17 files changed, 60 insertions, 6 deletions
diff --git a/collectors/ebpf.plugin/ebpf.d/cachestat.conf b/collectors/ebpf.plugin/ebpf.d/cachestat.conf
index 82f870c98..9c51b2c52 100644
--- a/collectors/ebpf.plugin/ebpf.d/cachestat.conf
+++ b/collectors/ebpf.plugin/ebpf.d/cachestat.conf
@@ -26,6 +26,8 @@
 #
 # The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
 #
+# The `lifetime` defines the time length a thread will run when it is enabled by a function.
+#
 # Uncomment lines to define specific options for thread.
 [global]
 #    ebpf load mode = entry
@@ -37,3 +39,4 @@
     ebpf co-re tracing = trampoline
     collect pid = real parent
 #    maps per core = yes
+    lifetime = 300
diff --git a/collectors/ebpf.plugin/ebpf.d/dcstat.conf b/collectors/ebpf.plugin/ebpf.d/dcstat.conf
index f741b62a8..614d814e6 100644
--- a/collectors/ebpf.plugin/ebpf.d/dcstat.conf
+++ b/collectors/ebpf.plugin/ebpf.d/dcstat.conf
@@ -24,6 +24,8 @@
 #
 # The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
 #
+# The `lifetime` defines the time length a thread will run when it is enabled by a function.
+#
 # Uncomment lines to define specific options for thread.
 [global]
 #    ebpf load mode = entry
@@ -35,3 +37,4 @@
     ebpf co-re tracing = trampoline
     collect pid = real parent
 #    maps per core = yes
+    lifetime = 300
diff --git a/collectors/ebpf.plugin/ebpf.d/disk.conf b/collectors/ebpf.plugin/ebpf.d/disk.conf
index 4adf88e74..c5a0a2708 100644
--- a/collectors/ebpf.plugin/ebpf.d/disk.conf
+++ b/collectors/ebpf.plugin/ebpf.d/disk.conf
@@ -3,7 +3,10 @@
 #  `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
 #            new charts for the return of these functions, such as errors.
 #
-#[global]
+# The `lifetime` defines the time length a thread will run when it is enabled by a function.
+#
+[global]
 #    ebpf load mode = entry
 #    update every = 10
+    lifetime = 300
 
diff --git a/collectors/ebpf.plugin/ebpf.d/fd.conf b/collectors/ebpf.plugin/ebpf.d/fd.conf
index 30a5fcfd9..d48230323 100644
--- a/collectors/ebpf.plugin/ebpf.d/fd.conf
+++ b/collectors/ebpf.plugin/ebpf.d/fd.conf
@@ -12,6 +12,8 @@
 #
 # The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
 #
+# The `lifetime` defines the time length a thread will run when it is enabled by a function.
+#
 # Uncomment lines to define specific options for thread.
 [global]
 #    ebpf load mode = entry
@@ -22,3 +24,4 @@
     ebpf type format = auto
     ebpf co-re tracing = trampoline
 #    maps per core = yes
+    lifetime = 300
diff --git a/collectors/ebpf.plugin/ebpf.d/filesystem.conf b/collectors/ebpf.plugin/ebpf.d/filesystem.conf
index c5eb01e54..209abba77 100644
--- a/collectors/ebpf.plugin/ebpf.d/filesystem.conf
+++ b/collectors/ebpf.plugin/ebpf.d/filesystem.conf
@@ -3,13 +3,16 @@
 #  `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
 #            new charts for the return of these functions, such as errors.
 #
+# The `lifetime` defines the time length a thread will run when it is enabled by a function.
+#
 # The eBPF collector also creates charts for each running application through an integration with the `apps plugin`.
 # If you want to disable the integration with `apps.plugin` along with the above charts, change the setting `apps` to
 # 'no'.
 #  
-#[global]
+[global]
 #    ebpf load mode = entry
 #    update every = 10
+    lifetime = 300
 
