Merging upstream version 1.39.0.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 420 insertions, 90 deletions

diff --git a/collectors/ebpf.plugin/ebpf_apps.c b/collectors/ebpf.plugin/ebpf_apps.c
index 7519e0640..d6db4c676 100644
--- a/collectors/ebpf.plugin/ebpf_apps.c
+++ b/collectors/ebpf.plugin/ebpf_apps.c
@@ -5,6 +5,344 @@
 #include "ebpf_apps.h"
 
 // ----------------------------------------------------------------------------
+// ARAL vectors used to speed up processing
+ARAL *ebpf_aral_apps_pid_stat = NULL;
+ARAL *ebpf_aral_process_stat = NULL;
+ARAL *ebpf_aral_socket_pid = NULL;
+ARAL *ebpf_aral_cachestat_pid = NULL;
+ARAL *ebpf_aral_dcstat_pid = NULL;
+ARAL *ebpf_aral_vfs_pid = NULL;
+ARAL *ebpf_aral_fd_pid = NULL;
+ARAL *ebpf_aral_shm_pid = NULL;
+
+// ----------------------------------------------------------------------------
+// Global vectors used with apps
+ebpf_socket_publish_apps_t **socket_bandwidth_curr = NULL;
+netdata_publish_cachestat_t **cachestat_pid = NULL;
+netdata_publish_dcstat_t **dcstat_pid = NULL;
+netdata_publish_swap_t **swap_pid = NULL;
+netdata_publish_vfs_t **vfs_pid = NULL;
+netdata_fd_stat_t **fd_pid = NULL;
+netdata_publish_shm_t **shm_pid = NULL;
+ebpf_process_stat_t **global_process_stats = NULL;
+
+/**
+ * eBPF ARAL Init
+ *
+ * Initiallize array allocator that will be used when integration with apps and ebpf is created.
+ */
+void ebpf_aral_init(void)
+{
+    size_t max_elements = NETDATA_EBPF_ALLOC_MAX_PID;
+    if (max_elements < NETDATA_EBPF_ALLOC_MIN_ELEMENTS) {
+        error("Number of elements given is too small, adjusting it for %d", NETDATA_EBPF_ALLOC_MIN_ELEMENTS);
+        max_elements = NETDATA_EBPF_ALLOC_MIN_ELEMENTS;
+    }
+
+    ebpf_aral_apps_pid_stat = ebpf_allocate_pid_aral("ebpf_pid_stat", sizeof(struct ebpf_pid_stat));
+
+    ebpf_aral_process_stat = ebpf_allocate_pid_aral(NETDATA_EBPF_PROC_ARAL_NAME, sizeof(ebpf_process_stat_t));
+
+#ifdef NETDATA_DEV_MODE
+    info("Plugin is using ARAL with values %d", NETDATA_EBPF_ALLOC_MAX_PID);
+#endif
+}
+
+/**
+ * eBPF pid stat get
+ *
+ * Get a ebpf_pid_stat entry to be used with a specific PID.
+ *
+ * @return it returns the address on success.
+ */
+struct ebpf_pid_stat *ebpf_pid_stat_get(void)
+{
+    struct ebpf_pid_stat *target = aral_mallocz(ebpf_aral_apps_pid_stat);
+    memset(target, 0, sizeof(struct ebpf_pid_stat));
+    return target;
+}
+
+/**
+ * eBPF target release
+ *
+ * @param stat Release a target after usage.
+ */
+void ebpf_pid_stat_release(struct ebpf_pid_stat *stat)
+{
+    aral_freez(ebpf_aral_apps_pid_stat, stat);
+}
+
+/*****************************************************************
+ *
+ *  PROCESS ARAL FUNCTIONS
+ *
+ *****************************************************************/
+
+/**
+ * eBPF process stat get
+ *
+ * Get a ebpf_pid_stat entry to be used with a specific PID.
+ *
+ * @return it returns the address on success.
+ */
+ebpf_process_stat_t *ebpf_process_stat_get(void)
+{
+    ebpf_process_stat_t *target = aral_mallocz(ebpf_aral_process_stat);
+    memset(target, 0, sizeof(ebpf_process_stat_t));
+    return target;
+}
+
+/**
+ * eBPF process release
+ *
+ * @param stat Release a target after usage.
