From dd24e74edfbafc09eaeb2dde0fda7eb3e1e86d0b Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Wed, 14 Jun 2023 21:20:36 +0200 Subject: Merging upstream version 1.40.0. Signed-off-by: Daniel Baumann --- collectors/ebpf.plugin/ebpf.d/cachestat.conf | 3 +++ collectors/ebpf.plugin/ebpf.d/dcstat.conf | 3 +++ collectors/ebpf.plugin/ebpf.d/fd.conf | 3 +++ collectors/ebpf.plugin/ebpf.d/network.conf | 4 ++++ collectors/ebpf.plugin/ebpf.d/process.conf | 7 +++++-- collectors/ebpf.plugin/ebpf.d/shm.conf | 3 +++ collectors/ebpf.plugin/ebpf.d/swap.conf | 3 +++ collectors/ebpf.plugin/ebpf.d/sync.conf | 4 ++++ collectors/ebpf.plugin/ebpf.d/vfs.conf | 13 +++++++++++++ 9 files changed, 41 insertions(+), 2 deletions(-) (limited to 'collectors/ebpf.plugin/ebpf.d') diff --git a/collectors/ebpf.plugin/ebpf.d/cachestat.conf b/collectors/ebpf.plugin/ebpf.d/cachestat.conf index 52466be51..82f870c98 100644 --- a/collectors/ebpf.plugin/ebpf.d/cachestat.conf +++ b/collectors/ebpf.plugin/ebpf.d/cachestat.conf @@ -24,6 +24,8 @@ # `parent` : Only stores parent PID. # `all` : Stores all PIDs used by software. This is the most expensive option. # +# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6. +# # Uncomment lines to define specific options for thread. [global] # ebpf load mode = entry @@ -34,3 +36,4 @@ ebpf type format = auto ebpf co-re tracing = trampoline collect pid = real parent +# maps per core = yes diff --git a/collectors/ebpf.plugin/ebpf.d/dcstat.conf b/collectors/ebpf.plugin/ebpf.d/dcstat.conf index 8aed8f783..f741b62a8 100644 --- a/collectors/ebpf.plugin/ebpf.d/dcstat.conf +++ b/collectors/ebpf.plugin/ebpf.d/dcstat.conf @@ -22,6 +22,8 @@ # `parent` : Only stores parent PID. # `all` : Stores all PIDs used by software. This is the most expensive option. # +# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6. +# # Uncomment lines to define specific options for thread. [global] # ebpf load mode = entry @@ -32,3 +34,4 @@ ebpf type format = auto ebpf co-re tracing = trampoline collect pid = real parent +# maps per core = yes diff --git a/collectors/ebpf.plugin/ebpf.d/fd.conf b/collectors/ebpf.plugin/ebpf.d/fd.conf index 8333520fc..30a5fcfd9 100644 --- a/collectors/ebpf.plugin/ebpf.d/fd.conf +++ b/collectors/ebpf.plugin/ebpf.d/fd.conf @@ -10,6 +10,8 @@ # # The `pid table size` defines the maximum number of PIDs stored inside the hash table. # +# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6. +# # Uncomment lines to define specific options for thread. [global] # ebpf load mode = entry @@ -19,3 +21,4 @@ # pid table size = 32768 ebpf type format = auto ebpf co-re tracing = trampoline +# maps per core = yes diff --git a/collectors/ebpf.plugin/ebpf.d/network.conf b/collectors/ebpf.plugin/ebpf.d/network.conf index d939d8e1f..75644a772 100644 --- a/collectors/ebpf.plugin/ebpf.d/network.conf +++ b/collectors/ebpf.plugin/ebpf.d/network.conf @@ -24,6 +24,9 @@ # `tracepoint`: When available, the eBPF collector will use kernel tracepoint to monitor syscall. # `probe` : This is the same as legacy code. # +# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6. +# +# Uncomment lines to define specific options for thread. [global] # ebpf load mode = entry # apps = yes @@ -35,6 +38,7 @@ udp connection table size = 4096 ebpf type format = auto ebpf co-re tracing = trampoline + maps per core = no # # Network Connection diff --git a/collectors/ebpf.plugin/ebpf.d/process.conf b/collectors/ebpf.plugin/ebpf.d/process.conf index 1da5f84d3..f5e8804cd 100644 --- a/collectors/ebpf.plugin/ebpf.d/process.conf +++ b/collectors/ebpf.plugin/ebpf.d/process.conf @@ -15,11 +15,14 @@ # `parent` : Only stores parent PID. # `all` : Stores all PIDs used by software. This is the most expensive