summaryrefslogtreecommitdiffstats
path: root/collectors/ebpf.plugin/ebpf.d
diff options
context:
space:
mode:
Diffstat (limited to 'collectors/ebpf.plugin/ebpf.d')
-rw-r--r--collectors/ebpf.plugin/ebpf.d/cachestat.conf42
-rw-r--r--collectors/ebpf.plugin/ebpf.d/dcstat.conf40
-rw-r--r--collectors/ebpf.plugin/ebpf.d/disk.conf12
-rw-r--r--collectors/ebpf.plugin/ebpf.d/ebpf_kernel_reject_list.txt1
-rw-r--r--collectors/ebpf.plugin/ebpf.d/fd.conf27
-rw-r--r--collectors/ebpf.plugin/ebpf.d/filesystem.conf23
-rw-r--r--collectors/ebpf.plugin/ebpf.d/functions.conf3
-rw-r--r--collectors/ebpf.plugin/ebpf.d/hardirq.conf11
-rw-r--r--collectors/ebpf.plugin/ebpf.d/mdflush.conf11
-rw-r--r--collectors/ebpf.plugin/ebpf.d/mount.conf23
-rw-r--r--collectors/ebpf.plugin/ebpf.d/network.conf66
-rw-r--r--collectors/ebpf.plugin/ebpf.d/oomkill.conf11
-rw-r--r--collectors/ebpf.plugin/ebpf.d/process.conf31
-rw-r--r--collectors/ebpf.plugin/ebpf.d/shm.conf42
-rw-r--r--collectors/ebpf.plugin/ebpf.d/softirq.conf11
-rw-r--r--collectors/ebpf.plugin/ebpf.d/swap.conf34
-rw-r--r--collectors/ebpf.plugin/ebpf.d/sync.conf43
-rw-r--r--collectors/ebpf.plugin/ebpf.d/vfs.conf35
18 files changed, 0 insertions, 466 deletions
diff --git a/collectors/ebpf.plugin/ebpf.d/cachestat.conf b/collectors/ebpf.plugin/ebpf.d/cachestat.conf
deleted file mode 100644
index 9c51b2c5..00000000
--- a/collectors/ebpf.plugin/ebpf.d/cachestat.conf
+++ /dev/null
@@ -1,42 +0,0 @@
-# The `ebpf load mode` option accepts the following values :
-# `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
-# `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
-# new charts for the return of these functions, such as errors.
-#
-# The eBPF collector also creates charts for each running application through an integration with the `apps.plugin`
-# or `cgroups.plugin`.
-# If you want to disable the integration with `apps.plugin` or `cgroups.plugin` along with the above charts, change
-# the setting `apps` and `cgroups` to 'no'.
-#
-# The `pid table size` defines the maximum number of PIDs stored inside the application hash table.
-#
-# The `ebpf type format` option accepts the following values :
-# `auto` : The eBPF collector will investigate hardware and select between the two next options.
-# `legacy`: The eBPF collector will load the legacy code. Note: This has a bigger overload.
-# `co-re` : The eBPF collector will use latest tracing method. Note: This is not available on all platforms.
-#
-# The `ebpf co-re tracing` option accepts the following values:
-# `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host.
-# `probe` : This is the same as legacy code.
-#
-# The `collect pid` option defines the PID stored inside hash tables and accepts the following options:
-# `real parent`: Only stores real parent inside PID
-# `parent` : Only stores parent PID.
-# `all` : Stores all PIDs used by software. This is the most expensive option.
-#
-# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
-#
-# The `lifetime` defines the time length a thread will run when it is enabled by a function.
-#
-# Uncomment lines to define specific options for thread.
-[global]
-# ebpf load mode = entry
-# apps = yes
-# cgroups = no
-# update every = 10
-# pid table size = 32768
- ebpf type format = auto
- ebpf co-re tracing = trampoline
- collect pid = real parent
-# maps per core = yes
- lifetime = 300
diff --git a/collectors/ebpf.plugin/ebpf.d/dcstat.conf b/collectors/ebpf.plugin/ebpf.d/dcstat.conf
deleted file mode 100644
index 614d814e..00000000
--- a/collectors/ebpf.plugin/ebpf.d/dcstat.conf
+++ /dev/null
@@ -1,40 +0,0 @@
-# The `ebpf load mode` option accepts the following values :
-# `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
-# `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
-# new charts for the return of these functions, such as errors.