+ */
+void ebpf_process_stat_release(ebpf_process_stat_t *stat)
+{
+    aral_freez(ebpf_aral_process_stat, stat);
+}
+
+/*****************************************************************
+ *
+ *  SOCKET ARAL FUNCTIONS
+ *
+ *****************************************************************/
+
+/**
+ * eBPF socket Aral init
+ *
+ * Initiallize array allocator that will be used when integration with apps is enabled.
+ */
+void ebpf_socket_aral_init()
+{
+    ebpf_aral_socket_pid = ebpf_allocate_pid_aral(NETDATA_EBPF_SOCKET_ARAL_NAME, sizeof(ebpf_socket_publish_apps_t));
+}
+
+/**
+ * eBPF socket get
+ *
+ * Get a ebpf_socket_publish_apps_t entry to be used with a specific PID.
+ *
+ * @return it returns the address on success.
+ */
+ebpf_socket_publish_apps_t *ebpf_socket_stat_get(void)
+{
+    ebpf_socket_publish_apps_t *target = aral_mallocz(ebpf_aral_socket_pid);
+    memset(target, 0, sizeof(ebpf_socket_publish_apps_t));
+    return target;
+}
+
+/**
+ * eBPF socket release
+ *
+ * @param stat Release a target after usage.
+ */
+void ebpf_socket_release(ebpf_socket_publish_apps_t *stat)
+{
+    aral_freez(ebpf_aral_socket_pid, stat);
+}
+
+/*****************************************************************
+ *
+ *  CACHESTAT ARAL FUNCTIONS
+ *
+ *****************************************************************/
+
+/**
+ * eBPF Cachestat Aral init
+ *
+ * Initiallize array allocator that will be used when integration with apps is enabled.
+ */
+void ebpf_cachestat_aral_init()
+{
+    ebpf_aral_cachestat_pid = ebpf_allocate_pid_aral(NETDATA_EBPF_CACHESTAT_ARAL_NAME, sizeof(netdata_publish_cachestat_t));
+}
+
+/**
+ * eBPF publish cachestat get
+ *
+ * Get a netdata_publish_cachestat_t entry to be used with a specific PID.
+ *
+ * @return it returns the address on success.
+ */
+netdata_publish_cachestat_t *ebpf_publish_cachestat_get(void)
+{
+    netdata_publish_cachestat_t *target = aral_mallocz(ebpf_aral_cachestat_pid);
+    memset(target, 0, sizeof(netdata_publish_cachestat_t));
+    return target;
+}
+
+/**
+ * eBPF cachestat release
+ *
+ * @param stat Release a target after usage.
+ */
+void ebpf_cachestat_release(netdata_publish_cachestat_t *stat)
+{
+    aral_freez(ebpf_aral_cachestat_pid, stat);
+}
+
+/*****************************************************************
+ *
+ *  DCSTAT ARAL FUNCTIONS
+ *
+ *****************************************************************/
+
+/**
+ * eBPF directory cache Aral init
+ *
+ * Initiallize array allocator that will be used when integration with apps is enabled.
+ */
+void ebpf_dcstat_aral_init()
+{
+    ebpf_aral_dcstat_pid = ebpf_allocate_pid_aral(NETDATA_EBPF_DCSTAT_ARAL_NAME, sizeof(netdata_publish_dcstat_t));
+}
+
+/**
+ * eBPF publish dcstat get
+ *
+ * Get a netdata_publish_dcstat_t entry to be used with a specific PID.
+ *
+ * @return it returns the address on success.
+ */
+netdata_publish_dcstat_t *ebpf_publish_dcstat_get(void)
+{
+    netdata_publish_dcstat_t *target = aral_mallocz(ebpf_aral_dcstat_pid);
+    memset(target, 0, sizeof(netdata_publish_dcstat_t));
+    return target;
+}
+
+/**
+ * eBPF dcstat release
+ *
+ * @param stat Release a target after usage.
+ */
