eBPF cgroup update (#16630)

25 files changed, 1340 insertions, 972 deletions

diff --git a/src/collectors/cgroups.plugin/cgroup-discovery.c b/src/collectors/cgroups.plugin/cgroup-discovery.c
index 78820c4cc7..e5d029cfb0 100644
--- a/src/collectors/cgroups.plugin/cgroup-discovery.c
+++ b/src/collectors/cgroups.plugin/cgroup-discovery.c
@@ -25,6 +25,10 @@ char cgroup_chart_id_prefix[] = "cgroup_";
 char services_chart_id_prefix[] = "systemd_";
 char *cgroups_rename_script = NULL;
 
+// Shared memory with information from detected cgroups
+netdata_ebpf_cgroup_shm_t shm_cgroup_ebpf = {NULL, NULL};
+int shm_fd_cgroup_ebpf = -1;
+sem_t *shm_mutex_cgroup_ebpf = SEM_FAILED;
 
 // ----------------------------------------------------------------------------
 
@@ -1027,6 +1031,82 @@ static int discovery_is_cgroup_duplicate(struct cgroup *cg) {
 }
 
 // ----------------------------------------------------------------------------
+// ebpf shared memory
+
+static void netdata_cgroup_ebpf_set_values(size_t length)
+{
+    sem_wait(shm_mutex_cgroup_ebpf);
+
+    shm_cgroup_ebpf.header->cgroup_max = cgroup_root_max;
+    shm_cgroup_ebpf.header->systemd_enabled = cgroup_enable_systemd_services |
+                                              cgroup_enable_systemd_services_detailed_memory |
+                                              cgroup_used_memory;
+    shm_cgroup_ebpf.header->body_length = length;
+
+    sem_post(shm_mutex_cgroup_ebpf);
+}
+
+static void netdata_cgroup_ebpf_initialize_shm()
+{
+    shm_fd_cgroup_ebpf = shm_open(NETDATA_SHARED_MEMORY_EBPF_CGROUP_NAME, O_CREAT | O_RDWR, 0660);
+    if (shm_fd_cgroup_ebpf < 0) {
+        collector_error("Cannot initialize shared memory used by cgroup and eBPF, integration won't happen.");
+        return;
+    }
+
+    size_t length = sizeof(netdata_ebpf_cgroup_shm_header_t) + cgroup_root_max * sizeof(netdata_ebpf_cgroup_shm_body_t);
+    if (ftruncate(shm_fd_cgroup_ebpf, length)) {
+        collector_error("Cannot set size for shared memory.");
+        goto end_init_shm;
+    }
+
+    shm_cgroup_ebpf.header = (netdata_ebpf_cgroup_shm_header_t *) mmap(NULL, length,
+                                                                       PROT_READ | PROT_WRITE, MAP_SHARED,
+                                                                       shm_fd_cgroup_ebpf, 0);
+
+    if (unlikely(MAP_FAILED == shm_cgroup_ebpf.header)) {
+        shm_cgroup_ebpf.header = NULL;
+        collector_error("Cannot map shared memory used between cgroup and eBPF, integration won't happen");
+        goto end_init_shm;
+    }
+    shm_cgroup_ebpf.body = (netdata_ebpf_cgroup_shm_body_t *) ((char *)shm_cgroup_ebpf.header +
+                                                               sizeof(netdata_ebpf_cgroup_shm_header_t));
+
+    shm_mutex_cgroup_ebpf = sem_open(NETDATA_NAMED_SEMAPHORE_EBPF_CGROUP_NAME, O_CREAT,
+                                     S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH, 1);
+
+    if (shm_mutex_cgroup_ebpf != SEM_FAILED) {
+        netdata_cgroup_ebpf_set_values(length);
+        return;
+    }
+
+    collector_error("Cannot create semaphore, integration between eBPF and cgroup won't happen");
+    munmap(shm_cgroup_ebpf.header, length);
+    shm_cgroup_ebpf.header = NULL;
+
+    end_init_shm:
+    close(shm_fd_cgroup_ebpf);
+    shm_fd_cgroup_ebpf = -1;
+    shm_unlink(NETDATA_SHARED_MEMORY_EBPF_CGROUP_NAME);
+}
+
+static void cgroup_cleanup_ebpf_integration()
+{
+    if (shm_mutex_cgroup_ebpf != SEM_FAILED) {
+        sem_close(shm_mutex_cgroup_ebpf);
+    }
+
+    if (shm_cgroup_ebpf.header) {
+        shm_cgroup_ebpf.header->cgroup_root_count = 0;
+        munmap(shm_cgroup_ebpf.header, shm_cgroup_ebpf.header->body_length);
+    }
+
+    if (shm_fd_cgroup_ebpf > 0) {
+        close(shm_fd_cgroup_ebpf);
+    }
+}
+
+// ----------------------------------------------------------------------------
 // cgroup network interfaces
 
