#
# Global options
#
# The `ebpf load mode` option accepts the following values :
#  `entry` : The eBPF collector only monitors calls for the functions, and does not show charts related to errors.
#  `return : In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
#            new charts for the return of these functions, such as errors.
#
# The eBPF collector also creates charts for each running application through an integration with the `apps.plugin`
# or `cgroups.plugin`.
# If you want to disable the integration with `apps.plugin` or `cgroups.plugin` along with the above charts, change the setting 
# `apps` and `cgroups` to  'no'.
#
# The `update every` option defines the number of seconds used to read data from kernel and send to netdata.
# The configuration value takes precedence over the runtime interval passed by pluginsd.
#
# The `pid table size` defines the maximum number of PIDs stored in the application hash tables.
#
# The `btf path` specifies where to find the BTF files.
#
# The `ebpf object flavor` option selects the eBPF object file family:
#  `arena`  : Use the BPF arena object flavor when available.
#  `buffer` : Use the ring-buffer object flavor when available (aliases: `buffer ring`, `ring buffer`).
#  `legacy` : Use the legacy tracing object files (alias: `tracing`).
# If the requested flavor is not available, eBPFGo falls back to the next supported flavor.
# Legacy C modules accept this key for compatibility; `legacy` forces the legacy path.
#
# The `maps per core` defines if hash tables will be per core or not. This option is ignored on kernels older than 4.15.
#
# The `lifetime` defines the time length a thread will run when it is enabled by a function.
#
[global]
    ebpf load mode = entry
    apps = no
    cgroups = no
    update every = 10
    pid table size = 32768
    btf path = /sys/kernel/btf/
    ebpf object flavor = buffer
    maps per core = yes
    lifetime = 300

#
# eBPF Programs
#
# The eBPF collector has the following eBPF programs:
#
#  `cachestat` : Make charts for kernel functions related to page cache.
#  `dcstat`    : Make charts for kernel functions related to directory cache.
#  `dns`       : Monitor DNS query and response traffic on ports 53 (DNS) and 5353 (mDNS) using a
#                BPF socket filter. Data is exposed through the `dns-queries` network-viewer function.
#  `disk`      : Monitor I/O latencies for disks
#  `fd`        : This eBPF program creates charts that show information about file manipulation.
#  `filesystem`: Monitor calls for functions used to manipulate specific filesystems
#  `hardirq`   : Monitor latency of serving hardware interrupt requests (hard IRQs).
#  `mdflush`   : Monitors flush counts for multi-devices.
#  `mount`     : Monitor calls for syscalls mount and umount
#  `oomkill`   : This eBPF program creates a chart that shows which process got OOM killed and when.
#  `process`   : This eBPF program creates charts that show information about process life.
#  `shm`       : Monitor calls for syscalls shmget, shmat, shmdt and shmctl.
#  `socket`    : Monitor `TCP` and `UDP` functions. Data is exposed via the `network-protocols`
#                on-demand Function served by `network-viewer.plugin`; no standalone charts.
#  `softirq`   : Monitor latency of serving software interrupt requests (soft IRQs).
#  `sync`      : Monitor calls for syscall sync(2).             
#  `swap`      : Monitor calls for internal swap functions.
#  `vfs`       : This eBPF program creates charts that show information about process VFS IO, VFS file manipulation and
#               files removed.
#
# When plugin detects that system has support to BTF, it enables integration with apps.plugin.
#
[ebpf programs]
    cachestat = yes
    dcstat = no
    dns = no
    disk = no
    fd = no
    filesystem = no
    hardirq = no
    mdflush = no
    mount = yes
    oomkill = yes
    process = no
    shm = no
    socket = no
    softirq = no
    sync = no
    swap = no
    vfs = no
