Network Viewer integrated with eBPF

src/collectors/ebpf.plugin/README.md

@@ -302,6 +302,9 @@ are divided in the following sections:
 
 #### `[network connections]`
 
+Netdata is integrating eBPF sockets collection with the [`networkviewer.plugin`](https://github.com/netdata/netdata/blob/master/src/collectors/network-viewer.plugin/network-connections-chart.html).
+During this process, we are temporarily disabling this option to prevent host overload.
+
 You can configure the information shown with function `ebpf_socket` using the settings in this section.
 
 ```conf

src/collectors/ebpf.plugin/ebpf.c

@@ -67,14 +67,14 @@ ebpf_module_t ebpf_modules[] = {
     { .info = {.thread_name = "socket",
               .config_name = "socket",
               .thread_description = NETDATA_EBPF_SOCKET_MODULE_DESC},
-      .functions = {.start_routine = ebpf_socket_thread,
-                   .apps_routine = ebpf_socket_create_apps_charts,
-                   .fnct_routine = ebpf_socket_read_open_connections,
-                   .fcnt_name = EBPF_FUNCTION_SOCKET,
-                   .fcnt_desc = EBPF_PLUGIN_SOCKET_FUNCTION_DESCRIPTION,
-                   .fcnt_thread_chart_name = NULL,
-                   .fcnt_thread_lifetime_name = NULL},
-                   .enabled = NETDATA_THREAD_EBPF_NOT_RUNNING,
+      .functions = {.start_routine = NULL, //ebpf_socket_thread,
+                    .apps_routine = NULL, //ebpf_socket_create_apps_charts,
+                    .fnct_routine = NULL, //ebpf_socket_read_open_connections,
+                    .fcnt_name = EBPF_FUNCTION_SOCKET,
+                    .fcnt_desc = EBPF_PLUGIN_SOCKET_FUNCTION_DESCRIPTION,
+                    .fcnt_thread_chart_name = NULL,
+                    .fcnt_thread_lifetime_name = NULL},
+                    .enabled = NETDATA_THREAD_EBPF_NOT_RUNNING,
       .update_every = EBPF_DEFAULT_UPDATE_EVERY, .global_charts = 1, .apps_charts = NETDATA_EBPF_APPS_FLAG_NO,
       .apps_level = NETDATA_APPS_LEVEL_REAL_PARENT, .cgroup_charts = CONFIG_BOOLEAN_NO, .mode = MODE_ENTRY, .optional = 0,
       .maps = NULL,
@@ -813,28 +813,6 @@ static void ebpf_exit()
     exit(0);
 }
 
-/**
- * Unload loegacy code
- *
- * @param objects       objects loaded from eBPF programs
- * @param probe_links   links from loader
- */
-void ebpf_unload_legacy_code(struct bpf_object *objects, struct bpf_link **probe_links)
-{
-    if (!probe_links || !objects)
-        return;
-
-    struct bpf_program *prog;
-    size_t j = 0 ;
-    bpf_object__for_each_program(prog, objects) {
-        bpf_link__destroy(probe_links[j]);
-        j++;
-    }
-    freez(probe_links);
-    if (objects)
-        bpf_object__close(objects);
-}
-
 /**
  * Unload Unique maps
  *
@@ -4023,7 +4001,7 @@ int main(int argc, char **argv)
         ebpf_module_t *em = &ebpf_modules[i];
         em->thread = st;
         em->thread_id = i;
-        if (em->enabled != NETDATA_THREAD_EBPF_NOT_RUNNING) {
+        if (em->enabled != NETDATA_THREAD_EBPF_NOT_RUNNING && em->functions.start_routine) {
             st->thread = mallocz(sizeof(netdata_thread_t));
             em->enabled = NETDATA_THREAD_EBPF_RUNNING;
             em->lifetime = EBPF_NON_FUNCTION_LIFE_TIME;

src/collectors/ebpf.plugin/ebpf_socket.h

@@ -51,18 +51,6 @@ enum ebpf_socket_publish_index {