 #define CGROUP_NETWORK_INTERFACE_MAX_LINE 2048
@@ -1231,6 +1311,8 @@ void cgroup_discovery_worker(void *ptr)
 
     service_register(SERVICE_THREAD_TYPE_LIBUV, NULL, NULL, NULL, false);
 
+    netdata_cgroup_ebpf_initialize_shm();
+
     while (service_running(SERVICE_COLLECTORS)) {
         worker_is_idle();
 
@@ -1244,6 +1326,7 @@ void cgroup_discovery_worker(void *ptr)
         discovery_find_all_cgroups();
     }
     collector_info("discovery thread stopped");
+    cgroup_cleanup_ebpf_integration();
     worker_unregister();
     service_exits();
     __atomic_store_n(&discovery_thread.exited,1,__ATOMIC_RELAXED);
diff --git a/src/collectors/cgroups.plugin/cgroup-internals.h b/src/collectors/cgroups.plugin/cgroup-internals.h
index e1c1830b3e..1f5be7707a 100644
--- a/src/collectors/cgroups.plugin/cgroup-internals.h
+++ b/src/collectors/cgroups.plugin/cgroup-internals.h
@@ -386,10 +386,6 @@ extern uint32_t throttled_time_hash;
 extern uint32_t throttled_usec_hash;
 extern struct cgroup *cgroup_root;
 
-extern netdata_ebpf_cgroup_shm_t shm_cgroup_ebpf;
-extern int shm_fd_cgroup_ebpf;
-extern sem_t *shm_mutex_cgroup_ebpf;
-
 enum cgroups_type { CGROUPS_AUTODETECT_FAIL, CGROUPS_V1, CGROUPS_V2 };
 
 enum cgroups_systemd_setting {
diff --git a/src/collectors/cgroups.plugin/sys_fs_cgroup.c b/src/collectors/cgroups.plugin/sys_fs_cgroup.c
index 100b0912de..fd30b4acc4 100644
--- a/src/collectors/cgroups.plugin/sys_fs_cgroup.c
+++ b/src/collectors/cgroups.plugin/sys_fs_cgroup.c
@@ -85,11 +85,6 @@ struct cgroups_systemd_config_setting cgroups_systemd_options[] = {
         { .name = NULL,      .setting = SYSTEMD_CGROUP_ERR     },
 };
 
-// Shared memory with information from detected cgroups
-netdata_ebpf_cgroup_shm_t shm_cgroup_ebpf = {NULL, NULL};
-int shm_fd_cgroup_ebpf = -1;
-sem_t *shm_mutex_cgroup_ebpf = SEM_FAILED;
-
 struct discovery_thread discovery_thread;
 
 
@@ -528,63 +523,6 @@ void read_cgroup_plugin_configuration() {
     mountinfo_free_all(root);
 }
 
-void netdata_cgroup_ebpf_set_values(size_t length)
-{
-    sem_wait(shm_mutex_cgroup_ebpf);
-
-    shm_cgroup_ebpf.header->cgroup_max = cgroup_root_max;
-    shm_cgroup_ebpf.header->systemd_enabled = cgroup_enable_systemd_services |
-                                              cgroup_enable_systemd_services_detailed_memory |
-                                              cgroup_used_memory;
-    shm_cgroup_ebpf.header->body_length = length;
-
-    sem_post(shm_mutex_cgroup_ebpf);
-}
-
-void netdata_cgroup_ebpf_initialize_shm()
-{
-    shm_fd_cgroup_ebpf = shm_open(NETDATA_SHARED_MEMORY_EBPF_CGROUP_NAME, O_CREAT | O_RDWR, 0660);
-    if (shm_fd_cgroup_ebpf < 0) {
-        collector_error("Cannot initialize shared memory used by cgroup and eBPF, integration won't happen.");
-        return;
-    }
-
-    size_t length = sizeof(netdata_ebpf_cgroup_shm_header_t) + cgroup_root_max * sizeof(netdata_ebpf_cgroup_shm_body_t);
-    if (ftruncate(shm_fd_cgroup_ebpf, length)) {
-        collector_error("Cannot set size for shared memory.");
-        goto end_init_shm;
-    }
-
-    shm_cgroup_ebpf.header = (netdata_ebpf_cgroup_shm_header_t *) mmap(NULL, length,
-                                                                       PROT_READ | PROT_WRITE, MAP_SHARED,
-                                                                       shm_fd_cgroup_ebpf, 0);
-
-    if (unlikely(MAP_FAILED == shm_cgroup_ebpf.header)) {
-        shm_cgroup_ebpf.header = NULL;
-        collector_error("Cannot map shared memory used between cgroup and eBPF, integration won't happen");
-        goto end_init_shm;
-    }
-    shm_cgroup_ebpf.body = (netdata_ebpf_cgroup_shm_body_t *) ((char *)shm_cgroup_ebpf.header +
-                                                              sizeof(netdata_ebpf_cgroup_shm_header_t));
-
-    shm_mutex_cgroup_ebpf = sem_open(NETDATA_NAMED_SEMAPHORE_EBPF_CGROUP_NAME, O_CREAT,
-                                     S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH, 1);
-
-    if (shm_mutex_cgroup_ebpf != SEM_FAILED) {
-        netdata_cgroup_ebpf_set_values(length);
-        return;
-    }
-
-    collector_error("Cannot create semaphore, integration between eBPF and cgroup won't happen");
-    munmap(shm_cgroup_ebpf.header, length);
-    shm_cgroup_ebpf.header = NULL;
-
-end_init_shm:
-    close(shm_fd_cgroup_ebpf);
-    shm_fd_cgroup_ebpf = -1;
-    shm_unlink(NETDATA_SHARED_MEMORY_EBPF_CGROUP_NAME);
-}
-
 // ---------------------------------------------------------------------------------------------
 