+void ebpf_dcstat_release(netdata_publish_dcstat_t *stat)
+{
+    aral_freez(ebpf_aral_dcstat_pid, stat);
+}
+
+/*****************************************************************
+ *
+ *  VFS ARAL FUNCTIONS
+ *
+ *****************************************************************/
+
+/**
+ * eBPF VFS Aral init
+ *
+ * Initiallize array allocator that will be used when integration with apps is enabled.
+ */
+void ebpf_vfs_aral_init()
+{
+    ebpf_aral_vfs_pid = ebpf_allocate_pid_aral(NETDATA_EBPF_VFS_ARAL_NAME, sizeof(netdata_publish_vfs_t));
+}
+
+/**
+ * eBPF publish VFS get
+ *
+ * Get a netdata_publish_vfs_t entry to be used with a specific PID.
+ *
+ * @return it returns the address on success.
+ */
+netdata_publish_vfs_t *ebpf_vfs_get(void)
+{
+    netdata_publish_vfs_t *target = aral_mallocz(ebpf_aral_vfs_pid);
+    memset(target, 0, sizeof(netdata_publish_vfs_t));
+    return target;
+}
+
+/**
+ * eBPF VFS release
+ *
+ * @param stat Release a target after usage.
+ */
+void ebpf_vfs_release(netdata_publish_vfs_t *stat)
+{
+    aral_freez(ebpf_aral_vfs_pid, stat);
+}
+
+/*****************************************************************
+ *
+ *  FD ARAL FUNCTIONS
+ *
+ *****************************************************************/
+
+/**
+ * eBPF file descriptor Aral init
+ *
+ * Initiallize array allocator that will be used when integration with apps is enabled.
+ */
+void ebpf_fd_aral_init()
+{
+    ebpf_aral_fd_pid = ebpf_allocate_pid_aral(NETDATA_EBPF_FD_ARAL_NAME, sizeof(netdata_fd_stat_t));
+}
+
+/**
+ * eBPF publish file descriptor get
+ *
+ * Get a netdata_fd_stat_t entry to be used with a specific PID.
+ *
+ * @return it returns the address on success.
+ */
+netdata_fd_stat_t *ebpf_fd_stat_get(void)
+{
+    netdata_fd_stat_t *target = aral_mallocz(ebpf_aral_fd_pid);
+    memset(target, 0, sizeof(netdata_fd_stat_t));
+    return target;
+}
+
+/**
+ * eBPF file descriptor release
+ *
+ * @param stat Release a target after usage.
+ */
+void ebpf_fd_release(netdata_fd_stat_t *stat)
+{
+    aral_freez(ebpf_aral_fd_pid, stat);
+}
+
+/*****************************************************************
+ *
+ *  SHM ARAL FUNCTIONS
+ *
+ *****************************************************************/
+
+/**
+ * eBPF shared memory Aral init
+ *
+ * Initiallize array allocator that will be used when integration with apps is enabled.
+ */
+void ebpf_shm_aral_init()
+{
+    ebpf_aral_shm_pid = ebpf_allocate_pid_aral(NETDATA_EBPF_SHM_ARAL_NAME, sizeof(netdata_publish_shm_t));
+}
+
+/**
+ * eBPF shared memory get
+ *
+ * Get a netdata_publish_shm_t entry to be used with a specific PID.
+ *
+ * @return it returns the address on success.
+ */
+netdata_publish_shm_t *ebpf_shm_stat_get(void)
+{
+    netdata_publish_shm_t *target = aral_mallocz(ebpf_aral_shm_pid);
+    memset(target, 0, sizeof(netdata_publish_shm_t));
+    return target;
+}
+
+/**
+ * eBPF shared memory release
+ *
+ * @param stat Release a target after usage.
+ */
+void ebpf_shm_release(netdata_publish_shm_t *stat)
+{
+    aral_freez(ebpf_aral_shm_pid, stat);
+}
+
+// ----------------------------------------------------------------------------
 // internal flags
 // handled in code (automatically set)
 
