memlock_stat, (long long)plugin_statistics.memlock_kern);
+    write_end_chart();
+
+    write_begin_chart(NETDATA_MONITORING_FAMILY, NETDATA_EBPF_HASH_TABLES_LOADED);
+    write_chart_dimension(hash_table_stat, (long long)plugin_statistics.hash_tables);
+    write_end_chart();
+
+    write_begin_chart(NETDATA_MONITORING_FAMILY, NETDATA_EBPF_HASH_TABLES_PER_CORE);
+    write_chart_dimension(hash_table_core[NETDATA_EBPF_THREAD_PER_CORE], (long long)plugin_statistics.hash_percpu);
+    write_chart_dimension(hash_table_core[NETDATA_EBPF_THREAD_UNIQUE], (long long)plugin_statistics.hash_unique);
+    write_end_chart();
+}
+
+/**
+ * Update Internal Metric variable
+ *
+ * By default eBPF.plugin sends internal metrics for netdata, but user can
+ * disable this.
+ *
+ * The function updates the variable used to send charts.
+ */
+static void update_internal_metric_variable()
+{
+    const char *s = getenv("NETDATA_INTERNALS_MONITORING");
+    if (s && *s && strcmp(s, "NO") == 0)
+        publish_internal_metrics = false;
+}
+
+/**
+ * Create chart for Statistic Thread
+ *
+ * Write to standard output current values for threads.
+ *
+ * @param update_every time used to update charts
+ */
+static inline void ebpf_create_statistic_thread_chart(int update_every)
+{
+    ebpf_write_chart_cmd(NETDATA_MONITORING_FAMILY,
+                         NETDATA_EBPF_THREADS,
+                         "Threads running.",
+                         "boolean",
+                         NETDATA_EBPF_FAMILY,
+                         NETDATA_EBPF_CHART_TYPE_LINE,
+                         NULL,
+                         NETDATA_EBPF_ORDER_STAT_THREADS,
+                         update_every,
+                         NETDATA_EBPF_MODULE_NAME_PROCESS);
+
+    int i;
+    for (i = 0; i < EBPF_MODULE_FUNCTION_IDX; i++) {
+        ebpf_write_global_dimension((char *)ebpf_modules[i].thread_name,
+                                    (char *)ebpf_modules[i].thread_name,
+                                    ebpf_algorithms[NETDATA_EBPF_ABSOLUTE_IDX]);
+    }
+}
+
+/**
+ * Create lifetime Thread Chart
+ *
+ * Write to standard output current values for threads lifetime.
+ *
+ * @param update_every time used to update charts
+ */
+static inline void ebpf_create_lifetime_thread_chart(int update_every)
+{
+    ebpf_write_chart_cmd(NETDATA_MONITORING_FAMILY,
+                         NETDATA_EBPF_LIFE_TIME,
+                         "Threads running.",
+                         "seconds",
+                         NETDATA_EBPF_FAMILY,
+                         NETDATA_EBPF_CHART_TYPE_LINE,
+                         NULL,
+                         NETDATA_EBPF_ORDER_STAT_LIFE_TIME,
+                         update_every,
+                         NETDATA_EBPF_MODULE_NAME_PROCESS);
+
+    int i;
+    for (i = 0; i < EBPF_MODULE_FUNCTION_IDX; i++) {
+        ebpf_write_global_dimension((char *)ebpf_modules[i].thread_name,
+                                    (char *)ebpf_modules[i].thread_name,
+                                    ebpf_algorithms[NETDATA_EBPF_ABSOLUTE_IDX]);
+    }
+}
+
+/**
+ * Create chart for Load Thread
+ *
+ * Write to standard output current values for load mode.
+ *
+ * @param update_every time used to update charts
+ */
+static inline void ebpf_create_statistic_load_chart(int update_every)
+{
+    ebpf_write_chart_cmd(NETDATA_MONITORING_FAMILY,
+                         NETDATA_EBPF_LOAD_METHOD,
+                         "Load info.",
+                         "methods",
+                         NETDATA_EBPF_FAMILY,
+                         NETDATA_EBPF_CHART_TYPE_LINE,
+                         NULL,
+                         NETDATA_EBPF_ORDER_STAT_LOAD_METHOD,
+                         update_every,
+                         NETDATA_EBPF_MODULE_NAME_PROCESS);
+
+    ebpf_write_global_dimension(load_event_stat[NETDATA_EBPF_LOAD_STAT_LEGACY],
+                                load_event_stat[NETDATA_EBPF_LOAD_STAT_LEGACY],
+                                ebpf_algorithms[NETDATA_EBPF_ABSOLUTE_IDX]);
+
+    ebpf_write_global_dimension(load_event_stat[NETDATA_EBPF_LOAD_STAT_CORE],
+                                load_event_stat[NETDATA_EBPF_LOAD_STAT_CORE],