option. # +# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6. +# # Uncomment lines to define specific options for thread. -#[global] +[global] # ebpf load mode = entry # apps = yes # cgroups = no # update every = 10 # pid table size = 32768 -# collect pid = real parent + collect pid = real parent +# maps per core = yes diff --git a/collectors/ebpf.plugin/ebpf.d/shm.conf b/collectors/ebpf.plugin/ebpf.d/shm.conf index 23ab96da4..f8ec1a18f 100644 --- a/collectors/ebpf.plugin/ebpf.d/shm.conf +++ b/collectors/ebpf.plugin/ebpf.d/shm.conf @@ -18,6 +18,8 @@ # `tracepoint`: When available, the eBPF collector will use kernel tracepoint to monitor syscall. # `probe` : This is the same as legacy code. # +# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6. +# # Uncomment lines to define specific options for thread. [global] # ebpf load mode = entry @@ -27,6 +29,7 @@ # pid table size = 32768 ebpf type format = auto ebpf co-re tracing = trampoline +# maps per core = yes # List of monitored syscalls [syscalls] diff --git a/collectors/ebpf.plugin/ebpf.d/swap.conf b/collectors/ebpf.plugin/ebpf.d/swap.conf index 3986ae4f8..5bad04424 100644 --- a/collectors/ebpf.plugin/ebpf.d/swap.conf +++ b/collectors/ebpf.plugin/ebpf.d/swap.conf @@ -17,6 +17,8 @@ # `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host. # `probe` : This is the same as legacy code. # +# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6. +# # Uncomment lines to define specific options for thread. [global] # ebpf load mode = entry @@ -26,3 +28,4 @@ # pid table size = 32768 ebpf type format = auto ebpf co-re tracing = trampoline +# maps per core = yes diff --git a/collectors/ebpf.plugin/ebpf.d/sync.conf b/collectors/ebpf.plugin/ebpf.d/sync.conf index ebec5d38e..fefbd4ee6 100644 --- a/collectors/ebpf.plugin/ebpf.d/sync.conf +++ b/collectors/ebpf.plugin/ebpf.d/sync.conf @@ -17,7 +17,10 @@ # `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host. # `tracepoint`: When available, the eBPF collector will use kernel tracepoint to monitor syscall. # `probe` : This is the same as legacy code. +# +# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6. # +# Uncomment lines to define specific options for thread. [global] # ebpf load mode = entry # apps = yes @@ -25,6 +28,7 @@ # update every = 10 ebpf type format = auto ebpf co-re tracing = trampoline +# maps per core = yes # List of monitored syscalls [syscalls] diff --git a/collectors/ebpf.plugin/ebpf.d/vfs.conf b/collectors/ebpf.plugin/ebpf.d/vfs.conf index fa5d5b4e9..b4e5daac0 100644 --- a/collectors/ebpf.plugin/ebpf.d/vfs.conf +++ b/collectors/ebpf.plugin/ebpf.d/vfs.conf @@ -8,6 +8,18 @@ # If you want to disable the integration with `apps.plugin` or `cgroups.plugin` along with the above charts, change # the setting `apps` and `cgroups` to 'no'. # +# The `ebpf type format` option accepts the following values : +# `auto` : The eBPF collector will investigate hardware and select between the two next options. +# `legacy`: The eBPF collector will load the legacy code. Note: This has a bigger overload. +# `co-re` : The eBPF collector will use latest tracing method. Note: This is not available on all platforms. +# +# The `ebpf co-re tracing` option accepts the following values: +# `trampoline`: This is the default mode used by the eBPF collector, due the small overhead added to host. +# `tracepoint`: When available, the eBPF collector will use kernel tracepoint to monitor syscall. +# `probe` : This is the same as legacy code. +# +# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.6. +# # Uncomment lines to define specific options for thread. [global] # ebpf load mode = entry @@ -17,3 +29,4 @@ # pid table size = 32768 ebpf type format = auto ebpf co-re tracing = trampoline +# maps per core = yes -- cgit v1.2.3