-#
-# The eBPF collector also creates charts for each running application through an integration with the `apps.plugin`
-# or `cgroups.plugin`.
-# If you want to disable the integration with `apps.plugin` or `cgroups.plugin` along with the above charts, change
-# the setting `apps` and `cgroups` to 'no'.
-#
-# The `ebpf type format` option accepts the following values :
-# `auto` : The eBPF collector will investigate hardware and select between the two next options.
-# `legacy`: The eBPF collector will load the legacy code. Note: This has a bigger overload.
-# `co-re` : The eBPF collector will use latest tracing method. Note: This is not available on all platforms.
-#
-# The `ebpf co-re tracing` option accepts the following values:
-# `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host.
-# `probe` : This is the same as legacy code.
-#
-# The `collect pid` option defines the PID stored inside hash tables and accepts the following options:
-# `real parent`: Only stores real parent inside PID
-# `parent` : Only stores parent PID.
-# `all` : Stores all PIDs used by software. This is the most expensive option.
-#
-# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
-#
-# The `lifetime` defines the time length a thread will run when it is enabled by a function.
-#
-# Uncomment lines to define specific options for thread.
-[global]
-# ebpf load mode = entry
-# apps = yes
-# cgroups = no
-# update every = 10
-# pid table size = 32768
- ebpf type format = auto
- ebpf co-re tracing = trampoline
- collect pid = real parent
-# maps per core = yes
- lifetime = 300
diff --git a/collectors/ebpf.plugin/ebpf.d/disk.conf b/collectors/ebpf.plugin/ebpf.d/disk.conf
deleted file mode 100644
index c5a0a270..00000000
--- a/collectors/ebpf.plugin/ebpf.d/disk.conf
+++ /dev/null
@@ -1,12 +0,0 @@
-# The `ebpf load mode` option accepts the following values :
-# `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
-# `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
-# new charts for the return of these functions, such as errors.
-#
-# The `lifetime` defines the time length a thread will run when it is enabled by a function.
-#
-[global]
-# ebpf load mode = entry
-# update every = 10
- lifetime = 300
-
diff --git a/collectors/ebpf.plugin/ebpf.d/ebpf_kernel_reject_list.txt b/collectors/ebpf.plugin/ebpf.d/ebpf_kernel_reject_list.txt
deleted file mode 100644
index 539bf357..00000000
--- a/collectors/ebpf.plugin/ebpf.d/ebpf_kernel_reject_list.txt
+++ /dev/null
@@ -1 +0,0 @@
-Ubuntu 4.18.0
diff --git a/collectors/ebpf.plugin/ebpf.d/fd.conf b/collectors/ebpf.plugin/ebpf.d/fd.conf
deleted file mode 100644
index d4823032..00000000
--- a/collectors/ebpf.plugin/ebpf.d/fd.conf
+++ /dev/null
@@ -1,27 +0,0 @@
-# The `ebpf load mode` option accepts the following values :
-# `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
-# `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
-# new charts for the return of these functions, such as errors.
-#
-# The eBPF collector also creates charts for each running application through an integration with the `apps.plugin`
-# or `cgroups.plugin`.
-# If you want to disable the integration with `apps.plugin` or `cgroups.plugin` along with the above charts, change
-# the setting `apps` and `cgroups` to 'no'.
-#
-# The `pid table size` defines the maximum number of PIDs stored inside the hash table.
-#
-# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
-#
-# The `lifetime` defines the time length a thread will run when it is enabled by a function.
-#
-# Uncomment lines to define specific options for thread.