 # All filesystems are named as 'NAMEdist' where NAME is the filesystem name while 'dist' is a reference for distribution.
 [filesystem]
diff --git a/collectors/ebpf.plugin/ebpf.d/functions.conf b/collectors/ebpf.plugin/ebpf.d/functions.conf
new file mode 100644
index 000000000..a4f57f641
--- /dev/null
+++ b/collectors/ebpf.plugin/ebpf.d/functions.conf
@@ -0,0 +1,3 @@
+#[global]
+#    update every = 5
+
diff --git a/collectors/ebpf.plugin/ebpf.d/hardirq.conf b/collectors/ebpf.plugin/ebpf.d/hardirq.conf
index f2bae1d57..6a47a94bf 100644
--- a/collectors/ebpf.plugin/ebpf.d/hardirq.conf
+++ b/collectors/ebpf.plugin/ebpf.d/hardirq.conf
@@ -3,6 +3,9 @@
 #  `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
 #            new charts for the return of these functions, such as errors.
 #
-#[global]
+# The `lifetime` defines the time length a thread will run when it is enabled by a function.
+#
+[global]
 #    ebpf load mode = entry
 #    update every = 10
+    lifetime = 300
diff --git a/collectors/ebpf.plugin/ebpf.d/mdflush.conf b/collectors/ebpf.plugin/ebpf.d/mdflush.conf
index e65e8672c..ea97ebe85 100644
--- a/collectors/ebpf.plugin/ebpf.d/mdflush.conf
+++ b/collectors/ebpf.plugin/ebpf.d/mdflush.conf
@@ -2,6 +2,10 @@
 #  `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
 #  `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
 #            new charts for the return of these functions, such as errors.
-#[global]
+#
+# The `lifetime` defines the time length a thread will run when it is enabled by a function.
+#
+[global]
 #    ebpf load mode = entry
 #    update every = 1
+    lifetime = 300
diff --git a/collectors/ebpf.plugin/ebpf.d/mount.conf b/collectors/ebpf.plugin/ebpf.d/mount.conf
index fdd82f220..ff9a2948c 100644
--- a/collectors/ebpf.plugin/ebpf.d/mount.conf
+++ b/collectors/ebpf.plugin/ebpf.d/mount.conf
@@ -12,8 +12,12 @@
 #   `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host.
 #   `tracepoint`: When available, the eBPF collector will use kernel tracepoint to monitor syscall.
 #   `probe`     : This is the same as legacy code.
+#
+# The `lifetime` defines the time length a thread will run when it is enabled by a function.
+#
 [global]
 #    ebpf load mode = entry
 #    update every = 1
     ebpf type format = auto
     ebpf co-re tracing = trampoline
+    lifetime = 300
diff --git a/collectors/ebpf.plugin/ebpf.d/network.conf b/collectors/ebpf.plugin/ebpf.d/network.conf
index 75644a772..00cbf2e8b 100644
--- a/collectors/ebpf.plugin/ebpf.d/network.conf
+++ b/collectors/ebpf.plugin/ebpf.d/network.conf
@@ -26,6 +26,8 @@
 #
 # The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
 #
+# The `lifetime` defines the time length a thread will run when it is enabled by a function.
+#
 # Uncomment lines to define specific options for thread.
 [global]
 #    ebpf load mode = entry
@@ -39,6 +41,7 @@
     ebpf type format = auto
     ebpf co-re tracing = trampoline
     maps per core = no
+    lifetime = 300
 