@@ -49,7 +387,7 @@ int ebpf_read_hash_table(void *ep, int fd, uint32_t pid)
  *
  * @return
  */
-size_t read_bandwidth_statistic_using_pid_on_target(ebpf_bandwidth_t **ep, int fd, struct pid_on_target *pids)
+size_t read_bandwidth_statistic_using_pid_on_target(ebpf_bandwidth_t **ep, int fd, struct ebpf_pid_on_target *pids)
 {
     size_t count = 0;
     while (pids) {
@@ -120,19 +458,19 @@ int am_i_running_as_root()
  *
  * @return it returns the number of structures that was reset.
  */
-size_t zero_all_targets(struct target *root)
+size_t zero_all_targets(struct ebpf_target *root)
 {
-    struct target *w;
+    struct ebpf_target *w;
     size_t count = 0;
 
     for (w = root; w; w = w->next) {
         count++;
 
         if (unlikely(w->root_pid)) {
-            struct pid_on_target *pid_on_target = w->root_pid;
+            struct ebpf_pid_on_target *pid_on_target = w->root_pid;
 
             while (pid_on_target) {
-                struct pid_on_target *pid_on_target_to_free = pid_on_target;
+                struct ebpf_pid_on_target *pid_on_target_to_free = pid_on_target;
                 pid_on_target = pid_on_target->next;
                 freez(pid_on_target_to_free);
             }
@@ -149,9 +487,9 @@ size_t zero_all_targets(struct target *root)
  *
  * @param agrt the pointer to be cleaned.
  */
-void clean_apps_groups_target(struct target *agrt)
+void clean_apps_groups_target(struct ebpf_target *agrt)
 {
-    struct target *current_target;
+    struct ebpf_target *current_target;
     while (agrt) {
         current_target = agrt;
         agrt = current_target->target;
@@ -170,7 +508,7 @@ void clean_apps_groups_target(struct target *agrt)
  *
  * @return It returns the target on success and NULL otherwise
  */
-struct target *get_apps_groups_target(struct target **agrt, const char *id, struct target *target, const char *name)
+struct ebpf_target *get_apps_groups_target(struct ebpf_target **agrt, const char *id, struct ebpf_target *target, const char *name)
 {
     int tdebug = 0, thidden = target ? target->hidden : 0, ends_with = 0;
     const char *nid = id;
@@ -188,9 +526,9 @@ struct target *get_apps_groups_target(struct target **agrt, const char *id, stru
     uint32_t hash = simple_hash(id);
 
     // find if it already exists
-    struct target *w, *last = *agrt;
+    struct ebpf_target *w, *last = *agrt;
     for (w = *agrt; w; w = w->next) {
-        if (w->idhash == hash && strncmp(nid, w->id, MAX_NAME) == 0)
+        if (w->idhash == hash && strncmp(nid, w->id, EBPF_MAX_NAME) == 0)
             return w;
 
         last = w;
@@ -215,18 +553,18 @@ struct target *get_apps_groups_target(struct target **agrt, const char *id, stru
             "Internal Error: request to link process '%s' to target '%s' which is linked to target '%s'", id,
             target->id, target->target->id);
 
-    w = callocz(1, sizeof(struct target));
-    strncpyz(w->id, nid, MAX_NAME);
+    w = callocz(1, sizeof(struct ebpf_target));
+    strncpyz(w->id, nid, EBPF_MAX_NAME);
     w->idhash = simple_hash(w->id);
 
     if (unlikely(!target))
         // copy the name
-        strncpyz(w->name, name, MAX_NAME);
+        strncpyz(w->name, name, EBPF_MAX_NAME);
     else
         // copy the id
-        strncpyz(w->name, nid, MAX_NAME);
+        strncpyz(w->name, nid, EBPF_MAX_NAME);
 
-    strncpyz(w->compare, nid, MAX_COMPARE_NAME);
+    strncpyz(w->compare, nid, EBPF_MAX_COMPARE_NAME);
     size_t len = strlen(w->compare);
     if (w->compare[len - 1] == '*') {
         w->compare[len - 1] = '\0';
@@ -267,7 +605,7 @@ struct target *get_apps_groups_target(struct target **agrt, const char *id, stru
  *
  * @return It returns 0 on success and -1 otherwise
  */
-int ebpf_read_apps_groups_conf(struct target **agdt, struct target **agrt, const char *path, const char *file)
+int ebpf_read_apps_groups_conf(struct ebpf_target **agdt, struct ebpf_target **agrt, const char *path, const char *file)
 {
     char filename[FILENAME_MAX + 1];
 
@@ -297,7 +635,7 @@ int ebpf_read_apps_groups_conf(struct target **agdt, struct target **agrt, const
             continue;
 
         // find a possibly existing target
-        struct target *w = NULL;
+        struct ebpf_target *w = NULL;
 
         // loop through all words, skipping the first one (the name)
         for (word = 0; word < words; word++) {
@@ -312,7 +650,7 @@ int ebpf_read_apps_groups_conf(struct target **agdt, struct target **agrt, const
                 continue;
 