+                                ebpf_algorithms[NETDATA_EBPF_ABSOLUTE_IDX]);
+}
+
+/**
+ * Create chart for Kernel Memory
+ *
+ * Write to standard output current values for allocated memory.
+ *
+ * @param update_every time used to update charts
+ */
+static inline void ebpf_create_statistic_kernel_memory(int update_every)
+{
+    ebpf_write_chart_cmd(NETDATA_MONITORING_FAMILY,
+                         NETDATA_EBPF_KERNEL_MEMORY,
+                         "Memory allocated for hash tables.",
+                         "bytes",
+                         NETDATA_EBPF_FAMILY,
+                         NETDATA_EBPF_CHART_TYPE_LINE,
+                         NULL,
+                         NETDATA_EBPF_ORDER_STAT_KERNEL_MEMORY,
+                         update_every,
+                         NETDATA_EBPF_MODULE_NAME_PROCESS);
+
+    ebpf_write_global_dimension(memlock_stat,
+                                memlock_stat,
+                                ebpf_algorithms[NETDATA_EBPF_ABSOLUTE_IDX]);
+}
+
+/**
+ * Create chart Hash Table
+ *
+ * Write to standard output number of hash tables used with this software.
+ *
+ * @param update_every time used to update charts
+ */
+static inline void ebpf_create_statistic_hash_tables(int update_every)
+{
+    ebpf_write_chart_cmd(NETDATA_MONITORING_FAMILY,
+                         NETDATA_EBPF_HASH_TABLES_LOADED,
+                         "Number of hash tables loaded.",
+                         "hash tables",
+                         NETDATA_EBPF_FAMILY,
+                         NETDATA_EBPF_CHART_TYPE_LINE,
+                         NULL,
+                         NETDATA_EBPF_ORDER_STAT_HASH_TABLES,
+                         update_every,
+                         NETDATA_EBPF_MODULE_NAME_PROCESS);
+
+    ebpf_write_global_dimension(hash_table_stat,
+                                hash_table_stat,
+                                ebpf_algorithms[NETDATA_EBPF_ABSOLUTE_IDX]);
+}
+
+/**
+ * Create chart for percpu stats
+ *
+ * Write to standard output current values for threads.
+ *
+ * @param update_every time used to update charts
+ */
+static inline void ebpf_create_statistic_hash_per_core(int update_every)
+{
+    ebpf_write_chart_cmd(NETDATA_MONITORING_FAMILY,
+                         NETDATA_EBPF_HASH_TABLES_PER_CORE,
+                         "How threads are loading hash/array tables.",
+                         "threads",
+                         NETDATA_EBPF_FAMILY,
+                         NETDATA_EBPF_CHART_TYPE_LINE,
+                         NULL,
+                         NETDATA_EBPF_ORDER_STAT_HASH_CORE,
+                         update_every,
+                         NETDATA_EBPF_MODULE_NAME_PROCESS);
+
+    ebpf_write_global_dimension(hash_table_core[NETDATA_EBPF_THREAD_PER_CORE],
+                                hash_table_core[NETDATA_EBPF_THREAD_PER_CORE],
+                                ebpf_algorithms[NETDATA_EBPF_ABSOLUTE_IDX]);
+
+    ebpf_write_global_dimension(hash_table_core[NETDATA_EBPF_THREAD_UNIQUE],
+                                hash_table_core[NETDATA_EBPF_THREAD_UNIQUE],
+                                ebpf_algorithms[NETDATA_EBPF_ABSOLUTE_IDX]);
+}
+
+
+/**
+ * Create Statistics Charts
+ *
+ * Create charts that will show statistics related to eBPF plugin.
+ *
+ * @param update_every time used to update charts
+ */
+static void ebpf_create_statistic_charts(int update_every)
+{
+    static char create_charts = 1;
+    update_internal_metric_variable();
+    if (!publish_internal_metrics)
+        return;
+
+    if (!create_charts)
+        return;
+
+    create_charts = 0;
+
+    ebpf_create_statistic_thread_chart(update_every);
+#ifdef NETDATA_DEV_MODE
+    EBPF_PLUGIN_FUNCTIONS(EBPF_FUNCTION_THREAD, EBPF_PLUGIN_THREAD_FUNCTION_DESCRIPTION);
+#endif
+
+    ebpf_create_lifetime_thread_chart(update_every);
+#ifdef NETDATA_DEV_MODE
+    EBPF_PLUGIN_FUNCTIONS(EBPF_FUNCTION_THREAD, EBPF_PLUGIN_THREAD_FUNCTION_DESCRIPTION);
+#endif
+
+    ebpf_create_statistic_load_chart(update_every);
+
+    ebpf_create_statistic_kernel_memory(update_every);
+
+    ebpf_create_statistic_hash_tables(update_every);
+
+    ebpf_create_statistic_hash_per_core(update_every);
 }
 