 static unsigned long long calc_delta(unsigned long long curr, unsigned long long prev) {
@@ -1596,19 +1534,6 @@ static void cgroup_main_cleanup(void *ptr) {
         }
     }
 
-    if (shm_mutex_cgroup_ebpf != SEM_FAILED) {
-        sem_close(shm_mutex_cgroup_ebpf);
-    }
-
-    if (shm_cgroup_ebpf.header) {
-        shm_cgroup_ebpf.header->cgroup_root_count = 0;
-        munmap(shm_cgroup_ebpf.header, shm_cgroup_ebpf.header->body_length);
-    }
-
-    if (shm_fd_cgroup_ebpf > 0) {
-        close(shm_fd_cgroup_ebpf);
-    }
-
     static_thread->enabled = NETDATA_MAIN_THREAD_EXITED;
 }
 
@@ -1645,8 +1570,6 @@ void *cgroups_main(void *ptr) {
 
     cgroup_read_host_total_ram();
 
-    netdata_cgroup_ebpf_initialize_shm();
-
     if (uv_mutex_init(&cgroup_root_mutex)) {
         collector_error("CGROUP: cannot initialize mutex for the main cgroup list");
         goto exit;
diff --git a/src/collectors/ebpf.plugin/ebpf.c b/src/collectors/ebpf.plugin/ebpf.c
index e22d3596bc..5cbcd19abf 100644
--- a/src/collectors/ebpf.plugin/ebpf.c
+++ b/src/collectors/ebpf.plugin/ebpf.c
@@ -18,7 +18,7 @@
 char *ebpf_plugin_dir = PLUGINS_DIR;
 static char *ebpf_configured_log_dir = LOG_DIR;
 
-char *ebpf_algorithms[] = {"absolute", "incremental"};
+char *ebpf_algorithms[] = { EBPF_CHART_ALGORITHM_ABSOLUTE, EBPF_CHART_ALGORITHM_INCREMENTAL};
 struct config collector_config = { .first_section = NULL,
                                    .last_section = NULL,
                                    .mutex = NETDATA_MUTEX_INITIALIZER,
diff --git a/src/collectors/ebpf.plugin/ebpf.h b/src/collectors/ebpf.plugin/ebpf.h
index c0f9b39fb3..7db04c2af0 100644
--- a/src/collectors/ebpf.plugin/ebpf.h
+++ b/src/collectors/ebpf.plugin/ebpf.h
@@ -179,7 +179,6 @@ typedef struct ebpf_tracepoint {
 #define NETDATA_EBPF_MEMORY_GROUP "mem"
 #define NETDATA_EBPF_SYSTEM_GROUP "system"
 #define NETDATA_SYSTEM_SWAP_SUBMENU "swap"
-#define NETDATA_SYSTEM_CGROUP_SWAP_SUBMENU "swap (eBPF)"
 #define NETDATA_SYSTEM_IPC_SHM_SUBMENU "ipc shared memory"
 #define NETDATA_MONITORING_FAMILY "netdata"
 
@@ -341,6 +340,9 @@ void ebpf_pid_file(char *filename, size_t length);
 #define EBPF_COMMON_DIMENSION_MILLISECONDS "milliseconds"
 #define EBPF_COMMON_DIMENSION_KILLS "kills"
 