             // add this target
-            struct target *n = get_apps_groups_target(agrt, s, w, name);
+            struct ebpf_target *n = get_apps_groups_target(agrt, s, w, name);
             if (!n) {
                 error("Cannot create target '%s' (line %zu, word %zu)", s, line, word);
                 continue;
@@ -331,7 +669,7 @@ int ebpf_read_apps_groups_conf(struct target **agdt, struct target **agrt, const
     if (!*agdt)
         fatal("Cannot create default target");
 
-    struct target *ptr = *agdt;
+    struct ebpf_target *ptr = *agdt;
     if (ptr->target)
         *agdt = ptr->target;
 
@@ -345,17 +683,15 @@ int ebpf_read_apps_groups_conf(struct target **agdt, struct target **agrt, const
 // ----------------------------------------------------------------------------
 // string lengths
 
-#define MAX_COMPARE_NAME 100
-#define MAX_NAME 100
 #define MAX_CMDLINE 16384
 
-struct pid_stat **all_pids = NULL;    // to avoid allocations, we pre-allocate the
+struct ebpf_pid_stat **ebpf_all_pids = NULL;    // to avoid allocations, we pre-allocate the
                                       // the entire pid space.
-struct pid_stat *root_of_pids = NULL; // global list of all processes running
+struct ebpf_pid_stat *ebpf_root_of_pids = NULL; // global list of all processes running
 
-size_t all_pids_count = 0; // the number of processes running
+size_t ebpf_all_pids_count = 0; // the number of processes running
 
-struct target
+struct ebpf_target
     *apps_groups_default_target = NULL, // the default target
     *apps_groups_root_target = NULL,    // apps_groups.conf defined
     *users_root_target = NULL,          // users
@@ -416,7 +752,7 @@ static inline void debug_log_dummy(void)
  *
  * @return It returns the status value.
  */
-static inline int managed_log(struct pid_stat *p, uint32_t log, int status)
+static inline int managed_log(struct ebpf_pid_stat *p, uint32_t log, int status)
 {
     if (unlikely(!status)) {
         // error("command failed log %u, errno %d", log, errno);
@@ -476,23 +812,23 @@ static inline int managed_log(struct pid_stat *p, uint32_t log, int status)
  *
  * @return It returns the pid entry structure
  */
-static inline struct pid_stat *get_pid_entry(pid_t pid)
+static inline struct ebpf_pid_stat *get_pid_entry(pid_t pid)
 {
-    if (unlikely(all_pids[pid]))
-        return all_pids[pid];
+    if (unlikely(ebpf_all_pids[pid]))
+        return ebpf_all_pids[pid];
 
-    struct pid_stat *p = callocz(1, sizeof(struct pid_stat));
+    struct ebpf_pid_stat *p = ebpf_pid_stat_get();
 
-    if (likely(root_of_pids))
-        root_of_pids->prev = p;
+    if (likely(ebpf_root_of_pids))
+        ebpf_root_of_pids->prev = p;
 
-    p->next = root_of_pids;
-    root_of_pids = p;
+    p->next = ebpf_root_of_pids;
+    ebpf_root_of_pids = p;
 
     p->pid = pid;
 
-    all_pids[pid] = p;
-    all_pids_count++;
+    ebpf_all_pids[pid] = p;
+    ebpf_all_pids_count++;
 
     return p;
 }
@@ -502,14 +838,14 @@ static inline struct pid_stat *get_pid_entry(pid_t pid)
  *
  * @param p the pid_stat structure to assign for a target.
  */
-static inline void assign_target_to_pid(struct pid_stat *p)
+static inline void assign_target_to_pid(struct ebpf_pid_stat *p)
 {
     targets_assignment_counter++;
 
     uint32_t hash = simple_hash(p->comm);
     size_t pclen = strlen(p->comm);
 
-    struct target *w;
+    struct ebpf_target *w;
     for (w = apps_groups_root_target; w; w = w->next) {
         // if(debug_enabled || (p->target && p->target->debug_enabled)) debug_log_int("\t\tcomparing '%s' with '%s'", w->compare, p->comm);
 
@@ -543,11 +879,11 @@ static inline void assign_target_to_pid(struct pid_stat *p)
 /**
  * Read cmd line from /proc/PID/cmdline
  *
- * @param p  the pid_stat_structure.
+ * @param p  the ebpf_pid_stat_structure.
  *
  * @return It returns 1 on success and 0 otherwise.
  */
-static inline int read_proc_pid_cmdline(struct pid_stat *p)
+static inline int read_proc_pid_cmdline(struct ebpf_pid_stat *p)
 {
     static char cmdline[MAX_CMDLINE + 1];
 
