1 files changed, 138 insertions, 0 deletions
diff --git a/collectors/ebpf.plugin/ebpf_process.h b/collectors/ebpf.plugin/ebpf_process.h
new file mode 100644
index 000000000..9553434b0
--- /dev/null
+++ b/collectors/ebpf.plugin/ebpf_process.h
@@ -0,0 +1,138 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+#ifndef NETDATA_EBPF_PROCESS_H
+#define NETDATA_EBPF_PROCESS_H 1
+
+// Groups used on Dashboard
+#define NETDATA_FILE_GROUP "File"
+#define NETDATA_VFS_GROUP "VFS"
+#define NETDATA_PROCESS_GROUP "Process"
+
+// Internal constants
+#define NETDATA_GLOBAL_VECTOR 24
+#define NETDATA_MAX_MONITOR_VECTOR 9
+#define NETDATA_VFS_ERRORS 3
+
+// Map index
+#define NETDATA_DEL_START 2
+#define NETDATA_IN_START_BYTE 3
+#define NETDATA_EXIT_START 5
+#define NETDATA_PROCESS_START 7
+
+// Global chart name
+#define NETDATA_FILE_OPEN_CLOSE_COUNT "file_descriptor"
+#define NETDATA_FILE_OPEN_ERR_COUNT "file_error"
+#define NETDATA_VFS_FILE_CLEAN_COUNT "deleted_objects"
+#define NETDATA_VFS_FILE_IO_COUNT "io"
+#define NETDATA_VFS_FILE_ERR_COUNT "io_error"
+
+#define NETDATA_EXIT_SYSCALL "exit"
+#define NETDATA_PROCESS_SYSCALL "process_thread"
+#define NETDATA_PROCESS_ERROR_NAME "task_error"
+#define NETDATA_PROCESS_STATUS_NAME "process_status"
+
+#define NETDATA_VFS_IO_FILE_BYTES "io_bytes"
+#define NETDATA_VFS_DIM_IN_FILE_BYTES "write"
+#define NETDATA_VFS_DIM_OUT_FILE_BYTES "read"
+
+// Charts created on Apps submenu
+#define NETDATA_SYSCALL_APPS_FILE_OPEN "file_open"
+#define NETDATA_SYSCALL_APPS_FILE_CLOSED "file_closed"
+#define NETDATA_SYSCALL_APPS_FILE_DELETED "file_deleted"
+#define NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS "vfs_write_call"
+#define NETDATA_SYSCALL_APPS_VFS_READ_CALLS "vfs_read_call"
+#define NETDATA_SYSCALL_APPS_VFS_WRITE_BYTES "vfs_write_bytes"
+#define NETDATA_SYSCALL_APPS_VFS_READ_BYTES "vfs_read_bytes"
+#define NETDATA_SYSCALL_APPS_TASK_PROCESS "process_create"
+#define NETDATA_SYSCALL_APPS_TASK_THREAD "thread_create"
+#define NETDATA_SYSCALL_APPS_TASK_CLOSE "task_close"
+
+// Charts created on Apps submenu, if and only if, the return mode is active
+
+#define NETDATA_SYSCALL_APPS_FILE_OPEN_ERROR "file_open_error"
+#define NETDATA_SYSCALL_APPS_FILE_CLOSE_ERROR "file_close_error"
+#define NETDATA_SYSCALL_APPS_VFS_WRITE_CALLS_ERROR "vfs_write_error"
+#define NETDATA_SYSCALL_APPS_VFS_READ_CALLS_ERROR "vfs_read_error"
+
+// Index from kernel
+typedef enum ebpf_process_index {
+    NETDATA_KEY_CALLS_DO_SYS_OPEN,
+    NETDATA_KEY_ERROR_DO_SYS_OPEN,
+
+    NETDATA_KEY_CALLS_VFS_WRITE,
+    NETDATA_KEY_ERROR_VFS_WRITE,
+    NETDATA_KEY_BYTES_VFS_WRITE,
+
+    NETDATA_KEY_CALLS_VFS_READ,
+    NETDATA_KEY_ERROR_VFS_READ,
+    NETDATA_KEY_BYTES_VFS_READ,
+
+    NETDATA_KEY_CALLS_VFS_UNLINK,
+    NETDATA_KEY_ERROR_VFS_UNLINK,
+
+    NETDATA_KEY_CALLS_DO_EXIT,
+
+    NETDATA_KEY_CALLS_RELEASE_TASK,
+
+    NETDATA_KEY_CALLS_DO_FORK,
+    NETDATA_KEY_ERROR_DO_FORK,
+
+    NETDATA_KEY_CALLS_CLOSE_FD,
+    NETDATA_KEY_ERROR_CLOSE_FD,
+
+    NETDATA_KEY_CALLS_SYS_CLONE,
+    NETDATA_KEY_ERROR_SYS_CLONE,
+
+    NETDATA_KEY_CALLS_VFS_WRITEV,
+    NETDATA_KEY_ERROR_VFS_WRITEV,
+    NETDATA_KEY_BYTES_VFS_WRITEV,
+
+    NETDATA_KEY_CALLS_VFS_READV,
+    NETDATA_KEY_ERROR_VFS_READV,
+    NETDATA_KEY_BYTES_VFS_READV
+
+} ebpf_process_index_t;
+
+typedef struct ebpf_process_publish_apps {
+    // Number of calls during the last read
+    uint64_t call_sys_open;
+    uint64_t call_close_fd;
+    uint64_t call_vfs_unlink;
+    uint64_t call_read;
+    uint64_t call_write;
+    uint64_t call_do_exit;
+    uint64_t call_release_task;
+    uint64_t call_do_fork;
+    uint64_t call_sys_clone;
+
+    // Number of errors during the last read
+    uint64_t ecall_sys_open;
+    uint64_t ecall_close_fd;
+    uint64_t ecall_vfs_unlink;
+    uint64_t ecall_read;
+    uint64_t ecall_write;
+    uint64_t ecall_do_fork;
+    uint64_t ecall_sys_clone;
+
+    // Number of bytes during the last read
+    uint64_t bytes_written;
+    uint64_t bytes_read;
+
+    // Dimensions sent to chart
+    uint64_t publish_open;
+    uint64_t publish_closed;
+    uint64_t publish_deleted;
+    uint64_t publish_write_call;
+    uint64_t publish_write_bytes;
+    uint64_t publish_read_call;
+    uint64_t publish_read_bytes;
+    uint64_t publish_process;
+    uint64_t publish_thread;
+    uint64_t publish_task;
+    uint64_t publish_open_error;
+    uint64_t publish_close_error;
+    uint64_t publish_write_error;
+    uint64_t publish_read_error;
+} ebpf_process_publish_apps_t;
+
+#endif /* NETDATA_EBPF_PROCESS_H */