+#define EBPF_CHART_ALGORITHM_ABSOLUTE "absolute"
+#define EBPF_CHART_ALGORITHM_INCREMENTAL "incremental"
+
 // Common variables
 extern int debug_enabled;
 extern struct ebpf_pid_stat *ebpf_root_of_pids;
diff --git a/src/collectors/ebpf.plugin/ebpf_apps.h b/src/collectors/ebpf.plugin/ebpf_apps.h
index b410bdcb04..a2cbaf3b7b 100644
--- a/src/collectors/ebpf.plugin/ebpf_apps.h
+++ b/src/collectors/ebpf.plugin/ebpf_apps.h
@@ -13,8 +13,7 @@
 #define NETDATA_APP_FAMILY "app"
 #define NETDATA_APPS_FILE_GROUP "file_access"
 #define NETDATA_APPS_FILE_FDS "fds"
-#define NETDATA_APPS_FILE_CGROUP_GROUP "file_access (eBPF)"
-#define NETDATA_APPS_PROCESS_GROUP "process (eBPF)"
+#define NETDATA_APPS_PROCESS_GROUP "process"
 #define NETDATA_APPS_NET_GROUP "net"
 #define NETDATA_APPS_IPC_SHM_GROUP "ipc shm"
 
diff --git a/src/collectors/ebpf.plugin/ebpf_cachestat.c b/src/collectors/ebpf.plugin/ebpf_cachestat.c
index ebffe8debf..45e09766f9 100644
--- a/src/collectors/ebpf.plugin/ebpf_cachestat.c
+++ b/src/collectors/ebpf.plugin/ebpf_cachestat.c
@@ -328,11 +328,11 @@ static void ebpf_obsolete_specific_cachestat_charts(char *type, int update_every
  *
  * @param em a pointer to `struct ebpf_module`
  */
-static void ebpf_obsolete_services(ebpf_module_t *em)
+static void ebpf_obsolete_cachestat_services(ebpf_module_t *em, char *id)
 {
     ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              id,
                               NETDATA_CACHESTAT_HIT_RATIO_CHART,
-                              "",
                               "Hit ratio",
                               EBPF_COMMON_DIMENSION_PERCENTAGE,
                               NETDATA_CACHESTAT_SUBMENU,
@@ -342,8 +342,8 @@ static void ebpf_obsolete_services(ebpf_module_t *em)
                               em->update_every);
 
     ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              id,
                               NETDATA_CACHESTAT_DIRTY_CHART,
-                              "",
                               "Number of dirty pages",
                               EBPF_CACHESTAT_DIMENSION_PAGE,
                               NETDATA_CACHESTAT_SUBMENU,
@@ -353,8 +353,8 @@ static void ebpf_obsolete_services(ebpf_module_t *em)
                               em->update_every);
 
     ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              id,
                               NETDATA_CACHESTAT_HIT_CHART,
-                              "",
                               "Number of accessed files",
                               EBPF_CACHESTAT_DIMENSION_HITS,
                               NETDATA_CACHESTAT_SUBMENU,
@@ -364,8 +364,8 @@ static void ebpf_obsolete_services(ebpf_module_t *em)
                               em->update_every);
 
     ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              id,
                               NETDATA_CACHESTAT_MISSES_CHART,
-                              "",
                               "Files out of page cache",
                               EBPF_CACHESTAT_DIMENSION_MISSES,
                               NETDATA_CACHESTAT_SUBMENU,
@@ -385,12 +385,13 @@ static void ebpf_obsolete_services(ebpf_module_t *em)
 static inline void ebpf_obsolete_cachestat_cgroup_charts(ebpf_module_t *em) {
     pthread_mutex_lock(&mutex_cgroup_shm);
 
-    ebpf_obsolete_services(em);
-
     ebpf_cgroup_target_t *ect;
     for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
-        if (ect->systemd)
+        if (ect->systemd) {
+            ebpf_obsolete_cachestat_services(em, ect->name);
+
             continue;
+        }
 
         ebpf_obsolete_specific_cachestat_charts(ect->name, em->update_every);
     }
@@ -1114,35 +1115,82 @@ void ebpf_cachestat_calc_chart_values()
  **/
 static void ebpf_create_systemd_cachestat_charts(int update_every)
 {
-    ebpf_create_charts_on_systemd(NETDATA_CACHESTAT_HIT_RATIO_CHART,
-                                  "Hit ratio",
-                                  EBPF_COMMON_DIMENSION_PERCENTAGE, NETDATA_CACHESTAT_SUBMENU,
-                                  NETDATA_EBPF_CHART_TYPE_LINE, 21100,
-                                  ebpf_algorithms[NETDATA_EBPF_ABSOLUTE_IDX],
-                                  NETDATA_SYSTEMD_CACHESTAT_HIT_RATIO_CONTEXT, NETDATA_EBPF_MODULE_NAME_CACHESTAT,
-                                  update_every);
+    static ebpf_systemd_args_t data_hit_ratio = {
+        .title = "Hit ratio",
+        .units = EBPF_COMMON_DIMENSION_PERCENTAGE,
+        .family = NETDATA_CACHESTAT_SUBMENU,
+        .charttype = NETDATA_EBPF_CHART_TYPE_LINE,
+        .order = 21100,
+        .algorithm = EBPF_CHART_ALGORITHM_ABSOLUTE,
+        .context = NETDATA_SYSTEMD_CACHESTAT_HIT_RATIO_CONTEXT,
+        .module = NETDATA_EBPF_MODULE_NAME_CACHESTAT,
+        .update_every = 0,
+        .suffix = NETDATA_CACHESTAT_HIT_RATIO_CHART,
+        .dimension = "percentage"
+    };
 