 /*****************************************************************
@@ -2412,7 +2759,7 @@ static char *ebpf_get_process_name(pid_t pid)
 
     procfile *ff = procfile_open(filename, " \t", PROCFILE_FLAG_DEFAULT);
     if(unlikely(!ff)) {
-        error("Cannot open %s", filename);
+        netdata_log_error("Cannot open %s", filename);
         return name;
     }
 
@@ -2605,11 +2952,11 @@ int main(int argc, char **argv)
 
         ebpf_module_t *em = &ebpf_modules[i];
         em->thread = st;
-        // We always initialize process, because it is responsible to take care of apps integration
-        if (em->enabled || !i) {
+        em->thread_id = i;
+        if (em->enabled) {
             st->thread = mallocz(sizeof(netdata_thread_t));
-            em->thread_id = i;
             em->enabled = NETDATA_THREAD_EBPF_RUNNING;
+            em->lifetime = EBPF_NON_FUNCTION_LIFE_TIME;
             netdata_thread_create(st->thread, st->name, NETDATA_THREAD_OPTION_DEFAULT, st->start_routine, em);
         } else {
             em->enabled = NETDATA_THREAD_EBPF_NOT_RUNNING;
@@ -2623,23 +2970,30 @@ int main(int argc, char **argv)
     int update_apps_list = update_apps_every - 1;
     int process_maps_per_core = ebpf_modules[EBPF_MODULE_PROCESS_IDX].maps_per_core;
     //Plugin will be killed when it receives a signal
-    while (!ebpf_exit_plugin) {
+    for ( ; !ebpf_exit_plugin ; global_iterations_counter++) {
         (void)heartbeat_next(&hb, step);
 
+        if (global_iterations_counter % EBPF_DEFAULT_UPDATE_EVERY == 0) {
+            pthread_mutex_lock(&lock);
+            ebpf_create_statistic_charts(EBPF_DEFAULT_UPDATE_EVERY);
+
+            ebpf_send_statistic_data();
+            pthread_mutex_unlock(&lock);
+            fflush(stdout);
+        }
+
         pthread_mutex_lock(&ebpf_exit_cleanup);
-        if (process_pid_fd != -1) {
-            pthread_mutex_lock(&collect_data_mutex);
-            if (++update_apps_list == update_apps_every) {
-                update_apps_list = 0;
-                cleanup_exited_pids();
-                collect_data_for_all_processes(process_pid_fd, process_maps_per_core);
-
-                pthread_mutex_lock(&lock);
-                ebpf_create_apps_charts(apps_groups_root_target);
-                pthread_mutex_unlock(&lock);
-            }
-            pthread_mutex_unlock(&collect_data_mutex);
+        pthread_mutex_lock(&collect_data_mutex);
+        if (++update_apps_list == update_apps_every) {
+            update_apps_list = 0;
+            cleanup_exited_pids();
+            collect_data_for_all_processes(process_pid_fd, process_maps_per_core);
+
+            pthread_mutex_lock(&lock);
+            ebpf_create_apps_charts(apps_groups_root_target);
+            pthread_mutex_unlock(&lock);
         }
+        pthread_mutex_unlock(&collect_data_mutex);
         pthread_mutex_unlock(&ebpf_exit_cleanup);
     }
 
@@ -2647,4 +3001,3 @@ int main(int argc, char **argv)
 
     return 0;
 }
-