     NETDATA_MAX_SOCKET_VECTOR
 };
 
-enum socket_functions {
-    NETDATA_FCNT_INET_CSK_ACCEPT,
-    NETDATA_FCNT_TCP_RETRANSMIT,
-    NETDATA_FCNT_CLEANUP_RBUF,
-    NETDATA_FCNT_TCP_CLOSE,
-    NETDATA_FCNT_UDP_RECEVMSG,
-    NETDATA_FCNT_TCP_SENDMSG,
-    NETDATA_FCNT_UDP_SENDMSG,
-    NETDATA_FCNT_TCP_V4_CONNECT,
-    NETDATA_FCNT_TCP_V6_CONNECT
-};
-
 typedef enum ebpf_socket_idx {
     NETDATA_KEY_CALLS_TCP_SENDMSG,
     NETDATA_KEY_ERROR_TCP_SENDMSG,
@@ -207,16 +195,6 @@ typedef struct netdata_passive_connection_idx {
     uint16_t port;
 } netdata_passive_connection_idx_t;
 
-/**
- * Union used to store ip addresses
- */
-union netdata_ip_t {
-    uint8_t  addr8[16];
-    uint16_t addr16[8];
-    uint32_t addr32[4];
-    uint64_t addr64[2];
-};
-
 typedef struct ebpf_network_viewer_ip_list {
     char *value;            // IP value
     uint32_t hash;          // IP hash

src/collectors/network-viewer.plugin/README.md

@@ -0,0 +1,66 @@
+<!--
+title: "Network Viewer monitoring (network-viewer.plugin)"
+sidebar_label: "Network Viewer monitoring "
+custom_edit_url: "https://github.com/netdata/netdata/edit/master/src/collectors/network-viewer.plugin/README.md"
+learn_status: "Published"
+learn_topic_type: "References"
+learn_rel_path: "Integrations/Monitor/System metrics"
+-->
+
+# Network Viewer monitoring (network-viewer.plugin)
+
+The `network-viewer.plugin` provides users with information about TCP and UDP
+resources.
+It is enabled by default on every Netdata installation.
+
+To accomplish this, it scans through the entire process tree, gathering socket
+information for each process identified during its parsing of `/proc` or using
+`libmnl`. Alternatively, it monitors calls to kernel internal functions when
+utilizing `eBPF`.
+
+## Functions
+
+To visualize your network traffic, you'll need to log in to the Netdata cloud.
+Navigate to the `Top` tab, select a specific host, and then click on
+`Network connections`.
+
+## Performance
+
+The `network-viewer.plugin` is a sophisticated piece of software that requires
+significant processing.
+
+On Linux systems, the plugin reads multiple `network-viewer.plugin` reads
+several `/proc` files for each running process to gather necessary data.
+Performing this task every second, particularly on hosts with numerous
+processes, can result in increased CPU utilization by the plugin.
+
+To minimize the load caused by parsing `/proc` the plugin can utilize `eBPF`,
+provided it's available on your host. However, this approach will introduce
+additional overhead for each TCP and UDP function call on the host. To switch
+from using `/proc` files to eBPF, adjustments to the configuration file are also
+required:
+
+```
+[plugin:network-viewer]
+	command options = ebpf
+```
+
+You can further customize the collection level by specifying the desired option
+`apps-level`:
+
+```
+[plugin:network-viewer]
+	command options = ebpf apps-level 1
+```
+
+The accepted values are as follows:
+    - 0: Group data under the real parent
+    - 1: Group data under the parent.
+
+Lastly, you have the option to personalize whether the plugin will display data per parent PID,
+which is the default behavior, or utilize per-thread information by enabling the `use-pid` option:
+
+```
+[plugin:network-viewer]
+	command options = ebpf apps-level 1 use-pid
+```