-    ebpf_create_charts_on_systemd(NETDATA_CACHESTAT_DIRTY_CHART,
-                                  "Number of dirty pages",
-                                  EBPF_CACHESTAT_DIMENSION_PAGE, NETDATA_CACHESTAT_SUBMENU,
-                                  NETDATA_EBPF_CHART_TYPE_LINE, 21101,
-                                  ebpf_algorithms[NETDATA_EBPF_ABSOLUTE_IDX],
-                                  NETDATA_SYSTEMD_CACHESTAT_MODIFIED_CACHE_CONTEXT, NETDATA_EBPF_MODULE_NAME_CACHESTAT,
-                                  update_every);
+    static ebpf_systemd_args_t data_dirty = {
+        .title = "Number of dirty pages",
+        .units = EBPF_CACHESTAT_DIMENSION_PAGE,
+        .family = NETDATA_CACHESTAT_SUBMENU,
+        .charttype = NETDATA_EBPF_CHART_TYPE_LINE,
+        .order = 21101,
+        .algorithm = EBPF_CHART_ALGORITHM_ABSOLUTE,
+        .context = NETDATA_SYSTEMD_CACHESTAT_MODIFIED_CACHE_CONTEXT,
+        .module = NETDATA_EBPF_MODULE_NAME_CACHESTAT,
+        .update_every = 0,
+        .suffix = NETDATA_CACHESTAT_DIRTY_CHART,
+        .dimension = "pages"
+    };
 
-    ebpf_create_charts_on_systemd(NETDATA_CACHESTAT_HIT_CHART, "Number of accessed files",
-                                  EBPF_CACHESTAT_DIMENSION_HITS, NETDATA_CACHESTAT_SUBMENU,
-                                  NETDATA_EBPF_CHART_TYPE_LINE, 21102,
-                                  ebpf_algorithms[NETDATA_EBPF_ABSOLUTE_IDX],
-                                  NETDATA_SYSTEMD_CACHESTAT_HIT_FILE_CONTEXT, NETDATA_EBPF_MODULE_NAME_CACHESTAT,
-                                  update_every);
+    static ebpf_systemd_args_t data_hit = {
+        .title = "Number of accessed pages",
+        .units = EBPF_CACHESTAT_DIMENSION_HITS,
+        .family = NETDATA_CACHESTAT_SUBMENU,
+        .charttype = NETDATA_EBPF_CHART_TYPE_LINE,
+        .order = 21102,
+        .algorithm = EBPF_CHART_ALGORITHM_ABSOLUTE,
+        .context = NETDATA_SYSTEMD_CACHESTAT_HIT_FILE_CONTEXT,
+        .module = NETDATA_EBPF_MODULE_NAME_CACHESTAT,
+        .update_every = 0,
+        .suffix = NETDATA_CACHESTAT_HIT_CHART,
+        .dimension = "hits"
+    };
 