-[global]
-# ebpf load mode = entry
-# apps = yes
-# cgroups = no
-# update every = 10
-# pid table size = 32768
- ebpf type format = auto
- ebpf co-re tracing = trampoline
-# maps per core = yes
- lifetime = 300
diff --git a/collectors/ebpf.plugin/ebpf.d/filesystem.conf b/collectors/ebpf.plugin/ebpf.d/filesystem.conf
deleted file mode 100644
index 209abba7..00000000
--- a/collectors/ebpf.plugin/ebpf.d/filesystem.conf
+++ /dev/null
@@ -1,23 +0,0 @@
-# The `ebpf load mode` option accepts the following values :
-# `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
-# `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
-# new charts for the return of these functions, such as errors.
-#
-# The `lifetime` defines the time length a thread will run when it is enabled by a function.
-#
-# The eBPF collector also creates charts for each running application through an integration with the `apps plugin`.
-# If you want to disable the integration with `apps.plugin` along with the above charts, change the setting `apps` to
-# 'no'.
-#
-[global]
-# ebpf load mode = entry
-# update every = 10
- lifetime = 300
-
-# All filesystems are named as 'NAMEdist' where NAME is the filesystem name while 'dist' is a reference for distribution.
-[filesystem]
- btrfsdist = yes
- ext4dist = yes
- nfsdist = yes
- xfsdist = yes
- zfsdist = yes
diff --git a/collectors/ebpf.plugin/ebpf.d/functions.conf b/collectors/ebpf.plugin/ebpf.d/functions.conf
deleted file mode 100644
index a4f57f64..00000000
--- a/collectors/ebpf.plugin/ebpf.d/functions.conf
+++ /dev/null
@@ -1,3 +0,0 @@
-#[global]
-# update every = 5
-
diff --git a/collectors/ebpf.plugin/ebpf.d/hardirq.conf b/collectors/ebpf.plugin/ebpf.d/hardirq.conf
deleted file mode 100644
index 6a47a94b..00000000
--- a/collectors/ebpf.plugin/ebpf.d/hardirq.conf
+++ /dev/null
@@ -1,11 +0,0 @@
-# The `ebpf load mode` option accepts the following values :
-# `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
-# `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
-# new charts for the return of these functions, such as errors.
-#
-# The `lifetime` defines the time length a thread will run when it is enabled by a function.
-#
-[global]
-# ebpf load mode = entry
-# update every = 10
- lifetime = 300
diff --git a/collectors/ebpf.plugin/ebpf.d/mdflush.conf b/collectors/ebpf.plugin/ebpf.d/mdflush.conf
deleted file mode 100644
index ea97ebe8..00000000
--- a/collectors/ebpf.plugin/ebpf.d/mdflush.conf
+++ /dev/null
@@ -1,11 +0,0 @@
-# The `ebpf load mode` option accepts the following values :
-# `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
-# `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
-# new charts for the return of these functions, such as errors.
-#
-# The `lifetime` defines the time length a thread will run when it is enabled by a function.
-#
-[global]
-# ebpf load mode = entry
-# update every = 1
- lifetime = 300
diff --git a/collectors/ebpf.plugin/ebpf.d/mount.conf b/collectors/ebpf.plugin/ebpf.d/mount.conf
deleted file mode 100644
index ff9a2948..00000000
--- a/collectors/ebpf.plugin/ebpf.d/mount.conf
+++ /dev/null
@@ -1,23 +0,0 @@
-# The `ebpf load mode` option accepts the following values :
-# `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
-# `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
-# new charts for the return of these functions, such as errors.
-#
-# The `ebpf type format` option accepts the following values :
-# `auto` : The eBPF collector will investigate hardware and select between the two next options.
-# `legacy`: The eBPF collector will load the legacy code. Note: This has a bigger overload.
-# `co-re` : The eBPF collector will use latest tracing method. Note: This is not available on all platforms.
-#
-# The `ebpf co-re tracing` option accepts the following values:
-# `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host.
-# `tracepoint`: When available, the eBPF collector will use kernel tracepoint to monitor syscall.
-# `probe` : This is the same as legacy code.
-#
-# The `lifetime` defines the time length a thread will run when it is enabled by a function.