@@ -596,7 +932,7 @@ cleanup:
  * @param p the pid stat structure to store the data.
  * @param ptr an useless argument.
  */
-static inline int read_proc_pid_stat(struct pid_stat *p, void *ptr)
+static inline int read_proc_pid_stat(struct ebpf_pid_stat *p, void *ptr)
 {
     UNUSED(ptr);
 
@@ -640,7 +976,7 @@ static inline int read_proc_pid_stat(struct pid_stat *p, void *ptr)
                 debug_log("\tJust added %d (%s)", p->pid, comm);
         }
 
-        strncpyz(p->comm, comm, MAX_COMPARE_NAME);
+        strncpyz(p->comm, comm, EBPF_MAX_COMPARE_NAME);
 
         // /proc/<pid>/cmdline
         if (likely(proc_pid_cmdline_is_needed))
@@ -673,7 +1009,7 @@ static inline int collect_data_for_pid(pid_t pid, void *ptr)
         return 0;
     }
 
-    struct pid_stat *p = get_pid_entry(pid);
+    struct ebpf_pid_stat *p = get_pid_entry(pid);
     if (unlikely(!p || p->read))
         return 0;
     p->read = 1;
@@ -701,11 +1037,11 @@ static inline int collect_data_for_pid(pid_t pid, void *ptr)
  */
 static inline void link_all_processes_to_their_parents(void)
 {
-    struct pid_stat *p, *pp;
+    struct ebpf_pid_stat *p, *pp;
 
     // link all children to their parents
     // and update children count on parents
-    for (p = root_of_pids; p; p = p->next) {
+    for (p = ebpf_root_of_pids; p; p = p->next) {
         // for each process found
 
         p->sortlist = 0;
@@ -716,7 +1052,7 @@ static inline void link_all_processes_to_their_parents(void)
             continue;
         }
 
-        pp = all_pids[p->ppid];
+        pp = ebpf_all_pids[p->ppid];
         if (likely(pp)) {
             p->parent = pp;
             pp->children_count++;
@@ -738,7 +1074,7 @@ static inline void link_all_processes_to_their_parents(void)
  */
 static void apply_apps_groups_targets_inheritance(void)
 {
-    struct pid_stat *p = NULL;
+    struct ebpf_pid_stat *p = NULL;
 
     // children that do not have a target
     // inherit their target from their parent
@@ -747,7 +1083,7 @@ static void apply_apps_groups_targets_inheritance(void)
         if (unlikely(debug_enabled))
             loops++;
         found = 0;
-        for (p = root_of_pids; p; p = p->next) {
+        for (p = ebpf_root_of_pids; p; p = p->next) {
             // if this process does not have a target
             // and it has a parent
             // and its parent has a target
@@ -773,7 +1109,7 @@ static void apply_apps_groups_targets_inheritance(void)
             loops++;
         found = 0;
 
-        for (p = root_of_pids; p; p = p->next) {
+        for (p = ebpf_root_of_pids; p; p = p->next) {
             if (unlikely(!p->sortlist && !p->children_count))
                 p->sortlist = sortlist++;
 
@@ -809,17 +1145,17 @@ static void apply_apps_groups_targets_inheritance(void)
     }
 
     // init goes always to default target
-    if (all_pids[INIT_PID])
-        all_pids[INIT_PID]->target = apps_groups_default_target;
+    if (ebpf_all_pids[INIT_PID])
+        ebpf_all_pids[INIT_PID]->target = apps_groups_default_target;
 
     // pid 0 goes always to default target
-    if (all_pids[0])
-        all_pids[0]->target = apps_groups_default_target;
+    if (ebpf_all_pids[0])
+        ebpf_all_pids[0]->target = apps_groups_default_target;
 
     // give a default target on all top level processes
     if (unlikely(debug_enabled))
         loops++;
-    for (p = root_of_pids; p; p = p->next) {
+    for (p = ebpf_root_of_pids; p; p = p->next) {
         // if the process is not merged itself
         // then is is a top level process
         if (unlikely(!p->merged && !p->target))
@@ -830,8 +1166,8 @@ static void apply_apps_groups_targets_inheritance(void)
             p->sortlist = sortlist++;
     }
 