-    ebpf_create_charts_on_systemd(NETDATA_CACHESTAT_MISSES_CHART, "Files out of page cache",
-                                  EBPF_CACHESTAT_DIMENSION_MISSES, NETDATA_CACHESTAT_SUBMENU,
-                                  NETDATA_EBPF_CHART_TYPE_LINE, 21103,
-                                  ebpf_algorithms[NETDATA_EBPF_ABSOLUTE_IDX],
-                                  NETDATA_SYSTEMD_CACHESTAT_MISS_FILES_CONTEXT, NETDATA_EBPF_MODULE_NAME_CACHESTAT,
-                                  update_every);
+    static ebpf_systemd_args_t data_miss = {
+        .title = "Files out of page cache",
+        .units = EBPF_CACHESTAT_DIMENSION_MISSES,
+        .family = NETDATA_CACHESTAT_SUBMENU,
+        .charttype = NETDATA_EBPF_CHART_TYPE_LINE,
+        .order = 21103,
+        .algorithm = EBPF_CHART_ALGORITHM_ABSOLUTE,
+        .context = NETDATA_SYSTEMD_CACHESTAT_MISS_FILES_CONTEXT,
+        .module = NETDATA_EBPF_MODULE_NAME_CACHESTAT,
+        .update_every = 0,
+        .suffix = NETDATA_CACHESTAT_MISSES_CHART,
+        .dimension = "misses"
+    };
+
+    if (!data_miss.update_every)
+        data_hit_ratio.update_every = data_dirty.update_every =
+        data_hit.update_every = data_miss.update_every = update_every;
+
+    ebpf_cgroup_target_t *w;
+    for (w = ebpf_cgroup_pids; w; w = w->next) {
+        if (unlikely(!w->systemd || w->flags & NETDATA_EBPF_SERVICES_HAS_CACHESTAT_CHART))
+            continue;
+
+        data_hit_ratio.id = data_dirty.id = data_hit.id = data_miss.id = w->name;
+        ebpf_create_charts_on_systemd(&data_hit_ratio);
+
+        ebpf_create_charts_on_systemd(&data_dirty);
+
+        ebpf_create_charts_on_systemd(&data_hit);
+
+        ebpf_create_charts_on_systemd(&data_miss);
+
+        w->flags |= NETDATA_EBPF_SERVICES_HAS_CACHESTAT_CHART;
+    }
 }
 
 /**
@@ -1154,37 +1202,27 @@ static void ebpf_send_systemd_cachestat_charts()
 {
     ebpf_cgroup_target_t *ect;
 
-    ebpf_write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_CACHESTAT_HIT_RATIO_CHART, "");
     for (ect = ebpf_cgroup_pids; ect; ect = ect->next) {
-        if (unlikely(ect->systemd) && unlikely(ect->updated)) {
-            write_chart_dimension(ect->name, (long long)ect->publish_cachestat.ratio);
+        if (unlikely(!(ect->flags & NETDATA_EBPF_SERVICES_HAS_CACHESTAT_CHART)) ) {
+            continue;
         }
-    }
-    ebpf_write_end_chart();
 
-    ebpf_write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_CACHESTAT_DIRTY_CHART, "");
-    for (ect = ebpf_cgroup_pids; ect; ect = ect->next) {
-        if (unlikely(ect->systemd) && unlikely(ect->updated)) {
-            write_chart_dimension(ect->name, (long long)ect->publish_cachestat.dirty);
-        }
-    }
-    ebpf_write_end_chart();
+        ebpf_write_begin_chart(NETDATA_SERVICE_FAMILY, ect->name, NETDATA_CACHESTAT_HIT_RATIO_CHART);
+        write_chart_dimension("percentage", (long long)ect->publish_cachestat.ratio);
+        ebpf_write_end_chart();
 
-    ebpf_write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_CACHESTAT_HIT_CHART, "");
-    for (ect = ebpf_cgroup_pids; ect; ect = ect->next) {
-        if (unlikely(ect->systemd) && unlikely(ect->updated)) {
-            write_chart_dimension(ect->name, (long long)ect->publish_cachestat.hit);
-        }
-    }
-    ebpf_write_end_chart();
+        ebpf_write_begin_chart(NETDATA_SERVICE_FAMILY, ect->name, NETDATA_CACHESTAT_DIRTY_CHART);
+        write_chart_dimension("pages", (long long)ect->publish_cachestat.dirty);
+        ebpf_write_end_chart();
 
-    ebpf_write_begin_chart(NETDATA_SERVICE_FAMILY, NETDATA_CACHESTAT_MISSES_CHART, "");
-    for (ect = ebpf_cgroup_pids; ect; ect = ect->next) {
-        if (unlikely(ect->systemd) && unlikely(ect->updated)) {
-            write_chart_dimension(ect->name, (long long)ect->publish_cachestat.miss);
-        }
+        ebpf_write_begin_chart(NETDATA_SERVICE_FAMILY, ect->name, NETDATA_CACHESTAT_HIT_CHART);
+        write_chart_dimension("hits", (long long)ect->publish_cachestat.hit);
+        ebpf_write_end_chart();
+
+        ebpf_write_begin_chart(NETDATA_SERVICE_FAMILY, ect->name, NETDATA_CACHESTAT_MISSES_CHART);
+        write_chart_dimension("misses", (long long)ect->publish_cachestat.miss);
+        ebpf_write_end_chart();
     }
-    ebpf_write_end_chart();
 }
 
