9 files changed, 41 insertions, 2 deletions
diff --git a/collectors/ebpf.plugin/ebpf.d/cachestat.conf b/collectors/ebpf.plugin/ebpf.d/cachestat.conf
index 52466be51..82f870c98 100644
--- a/collectors/ebpf.plugin/ebpf.d/cachestat.conf
+++ b/collectors/ebpf.plugin/ebpf.d/cachestat.conf
@@ -24,6 +24,8 @@
 #   `parent`     : Only stores parent PID.
 #   `all`        : Stores all PIDs used by software. This is the most expensive option.
 #
+# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
+#
 # Uncomment lines to define specific options for thread.
 [global]
 #    ebpf load mode = entry
@@ -34,3 +36,4 @@
     ebpf type format = auto
     ebpf co-re tracing = trampoline
     collect pid = real parent
+#    maps per core = yes
diff --git a/collectors/ebpf.plugin/ebpf.d/dcstat.conf b/collectors/ebpf.plugin/ebpf.d/dcstat.conf
index 8aed8f783..f741b62a8 100644
--- a/collectors/ebpf.plugin/ebpf.d/dcstat.conf
+++ b/collectors/ebpf.plugin/ebpf.d/dcstat.conf
@@ -22,6 +22,8 @@
 #   `parent`     : Only stores parent PID.
 #   `all`        : Stores all PIDs used by software. This is the most expensive option.
 #
+# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
+#
 # Uncomment lines to define specific options for thread.
 [global]
 #    ebpf load mode = entry
@@ -32,3 +34,4 @@
     ebpf type format = auto
     ebpf co-re tracing = trampoline
     collect pid = real parent
+#    maps per core = yes
diff --git a/collectors/ebpf.plugin/ebpf.d/fd.conf b/collectors/ebpf.plugin/ebpf.d/fd.conf
index 8333520fc..30a5fcfd9 100644
--- a/collectors/ebpf.plugin/ebpf.d/fd.conf
+++ b/collectors/ebpf.plugin/ebpf.d/fd.conf
@@ -10,6 +10,8 @@
 #
 # The `pid table size` defines the maximum number of PIDs stored inside the hash table.
 #
+# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
+#
 # Uncomment lines to define specific options for thread.
 [global]
 #    ebpf load mode = entry
@@ -19,3 +21,4 @@
 #    pid table size = 32768
     ebpf type format = auto
     ebpf co-re tracing = trampoline
+#    maps per core = yes
diff --git a/collectors/ebpf.plugin/ebpf.d/network.conf b/collectors/ebpf.plugin/ebpf.d/network.conf
index d939d8e1f..75644a772 100644
--- a/collectors/ebpf.plugin/ebpf.d/network.conf
+++ b/collectors/ebpf.plugin/ebpf.d/network.conf
@@ -24,6 +24,9 @@
 #   `tracepoint`: When available, the eBPF collector will use kernel tracepoint to monitor syscall.
 #   `probe`     : This is the same as legacy code.
 #
+# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
+#
+# Uncomment lines to define specific options for thread.
 [global]
 #    ebpf load mode = entry
 #    apps = yes
@@ -35,6 +38,7 @@
     udp connection table size = 4096
     ebpf type format = auto
     ebpf co-re tracing = trampoline
+    maps per core = no
 