-#
-[global]
-# ebpf load mode = entry
-# update every = 1
- ebpf type format = auto
- ebpf co-re tracing = trampoline
- lifetime = 300
diff --git a/collectors/ebpf.plugin/ebpf.d/network.conf b/collectors/ebpf.plugin/ebpf.d/network.conf
deleted file mode 100644
index 99c32edc..00000000
--- a/collectors/ebpf.plugin/ebpf.d/network.conf
+++ /dev/null
@@ -1,66 +0,0 @@
-# The `ebpf load mode` option accepts the following values :
-# `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
-# `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
-# new charts for the return of these functions, such as errors.
-#
-# The eBPF collector also creates charts for each running application through an integration with the `apps.plugin`
-# or `cgroups.plugin`.
-# If you want to disable the integration with `apps.plugin` or `cgroups.plugin` along with the above charts, change
-# the setting `apps` and `cgroups` to 'no'.
-#
-# The following options change the hash table size:
-# `bandwidth table size`: Maximum number of connections monitored
-# `ipv4 connection table size`: Maximum number of IPV4 connections monitored
-# `ipv6 connection table size`: Maximum number of IPV6 connections monitored
-# `udp connection table size`: Maximum number of UDP connections monitored
-#
-# The `ebpf type format` option accepts the following values :
-# `auto` : The eBPF collector will investigate hardware and select between the two next options.
-# `legacy`: The eBPF collector will load the legacy code. Note: This has a bigger overload.
-# `co-re` : The eBPF collector will use latest tracing method. Note: This is not available on all platforms.
-#
-# The `ebpf co-re tracing` option accepts the following values:
-# `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host.
-# `tracepoint`: When available, the eBPF collector will use kernel tracepoint to monitor syscall.
-# `probe` : This is the same as legacy code.
-#
-# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
-#
-# The `collect pid` option defines the PID stored inside hash tables and accepts the following options:
-# `real parent`: Only stores real parent inside PID
-# `parent` : Only stores parent PID.
-# `all` : Stores all PIDs used by software. This is the most expensive option.
-#
-# The `lifetime` defines the time length a thread will run when it is enabled by a function.
-#
-# Uncomment lines to define specific options for thread.
-[global]
-# ebpf load mode = entry
-# apps = yes
-# cgroups = no
-# update every = 10
- bandwidth table size = 16384
- socket monitoring table size = 16384
- udp connection table size = 4096
- ebpf type format = auto
- ebpf co-re tracing = probe
- maps per core = no
- collect pid = all
- lifetime = 300
-
-#
-# Network Connection
-#
-# This is a feature with status WIP(Work in Progress)
-#
-[network connections]
- enabled = yes
- resolve hostnames = no
- resolve service names = yes
- ports = *
-# ips = !127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 fc00::/7 !::1/128
- ips = *
- hostnames = *
-
-[service name]
- 19999 = Netdata
diff --git a/collectors/ebpf.plugin/ebpf.d/oomkill.conf b/collectors/ebpf.plugin/ebpf.d/oomkill.conf
deleted file mode 100644
index ea97ebe8..00000000
--- a/collectors/ebpf.plugin/ebpf.d/oomkill.conf
+++ /dev/null
@@ -1,11 +0,0 @@
-# The `ebpf load mode` option accepts the following values :
-# `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
-# `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
-# new charts for the return of these functions, such as errors.
-#
-# The `lifetime` defines the time length a thread will run when it is enabled by a function.
-#
-[global]
-# ebpf load mode = entry
-# update every = 1
- lifetime = 300
diff --git a/collectors/ebpf.plugin/ebpf.d/process.conf b/collectors/ebpf.plugin/ebpf.d/process.conf
deleted file mode 100644
index 150c5792..00000000
--- a/collectors/ebpf.plugin/ebpf.d/process.conf
+++ /dev/null
@@ -1,31 +0,0 @@
-# The `ebpf load mode` option accepts the following values :
-# `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
-# `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
-# new charts for the return of these functions, such as errors.
-#
-# The eBPF collector also creates charts for each running application through an integration with the `apps.plugin`
-# or `cgroups.plugin`.
-# If you want to disable the integration with `apps.plugin` or `cgroups.plugin` along with the above charts, change
-# the setting `apps` and `cgroups` to 'no'.
-#
-# The `pid table size` defines the maximum number of PIDs stored inside the hash table.