 /**
@@ -1223,7 +1261,7 @@ static void ebpf_create_specific_cachestat_charts(char *type, int update_every)
 {
     ebpf_create_chart(type, NETDATA_CACHESTAT_HIT_RATIO_CHART,
                       "Hit ratio",
-                      EBPF_COMMON_DIMENSION_PERCENTAGE, NETDATA_CACHESTAT_CGROUP_SUBMENU,
+                      EBPF_COMMON_DIMENSION_PERCENTAGE, NETDATA_CACHESTAT_SUBMENU,
                       NETDATA_CGROUP_CACHESTAT_HIT_RATIO_CONTEXT,
                       NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5200,
                       ebpf_create_global_dimension,
@@ -1231,7 +1269,7 @@ static void ebpf_create_specific_cachestat_charts(char *type, int update_every)
 
     ebpf_create_chart(type, NETDATA_CACHESTAT_DIRTY_CHART,
                       "Number of dirty pages",
-                      EBPF_CACHESTAT_DIMENSION_PAGE, NETDATA_CACHESTAT_CGROUP_SUBMENU,
+                      EBPF_CACHESTAT_DIMENSION_PAGE, NETDATA_CACHESTAT_SUBMENU,
                       NETDATA_CGROUP_CACHESTAT_MODIFIED_CACHE_CONTEXT,
                       NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5201,
                       ebpf_create_global_dimension,
@@ -1240,7 +1278,7 @@ static void ebpf_create_specific_cachestat_charts(char *type, int update_every)
 
     ebpf_create_chart(type, NETDATA_CACHESTAT_HIT_CHART,
                       "Number of accessed files",
-                      EBPF_CACHESTAT_DIMENSION_HITS, NETDATA_CACHESTAT_CGROUP_SUBMENU,
+                      EBPF_CACHESTAT_DIMENSION_HITS, NETDATA_CACHESTAT_SUBMENU,
                       NETDATA_CGROUP_CACHESTAT_HIT_FILES_CONTEXT,
                       NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5202,
                       ebpf_create_global_dimension,
@@ -1249,7 +1287,7 @@ static void ebpf_create_specific_cachestat_charts(char *type, int update_every)
 
     ebpf_create_chart(type, NETDATA_CACHESTAT_MISSES_CHART,
                       "Files out of page cache",
-                      EBPF_CACHESTAT_DIMENSION_MISSES, NETDATA_CACHESTAT_CGROUP_SUBMENU,
+                      EBPF_CACHESTAT_DIMENSION_MISSES, NETDATA_CACHESTAT_SUBMENU,
                       NETDATA_CGROUP_CACHESTAT_MISS_FILES_CONTEXT,
                       NETDATA_EBPF_CHART_TYPE_LINE, NETDATA_CHART_PRIO_CGROUPS_CONTAINERS + 5203,
                       ebpf_create_global_dimension,
@@ -1303,15 +1341,11 @@ static void ebpf_obsolete_specific_cachestat_charts(char *type, int update_every
 */
 void ebpf_cachestat_send_cgroup_data(int update_every)
 {
-    if (!ebpf_cgroup_pids)
-        return;
-
     pthread_mutex_lock(&mutex_cgroup_shm);
     ebpf_cgroup_target_t *ect;
     ebpf_cachestat_calc_chart_values();
 
-    int has_systemd = shm_ebpf_cgroup.header->systemd_enabled;
-    if (has_systemd) {
+    if (shm_ebpf_cgroup.header->systemd_enabled) {
         if (send_cgroup_chart) {
             ebpf_create_systemd_cachestat_charts(update_every);
         }
diff --git a/src/collectors/ebpf.plugin/ebpf_cachestat.h b/src/collectors/ebpf.plugin/ebpf_cachestat.h
index 4773646eff..4578fbe980 100644
--- a/src/collectors/ebpf.plugin/ebpf_cachestat.h
+++ b/src/collectors/ebpf.plugin/ebpf_cachestat.h
@@ -14,7 +14,6 @@
 #define NETDATA_CACHESTAT_MISSES_CHART "cachestat_misses"
 
 #define NETDATA_CACHESTAT_SUBMENU "page_cache"
-#define NETDATA_CACHESTAT_CGROUP_SUBMENU "page cache (eBPF)"
 
 #define EBPF_CACHESTAT_DIMENSION_PAGE "pages/s"
 #define EBPF_CACHESTAT_DIMENSION_HITS "hits/s"
@@ -29,10 +28,10 @@
 #define NETDATA_CGROUP_CACHESTAT_HIT_FILES_CONTEXT "cgroup.cachestat_hits"
 #define NETDATA_CGROUP_CACHESTAT_MISS_FILES_CONTEXT "cgroup.cachestat_misses"
 