-    if (all_pids[1])
-        all_pids[1]->sortlist = sortlist++;
+    if (ebpf_all_pids[1])
+        ebpf_all_pids[1]->sortlist = sortlist++;
 
     // give a target to all merged child processes
     found = 1;
@@ -839,7 +1175,7 @@ static void apply_apps_groups_targets_inheritance(void)
         if (unlikely(debug_enabled))
             loops++;
         found = 0;
-        for (p = root_of_pids; p; p = p->next) {
+        for (p = ebpf_root_of_pids; p; p = p->next) {
             if (unlikely(!p->target && p->merged && p->parent && p->parent->target)) {
                 p->target = p->parent->target;
                 found++;
@@ -860,9 +1196,9 @@ static void apply_apps_groups_targets_inheritance(void)
  *
  * @param root the targets that will be updated.
  */
-static inline void post_aggregate_targets(struct target *root)
+static inline void post_aggregate_targets(struct ebpf_target *root)
 {
-    struct target *w;
+    struct ebpf_target *w;
     for (w = root; w; w = w->next) {
         if (w->collected_starttime) {
             if (!w->starttime || w->collected_starttime < w->starttime) {
@@ -881,7 +1217,7 @@ static inline void post_aggregate_targets(struct target *root)
  */
 static inline void del_pid_entry(pid_t pid)
 {
-    struct pid_stat *p = all_pids[pid];
+    struct ebpf_pid_stat *p = ebpf_all_pids[pid];
 
     if (unlikely(!p)) {
         error("attempted to free pid %d that is not allocated.", pid);
@@ -890,8 +1226,8 @@ static inline void del_pid_entry(pid_t pid)
 
     debug_log("process %d %s exited, deleting it.", pid, p->comm);
 
-    if (root_of_pids == p)
-        root_of_pids = p->next;
+    if (ebpf_root_of_pids == p)
+        ebpf_root_of_pids = p->next;
 
     if (p->next)
         p->next->prev = p->prev;
@@ -903,10 +1239,10 @@ static inline void del_pid_entry(pid_t pid)
     freez(p->io_filename);
     freez(p->cmdline_filename);
     freez(p->cmdline);
-    freez(p);
+    ebpf_pid_stat_release(p);
 
-    all_pids[pid] = NULL;
-    all_pids_count--;
+    ebpf_all_pids[pid] = NULL;
+    ebpf_all_pids_count--;
 }
 
 /**
@@ -921,9 +1257,9 @@ static inline void del_pid_entry(pid_t pid)
  */
 int get_pid_comm(pid_t pid, size_t n, char *dest)
 {
-    struct pid_stat *stat;
+    struct ebpf_pid_stat *stat;
 
-    stat = all_pids[pid];
+    stat = ebpf_all_pids[pid];
     if (unlikely(stat == NULL)) {
         return -1;
     }
@@ -945,19 +1281,19 @@ void cleanup_variables_from_other_threads(uint32_t pid)
 {
     // Clean socket structures
     if (socket_bandwidth_curr) {
-        freez(socket_bandwidth_curr[pid]);
+        ebpf_socket_release(socket_bandwidth_curr[pid]);
         socket_bandwidth_curr[pid] = NULL;
     }
 
     // Clean cachestat structure
     if (cachestat_pid) {
-        freez(cachestat_pid[pid]);
+        ebpf_cachestat_release(cachestat_pid[pid]);
         cachestat_pid[pid] = NULL;
     }
 
     // Clean directory cache structure
     if (dcstat_pid) {
-        freez(dcstat_pid[pid]);
+        ebpf_dcstat_release(dcstat_pid[pid]);
         dcstat_pid[pid] = NULL;
     }
 
@@ -969,19 +1305,19 @@ void cleanup_variables_from_other_threads(uint32_t pid)
 
     // Clean vfs structure
     if (vfs_pid) {
-        freez(vfs_pid[pid]);
+        ebpf_vfs_release(vfs_pid[pid]);
         vfs_pid[pid] = NULL;
     }
 
     // Clean fd structure
     if (fd_pid) {
-        freez(fd_pid[pid]);
+        ebpf_fd_release(fd_pid[pid]);
         fd_pid[pid] = NULL;
     }
 