-#
-# The `collect pid` option defines the PID stored inside hash tables and accepts the following options:
-# `real parent`: Only stores real parent inside PID
-# `parent` : Only stores parent PID.
-# `all` : Stores all PIDs used by software. This is the most expensive option.
-#
-# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
-#
-# The `lifetime` defines the time length a thread will run when it is enabled by a function.
-#
-# Uncomment lines to define specific options for thread.
-[global]
-# ebpf load mode = entry
-# apps = yes
-# cgroups = no
-# update every = 10
-# pid table size = 32768
- collect pid = real parent
-# maps per core = yes
- lifetime = 300
diff --git a/collectors/ebpf.plugin/ebpf.d/shm.conf b/collectors/ebpf.plugin/ebpf.d/shm.conf
deleted file mode 100644
index 95fb54e0..00000000
--- a/collectors/ebpf.plugin/ebpf.d/shm.conf
+++ /dev/null
@@ -1,42 +0,0 @@
-# The `ebpf load mode` option accepts the following values :
-# `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
-# `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
-# new charts for the return of these functions, such as errors.
-#
-# The eBPF collector also creates charts for each running application through an integration with the `apps.plugin`
-# or `cgroups.plugin`.
-# If you want to disable the integration with `apps.plugin` or `cgroups.plugin` along with the above charts, change
-# the setting `apps` and `cgroups` to 'no'.
-#
-# The `ebpf type format` option accepts the following values :
-# `auto` : The eBPF collector will investigate hardware and select between the two next options.
-# `legacy`: The eBPF collector will load the legacy code. Note: This has a bigger overload.
-# `co-re` : The eBPF collector will use latest tracing method. Note: This is not available on all platforms.
-#
-# The `ebpf co-re tracing` option accepts the following values:
-# `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host.
-# `tracepoint`: When available, the eBPF collector will use kernel tracepoint to monitor syscall.
-# `probe` : This is the same as legacy code.
-#
-# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
-#
-# The `lifetime` defines the time length a thread will run when it is enabled by a function.
-#
-# Uncomment lines to define specific options for thread.
-[global]
-# ebpf load mode = entry
-# apps = yes
-# cgroups = no
-# update every = 10
-# pid table size = 32768
- ebpf type format = auto
- ebpf co-re tracing = trampoline
-# maps per core = yes
- lifetime = 300
-
-# List of monitored syscalls
-[syscalls]
- shmget = yes
- shmat = yes
- shmdt = yes
- shmctl = yes
diff --git a/collectors/ebpf.plugin/ebpf.d/softirq.conf b/collectors/ebpf.plugin/ebpf.d/softirq.conf
deleted file mode 100644
index 6a47a94b..00000000
--- a/collectors/ebpf.plugin/ebpf.d/softirq.conf
+++ /dev/null
@@ -1,11 +0,0 @@
-# The `ebpf load mode` option accepts the following values :
-# `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
-# `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
-# new charts for the return of these functions, such as errors.
-#
-# The `lifetime` defines the time length a thread will run when it is enabled by a function.
-#
-[global]
-# ebpf load mode = entry
-# update every = 10
- lifetime = 300
diff --git a/collectors/ebpf.plugin/ebpf.d/swap.conf b/collectors/ebpf.plugin/ebpf.d/swap.conf
deleted file mode 100644
index 29d9b420..00000000
--- a/collectors/ebpf.plugin/ebpf.d/swap.conf
+++ /dev/null
@@ -1,34 +0,0 @@
-# The `ebpf load mode` option accepts the following values :
-# `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
-# `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
-# new charts for the return of these functions, such as errors.
-#
-# The eBPF collector also creates charts for each running application through an integration with the `apps.plugin`
-# or `cgroups.plugin`.
-# If you want to disable the integration with `apps.plugin` or `cgroups.plugin` along with the above charts, change
-# the setting `apps` and `cgroups` to 'no'.
-#
-# The `ebpf type format` option accepts the following values :
-# `auto` : The eBPF collector will investigate hardware and select between the two next options.
-# `legacy`: The eBPF collector will load the legacy code. Note: This has a bigger overload.
-# `co-re` : The eBPF collector will use latest tracing method. Note: This is not available on all platforms.