-#define NETDATA_SYSTEMD_CACHESTAT_HIT_RATIO_CONTEXT "services.cachestat_ratio"
-#define NETDATA_SYSTEMD_CACHESTAT_MODIFIED_CACHE_CONTEXT "services.cachestat_dirties"
-#define NETDATA_SYSTEMD_CACHESTAT_HIT_FILE_CONTEXT "services.cachestat_hits"
-#define NETDATA_SYSTEMD_CACHESTAT_MISS_FILES_CONTEXT "services.cachestat_misses"
+#define NETDATA_SYSTEMD_CACHESTAT_HIT_RATIO_CONTEXT "systemd.services.cachestat_ratio"
+#define NETDATA_SYSTEMD_CACHESTAT_MODIFIED_CACHE_CONTEXT "systemd.services.cachestat_dirties"
+#define NETDATA_SYSTEMD_CACHESTAT_HIT_FILE_CONTEXT "systemd.services.cachestat_hits"
+#define NETDATA_SYSTEMD_CACHESTAT_MISS_FILES_CONTEXT "systemd.services.cachestat_misses"
 
 // variables
 enum cachestat_counters {
diff --git a/src/collectors/ebpf.plugin/ebpf_cgroup.c b/src/collectors/ebpf.plugin/ebpf_cgroup.c
index 1aadfbaf83..881a00ddf4 100644
--- a/src/collectors/ebpf.plugin/ebpf_cgroup.c
+++ b/src/collectors/ebpf.plugin/ebpf_cgroup.c
@@ -327,17 +327,22 @@ void ebpf_parse_cgroup_shm_data()
  * @param module    chart module name, this is the eBPF thread.
  * @param update_every value to overwrite the update frequency set by the server.
  */
-void ebpf_create_charts_on_systemd(char *id, char *title, char *units, char *family, char *charttype, int order,
-                                   char *algorithm, char *context, char *module, int update_every)
+void ebpf_create_charts_on_systemd(ebpf_systemd_args_t *chart)
 {
-    ebpf_cgroup_target_t *w;
-    ebpf_write_chart_cmd(NETDATA_SERVICE_FAMILY, id, "", title, units, family, charttype, context,
-                         order, update_every, module);
-
-    for (w = ebpf_cgroup_pids; w; w = w->next) {
-        if (unlikely(w->systemd) && unlikely(w->updated))
-            fprintf(stdout, "DIMENSION %s '' %s 1 1\n", w->name, algorithm);
-    }
+    ebpf_write_chart_cmd(NETDATA_SERVICE_FAMILY,
+                         chart->id,
+                         chart->suffix,
+                         chart->title,
+                         chart->units,
+                         chart->family,
+                         chart->charttype,
+                         chart->context,
+                         chart->order,
+                         chart->update_every,
+                         chart->module);
+    ebpf_create_chart_labels("service_name", chart->id, 0);
+    ebpf_commit_label();
+    fprintf(stdout, "DIMENSION %s '' %s 1 1\n", chart->dimension, chart->algorithm);
 }
 
 // --------------------------------------------------------------------------------------------------------------------
diff --git a/src/collectors/ebpf.plugin/ebpf_cgroup.h b/src/collectors/ebpf.plugin/ebpf_cgroup.h
index ba8346934f..87df7bed2a 100644
--- a/src/collectors/ebpf.plugin/ebpf_cgroup.h
+++ b/src/collectors/ebpf.plugin/ebpf_cgroup.h
@@ -9,7 +9,7 @@
 #include "ebpf.h"
 #include "ebpf_apps.h"
 
-#define NETDATA_SERVICE_FAMILY "services"
+#define NETDATA_SERVICE_FAMILY "systemd"
 
 struct pid_on_target2 {
     int32_t pid;
@@ -36,7 +36,17 @@ enum ebpf_cgroup_flags {
     NETDATA_EBPF_CGROUP_HAS_OOMKILL_CHART = 1<<6,
     NETDATA_EBPF_CGROUP_HAS_CACHESTAT_CHART = 1<<7,
     NETDATA_EBPF_CGROUP_HAS_DC_CHART = 1<<8,
-    NETDATA_EBPF_CGROUP_HAS_SHM_CHART = 1<<9
+    NETDATA_EBPF_CGROUP_HAS_SHM_CHART = 1<<9,
+
+    NETDATA_EBPF_SERVICES_HAS_PROCESS_CHART = 1<<16,
+    NETDATA_EBPF_SERVICES_HAS_SWAP_CHART = 1<<17,
+    NETDATA_EBPF_SERVICES_HAS_SOCKET_CHART = 1<<18,
+    NETDATA_EBPF_SERVICES_HAS_FD_CHART = 1<<19,
+    NETDATA_EBPF_SERVICES_HAS_VFS_CHART = 1<<20,
+    NETDATA_EBPF_SERVICES_HAS_OOMKILL_CHART = 1<<21,
+    NETDATA_EBPF_SERVICES_HAS_CACHESTAT_CHART = 1<<2