 #
 # Network Connection
diff --git a/collectors/ebpf.plugin/ebpf.d/process.conf b/collectors/ebpf.plugin/ebpf.d/process.conf
index 1da5f84d3..f5e8804cd 100644
--- a/collectors/ebpf.plugin/ebpf.d/process.conf
+++ b/collectors/ebpf.plugin/ebpf.d/process.conf
@@ -15,11 +15,14 @@
 #   `parent`     : Only stores parent PID.
 #   `all`        : Stores all PIDs used by software. This is the most expensive option.
 #
+# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
+#
 # Uncomment lines to define specific options for thread.
-#[global]
+[global]
 #    ebpf load mode = entry
 #    apps = yes
 #    cgroups = no
 #    update every = 10
 #    pid table size = 32768
-#    collect pid = real parent
+    collect pid = real parent
+#    maps per core = yes
diff --git a/collectors/ebpf.plugin/ebpf.d/shm.conf b/collectors/ebpf.plugin/ebpf.d/shm.conf
index 23ab96da4..f8ec1a18f 100644
--- a/collectors/ebpf.plugin/ebpf.d/shm.conf
+++ b/collectors/ebpf.plugin/ebpf.d/shm.conf
@@ -18,6 +18,8 @@
 #   `tracepoint`: When available, the eBPF collector will use kernel tracepoint to monitor syscall.
 #   `probe`     : This is the same as legacy code.
 #
+# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
+#
 # Uncomment lines to define specific options for thread.
 [global]
 #    ebpf load mode = entry
@@ -27,6 +29,7 @@
 #    pid table size = 32768
     ebpf type format = auto
     ebpf co-re tracing = trampoline
+#    maps per core = yes
 
 # List of monitored syscalls
 [syscalls]
diff --git a/collectors/ebpf.plugin/ebpf.d/swap.conf b/collectors/ebpf.plugin/ebpf.d/swap.conf
index 3986ae4f8..5bad04424 100644
--- a/collectors/ebpf.plugin/ebpf.d/swap.conf
+++ b/collectors/ebpf.plugin/ebpf.d/swap.conf
@@ -17,6 +17,8 @@
 #   `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host.
 #   `probe`     : This is the same as legacy code.
 #
+# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
+#
 # Uncomment lines to define specific options for thread.
 [global]
 #    ebpf load mode = entry
@@ -26,3 +28,4 @@
 #    pid table size = 32768
     ebpf type format = auto
     ebpf co-re tracing = trampoline
+#    maps per core = yes
diff --git a/collectors/ebpf.plugin/ebpf.d/sync.conf b/collectors/ebpf.plugin/ebpf.d/sync.conf
index ebec5d38e..fefbd4ee6 100644
--- a/collectors/ebpf.plugin/ebpf.d/sync.conf
+++ b/collectors/ebpf.plugin/ebpf.d/sync.conf
@@ -17,7 +17,10 @@
 #   `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host.
 #   `tracepoint`: When available, the eBPF collector will use kernel tracepoint to monitor syscall.
 #   `probe`     : This is the same as legacy code.
+#
+# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
 #  
+# Uncomment lines to define specific options for thread.
 [global]
 #    ebpf load mode = entry
 #    apps = yes
@@ -25,6 +28,7 @@
 #    update every = 10
     ebpf type format = auto
     ebpf co-re tracing = trampoline
+#    maps per core = yes
 
 # List of monitored syscalls 
 [syscalls]
diff --git a/collectors/ebpf.plugin/ebpf.d/vfs.conf b/collectors/ebpf.plugin/ebpf.d/vfs.conf
index fa5d5b4e9..b4e5daac0 100644
--- a/collectors/ebpf.plugin/ebpf.d/vfs.conf
+++ b/collectors/ebpf.plugin/ebpf.d/vfs.conf
@@ -8,6 +8,18 @@
 # If you want to disable the integration with `apps.plugin` or `cgroups.plugin` along with the above charts, change
 # the setting `apps` and `cgroups` to  'no'.
 #
+# The `ebpf type format` option accepts the following values :
+#  `auto`  : The eBPF collector will investigate hardware and select between the two next options.
+#  `legacy`: The eBPF collector will load the legacy code. Note: This has a bigger overload.
+#  `co-re` : The eBPF collector will use latest tracing method. Note: This is not available on all platforms.
+#
+# The `ebpf co-re tracing` option accepts the following values: 
+#   `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host.
+#   `tracepoint`: When available, the eBPF collector will use kernel tracepoint to monitor syscall.
+#   `probe`     : This is the same as legacy code.
+#
+# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
+#
 # Uncomment lines to define specific options for thread.
 [global]
 #    ebpf load mode = entry
@@ -17,3 +29,4 @@
 #    pid table size = 32768
     ebpf type format = auto
     ebpf co-re tracing = trampoline
+#    maps per core = yes