-#
-# The `ebpf co-re tracing` option accepts the following values:
-# `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host.
-# `probe` : This is the same as legacy code.
-#
-# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
-#
-# The `lifetime` defines the time length a thread will run when it is enabled by a function.
-#
-# Uncomment lines to define specific options for thread.
-[global]
-# ebpf load mode = entry
-# apps = yes
-# cgroups = no
-# update every = 10
-# pid table size = 32768
- ebpf type format = auto
- ebpf co-re tracing = trampoline
-# maps per core = yes
- lifetime = 300
diff --git a/collectors/ebpf.plugin/ebpf.d/sync.conf b/collectors/ebpf.plugin/ebpf.d/sync.conf
deleted file mode 100644
index a086ed4d..00000000
--- a/collectors/ebpf.plugin/ebpf.d/sync.conf
+++ /dev/null
@@ -1,43 +0,0 @@
-# The `ebpf load mode` option accepts the following values :
-# `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
-# `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
-# new charts for the return of these functions, such as errors.
-#
-# The eBPF collector also creates charts for each running application through an integration with the `apps.plugin`
-# or `cgroups.plugin`.
-# If you want to disable the integration with `apps.plugin` or `cgroups.plugin` along with the above charts, change
-# the setting `apps` and `cgroups` to 'no'.
-#
-# The `ebpf type format` option accepts the following values :
-# `auto` : The eBPF collector will investigate hardware and select between the two next options.
-# `legacy`: The eBPF collector will load the legacy code. Note: This has a bigger overload.
-# `co-re` : The eBPF collector will use latest tracing method. Note: This is not available on all platforms.
-#
-# The `ebpf co-re tracing` option accepts the following values:
-# `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host.
-# `tracepoint`: When available, the eBPF collector will use kernel tracepoint to monitor syscall.
-# `probe` : This is the same as legacy code.
-#
-# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
-#
-# The `lifetime` defines the time length a thread will run when it is enabled by a function.
-#
-# Uncomment lines to define specific options for thread.
-[global]
-# ebpf load mode = entry
-# apps = yes
-# cgroups = no
-# update every = 10
- ebpf type format = auto
- ebpf co-re tracing = trampoline
-# maps per core = yes
- lifetime = 300
-
-# List of monitored syscalls
-[syscalls]
- sync = yes
- msync = yes
- fsync = yes
- fdatasync = yes
- syncfs = yes
- sync_file_range = yes
diff --git a/collectors/ebpf.plugin/ebpf.d/vfs.conf b/collectors/ebpf.plugin/ebpf.d/vfs.conf
deleted file mode 100644
index f511581b..00000000
--- a/collectors/ebpf.plugin/ebpf.d/vfs.conf
+++ /dev/null
@@ -1,35 +0,0 @@
-# The `ebpf load mode` option accepts the following values :
-# `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
-# `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
-# new charts for the return of these functions, such as errors.
-#
-# The eBPF collector also creates charts for each running application through an integration with the `apps.plugin`
-# or `cgroups.plugin`.
-# If you want to disable the integration with `apps.plugin` or `cgroups.plugin` along with the above charts, change
-# the setting `apps` and `cgroups` to 'no'.
-#
-# The `ebpf type format` option accepts the following values :
-# `auto` : The eBPF collector will investigate hardware and select between the two next options.
-# `legacy`: The eBPF collector will load the legacy code. Note: This has a bigger overload.
-# `co-re` : The eBPF collector will use latest tracing method. Note: This is not available on all platforms.
-#
-# The `ebpf co-re tracing` option accepts the following values:
-# `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host.
-# `tracepoint`: When available, the eBPF collector will use kernel tracepoint to monitor syscall.
-# `probe` : This is the same as legacy code.
-#
-# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6.
-#
-# The `lifetime` defines the time length a thread will run when it is enabled by a function.
-#
-# Uncomment lines to define specific options for thread.
-[global]
-# ebpf load mode = entry
-# apps = yes
-# cgroups = no
-# update every = 10
-# pid table size = 32768
- ebpf type format = auto
- ebpf co-re tracing = trampoline
-# maps per core = yes
- lifetime = 300