     // Clean shm structure
     if (shm_pid) {
-        freez(shm_pid[pid]);
+        ebpf_shm_release(shm_pid[pid]);
         shm_pid[pid] = NULL;
     }
 }
@@ -991,9 +1327,9 @@ void cleanup_variables_from_other_threads(uint32_t pid)
  */
 void cleanup_exited_pids()
 {
-    struct pid_stat *p = NULL;
+    struct ebpf_pid_stat *p = NULL;
 
-    for (p = root_of_pids; p;) {
+    for (p = ebpf_root_of_pids; p;) {
         if (!p->updated && (!p->keep || p->keeploops > 0)) {
             if (unlikely(debug_enabled && (p->keep || p->keeploops)))
                 debug_log(" > CLEANUP cannot keep exited process %d (%s) anymore - removing it.", p->pid, p->comm);
@@ -1002,12 +1338,9 @@ void cleanup_exited_pids()
             p = p->next;
 
             // Clean process structure
-            freez(global_process_stats[r]);
+            ebpf_process_stat_release(global_process_stats[r]);
             global_process_stats[r] = NULL;
 
-            freez(current_apps_data[r]);
-            current_apps_data[r] = NULL;
-
             cleanup_variables_from_other_threads(r);
 
             del_pid_entry(r);
@@ -1060,7 +1393,7 @@ static inline void read_proc_filesystem()
  * @param p the pid with information to update
  * @param o never used
  */
-static inline void aggregate_pid_on_target(struct target *w, struct pid_stat *p, struct target *o)
+static inline void aggregate_pid_on_target(struct ebpf_target *w, struct ebpf_pid_stat *p, struct ebpf_target *o)
 {
     UNUSED(o);
 
@@ -1075,7 +1408,7 @@ static inline void aggregate_pid_on_target(struct target *w, struct pid_stat *p,
     }
 
     w->processes++;
-    struct pid_on_target *pid_on_target = mallocz(sizeof(struct pid_on_target));
+    struct ebpf_pid_on_target *pid_on_target = mallocz(sizeof(struct ebpf_pid_on_target));
     pid_on_target->pid = p->pid;
     pid_on_target->next = w->root_pid;
     w->root_pid = pid_on_target;
@@ -1091,10 +1424,10 @@ static inline void aggregate_pid_on_target(struct target *w, struct pid_stat *p,
  */
 void collect_data_for_all_processes(int tbl_pid_stats_fd)
 {
-    if (unlikely(!all_pids))
+    if (unlikely(!ebpf_all_pids))
         return;
 
-    struct pid_stat *pids = root_of_pids; // global list of all processes running
+    struct ebpf_pid_stat *pids = ebpf_root_of_pids; // global list of all processes running
     while (pids) {
         if (pids->updated_twice) {
             pids->read = 0; // mark it as not read, so that collect_data_for_pid() will read it
@@ -1113,24 +1446,21 @@ void collect_data_for_all_processes(int tbl_pid_stats_fd)
     read_proc_filesystem();
 
     uint32_t key;
-    pids = root_of_pids; // global list of all processes running
+    pids = ebpf_root_of_pids; // global list of all processes running
     // while (bpf_map_get_next_key(tbl_pid_stats_fd, &key, &next_key) == 0) {
     while (pids) {
         key = pids->pid;
         ebpf_process_stat_t *w = global_process_stats[key];
         if (!w) {
-            w = callocz(1, sizeof(ebpf_process_stat_t));
+            w = ebpf_process_stat_get();
             global_process_stats[key] = w;
         }
 
         if (bpf_map_lookup_elem(tbl_pid_stats_fd, &key, w)) {
             // Clean Process structures
-            freez(w);
+            ebpf_process_stat_release(w);
             global_process_stats[key] = NULL;
 
-            freez(current_apps_data[key]);
-            current_apps_data[key] = NULL;
-
             cleanup_variables_from_other_threads(key);
 
             pids = pids->next;
@@ -1148,7 +1478,7 @@ void collect_data_for_all_processes(int tbl_pid_stats_fd)
 
     // this has to be done, before the cleanup
     // // concentrate everything on the targets
-    for (pids = root_of_pids; pids; pids = pids->next)
+    for (pids = ebpf_root_of_pids; pids; pids = pids->next)
         aggregate_pid_on_target(pids->target, pids, NULL);
 
     post_aggregate_targets(apps_groups_root_target);