 #
 # Network Connection
diff --git a/collectors/ebpf.plugin/ebpf.d/oomkill.conf b/collectors/ebpf.plugin/ebpf.d/oomkill.conf
index e65e8672c..ea97ebe85 100644
--- a/collectors/ebpf.plugin/ebpf.d/oomkill.conf
+++ b/collectors/ebpf.plugin/ebpf.d/oomkill.conf
@@ -2,6 +2,10 @@
 #  `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
 #  `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
 #            new charts for the return of these functions, such as errors.
-#[global]
+#
+# The `lifetime` defines the time length a thread will run when it is enabled by a function.
+#
+[global]
 #    ebpf load mode = entry
 #    update every = 1
+    lifetime = 300
diff --git a/collectors/ebpf.plugin/ebpf.d/process.conf b/collectors/ebpf.plugin/ebpf.d/process.conf
index f5e8804cd..150c57920 100644
--- a/collectors/ebpf.plugin/ebpf.d/process.conf
+++ b/collectors/ebpf.plugin/ebpf.d/process.conf
@@ -17,6 +17,8 @@
 #
 # The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
 #
+# The `lifetime` defines the time length a thread will run when it is enabled by a function.
+#
 # Uncomment lines to define specific options for thread.
 [global]
 #    ebpf load mode = entry
@@ -26,3 +28,4 @@
 #    pid table size = 32768
     collect pid = real parent
 #    maps per core = yes
+    lifetime = 300
diff --git a/collectors/ebpf.plugin/ebpf.d/shm.conf b/collectors/ebpf.plugin/ebpf.d/shm.conf
index f8ec1a18f..95fb54e0f 100644
--- a/collectors/ebpf.plugin/ebpf.d/shm.conf
+++ b/collectors/ebpf.plugin/ebpf.d/shm.conf
@@ -20,6 +20,8 @@
 #
 # The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
 #
+# The `lifetime` defines the time length a thread will run when it is enabled by a function.
+#
 # Uncomment lines to define specific options for thread.
 [global]
 #    ebpf load mode = entry
@@ -30,6 +32,7 @@
     ebpf type format = auto
     ebpf co-re tracing = trampoline
 #    maps per core = yes
+    lifetime = 300
 
 # List of monitored syscalls
 [syscalls]
diff --git a/collectors/ebpf.plugin/ebpf.d/softirq.conf b/collectors/ebpf.plugin/ebpf.d/softirq.conf
index f2bae1d57..6a47a94bf 100644
--- a/collectors/ebpf.plugin/ebpf.d/softirq.conf
+++ b/collectors/ebpf.plugin/ebpf.d/softirq.conf
@@ -3,6 +3,9 @@
 #  `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
 #            new charts for the return of these functions, such as errors.
 #
-#[global]
+# The `lifetime` defines the time length a thread will run when it is enabled by a function.
+#
+[global]
 #    ebpf load mode = entry
 #    update every = 10
+    lifetime = 300
diff --git a/collectors/ebpf.plugin/ebpf.d/swap.conf b/collectors/ebpf.plugin/ebpf.d/swap.conf
index 5bad04424..29d9b4204 100644
--- a/collectors/ebpf.plugin/ebpf.d/swap.conf
+++ b/collectors/ebpf.plugin/ebpf.d/swap.conf
@@ -19,6 +19,8 @@
 #
 # The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
 #
+# The `lifetime` defines the time length a thread will run when it is enabled by a function.
+#
 # Uncomment lines to define specific options for thread.
 [global]
 #    ebpf load mode = entry
@@ -29,3 +31,4 @@
     ebpf type format = auto
     ebpf co-re tracing = trampoline
 #    maps per core = yes
+    lifetime = 300
diff --git a/collectors/ebpf.plugin/ebpf.d/sync.conf b/collectors/ebpf.plugin/ebpf.d/sync.conf
index fefbd4ee6..a086ed4db 100644
--- a/collectors/ebpf.plugin/ebpf.d/sync.conf
+++ b/collectors/ebpf.plugin/ebpf.d/sync.conf
@@ -19,6 +19,8 @@
 #   `probe`     : This is the same as legacy code.
 #
 # The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
+#
+# The `lifetime` defines the time length a thread will run when it is enabled by a function.
 #  
 # Uncomment lines to define specific options for thread.
 [global]
@@ -29,6 +31,7 @@
     ebpf type format = auto
     ebpf co-re tracing = trampoline
 #    maps per core = yes
+    lifetime = 300
 
 # List of monitored syscalls 
 [syscalls]
diff --git a/collectors/ebpf.plugin/ebpf.d/vfs.conf b/collectors/ebpf.plugin/ebpf.d/vfs.conf
index b4e5daac0..f511581b8 100644
--- a/collectors/ebpf.plugin/ebpf.d/vfs.conf
+++ b/collectors/ebpf.plugin/ebpf.d/vfs.conf
@@ -20,6 +20,8 @@
 #
 # The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
 #
+# The `lifetime` defines the time length a thread will run when it is enabled by a function.
+#
 # Uncomment lines to define specific options for thread.
 [global]
 #    ebpf load mode = entry
@@ -30,3 +32,4 @@
     ebpf type format = auto
     ebpf co-re tracing = trampoline
 #    maps per core = yes
+    lifetime = 300