5 files changed, 24 insertions, 2 deletions
diff --git a/collectors/ebpf.plugin/ebpf.d/cachestat.conf b/collectors/ebpf.plugin/ebpf.d/cachestat.conf
index e2418394..52466be5 100644
--- a/collectors/ebpf.plugin/ebpf.d/cachestat.conf
+++ b/collectors/ebpf.plugin/ebpf.d/cachestat.conf
@@ -19,6 +19,11 @@
 #   `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host.
 #   `probe`     : This is the same as legacy code.
 #
+# The `collect pid` option defines the PID stored inside hash tables and accepts the following options:
+#   `real parent`: Only stores real parent inside PID
+#   `parent`     : Only stores parent PID.
+#   `all`        : Stores all PIDs used by software. This is the most expensive option.
+#
 # Uncomment lines to define specific options for thread.
 [global]
 #    ebpf load mode = entry
@@ -28,3 +33,4 @@
 #    pid table size = 32768
     ebpf type format = auto
     ebpf co-re tracing = trampoline
+    collect pid = real parent
diff --git a/collectors/ebpf.plugin/ebpf.d/dcstat.conf b/collectors/ebpf.plugin/ebpf.d/dcstat.conf
index 3986ae4f..8aed8f78 100644
--- a/collectors/ebpf.plugin/ebpf.d/dcstat.conf
+++ b/collectors/ebpf.plugin/ebpf.d/dcstat.conf
@@ -17,6 +17,11 @@
 #   `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host.
 #   `probe`     : This is the same as legacy code.
 #
+# The `collect pid` option defines the PID stored inside hash tables and accepts the following options:
+#   `real parent`: Only stores real parent inside PID
+#   `parent`     : Only stores parent PID.
+#   `all`        : Stores all PIDs used by software. This is the most expensive option.
+#
 # Uncomment lines to define specific options for thread.
 [global]
 #    ebpf load mode = entry
@@ -26,3 +31,4 @@
 #    pid table size = 32768
     ebpf type format = auto
     ebpf co-re tracing = trampoline
+    collect pid = real parent
diff --git a/collectors/ebpf.plugin/ebpf.d/fd.conf b/collectors/ebpf.plugin/ebpf.d/fd.conf
index f6edd3d9..8333520f 100644
--- a/collectors/ebpf.plugin/ebpf.d/fd.conf
+++ b/collectors/ebpf.plugin/ebpf.d/fd.conf
@@ -11,9 +11,11 @@
 # The `pid table size` defines the maximum number of PIDs stored inside the hash table.
 #
 # Uncomment lines to define specific options for thread.
-#[global]
+[global]
 #    ebpf load mode = entry
 #    apps = yes
 #    cgroups = no
 #    update every = 10
 #    pid table size = 32768
+    ebpf type format = auto
+    ebpf co-re tracing = trampoline
diff --git a/collectors/ebpf.plugin/ebpf.d/process.conf b/collectors/ebpf.plugin/ebpf.d/process.conf
index f6edd3d9..1da5f84d 100644
--- a/collectors/ebpf.plugin/ebpf.d/process.conf
+++ b/collectors/ebpf.plugin/ebpf.d/process.conf
@@ -9,6 +9,11 @@
 # the setting `apps` and `cgroups` to  'no'.
 #
 # The `pid table size` defines the maximum number of PIDs stored inside the hash table.
+# 
+# The `collect pid` option defines the PID stored inside hash tables and accepts the following options:
+#   `real parent`: Only stores real parent inside PID
+#   `parent`     : Only stores parent PID.
+#   `all`        : Stores all PIDs used by software. This is the most expensive option.
 #
 # Uncomment lines to define specific options for thread.
 #[global]
@@ -17,3 +22,4 @@
 #    cgroups = no
 #    update every = 10
 #    pid table size = 32768
+#    collect pid = real parent
diff --git a/collectors/ebpf.plugin/ebpf.d/vfs.conf b/collectors/ebpf.plugin/ebpf.d/vfs.conf
index a65e0acb..fa5d5b4e 100644
--- a/collectors/ebpf.plugin/ebpf.d/vfs.conf
+++ b/collectors/ebpf.plugin/ebpf.d/vfs.conf
@@ -9,9 +9,11 @@
 # the setting `apps` and `cgroups` to  'no'.
 #
 # Uncomment lines to define specific options for thread.
-#[global]
+[global]
 #    ebpf load mode = entry
 #    apps = yes
 #    cgroups = no
 #    update every = 10
 #    pid table size = 32768
+    ebpf type format = auto
+    ebpf co-re tracing = trampoline