Update binaries (eBPF) (#16671)

19 files changed, 53 insertions, 170 deletions

diff --git a/collectors/ebpf.plugin/ebpf.c b/collectors/ebpf.plugin/ebpf.c
index f9fc88db9f..3ad701505b 100644
--- a/collectors/ebpf.plugin/ebpf.c
+++ b/collectors/ebpf.plugin/ebpf.c
@@ -1797,9 +1797,9 @@ static void ebpf_parse_ip_list_unsafe(void **out, char *ip)
             }
         }
 
-        if ((be64toh(*(uint64_t *)&first.addr32[2]) > be64toh(*(uint64_t *)&last.addr32[2]) &&
-             !memcmp(first.addr32, last.addr32, 2*sizeof(uint32_t))) ||
-            (be64toh(*(uint64_t *)&first.addr32) > be64toh(*(uint64_t *)&last.addr32)) ) {
+        if ((be64toh(*(uint64_t *)&first.addr64[1]) > be64toh(*(uint64_t *)&last.addr64[1]) &&
+             !memcmp(first.addr64, last.addr64, sizeof(uint64_t))) ||
+            (be64toh(*(uint64_t *)&first.addr64) > be64toh(*(uint64_t *)&last.addr64)) ) {
             netdata_log_info("The specified range %s is invalid, the second address is smallest than the first, it will be ignored.",
                              ipdup);
             goto cleanipdup;
diff --git a/collectors/ebpf.plugin/ebpf_apps.h b/collectors/ebpf.plugin/ebpf_apps.h
index 2580915078..b2837b7d44 100644
--- a/collectors/ebpf.plugin/ebpf_apps.h
+++ b/collectors/ebpf.plugin/ebpf_apps.h
@@ -18,6 +18,10 @@
 #define NETDATA_APPS_NET_GROUP "net"
 #define NETDATA_APPS_IPC_SHM_GROUP "ipc shm"
 
+#ifndef TASK_COMM_LEN
+#define TASK_COMM_LEN 16
+#endif
+
 #include "ebpf_process.h"
 #include "ebpf_dcstat.h"
 #include "ebpf_disk.h"
@@ -139,7 +143,12 @@ struct ebpf_pid_on_target {
 // ----------------------------------------------------------------------------
 // Structures used to read information from kernel ring
 typedef struct ebpf_process_stat {
-    uint64_t pid_tgid; // This cannot be removed, because it is used inside kernel ring.
+    uint64_t ct;
+    uint32_t uid;
+    uint32_t gid;
+    char name[TASK_COMM_LEN];
+
+    uint32_t tgid;
     uint32_t pid;
 
     //Counter
diff --git a/collectors/ebpf.plugin/ebpf_cachestat.c b/collectors/ebpf.plugin/ebpf_cachestat.c
index 59a631d4a7..24710ea5af 100644
--- a/collectors/ebpf.plugin/ebpf_cachestat.c
+++ b/collectors/ebpf.plugin/ebpf_cachestat.c
@@ -78,7 +78,6 @@ static void ebpf_cachestat_disable_probe(struct cachestat_bpf *obj)
     bpf_program__set_autoload(obj->progs.netdata_set_page_dirty_kprobe, false);
     bpf_program__set_autoload(obj->progs.netdata_account_page_dirtied_kprobe, false);
     bpf_program__set_autoload(obj->progs.netdata_mark_buffer_dirty_kprobe, false);
-    bpf_program__set_autoload(obj->progs.netdata_release_task_kprobe, false);
 }
 
 /*
@@ -119,7 +118,6 @@ static void ebpf_cachestat_disable_trampoline(struct cachestat_bpf *obj)
     bpf_program__set_autoload(obj->progs.netdata_set_page_dirty_fentry, false);
     bpf_program__set_autoload(obj->progs.netdata_account_page_dirtied_fentry, false);
     bpf_program__set_autoload(obj->progs.netdata_mark_buffer_dirty_fentry, false);
-    bpf_program__set_autoload(obj->progs.netdata_release_task_fentry, false);
 }
 
 /*
@@ -175,9 +173,6 @@ static inline void netdata_set_trampoline_target(struct cachestat_bpf *obj)
 
     bpf_program__set_attach_target(obj->progs.netdata_mark_buffer_dirty_fentry, 0,
                                    cachestat_targets[NETDATA_KEY_CALLS_MARK_BUFFER_DIRTY].name);
-
-    bpf_program__set_attach_target(obj->progs.netdata_release_task_fentry, 0,
-                                   EBPF_COMMON_FNCT_CLEAN_UP);
 }
 
 /**
@@ -234,13 +229,6 @@ static int ebpf_cachestat_attach_probe(struct cachestat_bpf *obj)
     if (ret)
         return -1;
 
-    obj->links.netdata_release_task_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_release_task_kprobe,
-                                                                        false,
-                                                                        EBPF_COMMON_FNCT_CLEAN_UP);
-    ret = libbpf_get_error(obj->links.netdata_release_task_kprobe);
-    if (ret)
-        return -1;
-
     return 0;
 }
 
@@ -277,19 +265,6 @@ static void ebpf_cachestat_set_hash_tables(struct cachestat_bpf *obj)
 }
 
 /**
- *  Disable Release Task
- *
- *  Disable release task when apps is not enabled.
- *
- *  @param obj is the main structure for bpf objects.
- */
-static void ebpf_cachestat_disable_release_task(struct cachestat_bpf *obj)
-{
-    bpf_program__set_autoload(obj->progs.netdata_release_task_kprobe, false);
-    bpf_program__set_autoload(obj->progs.netdata_release_task_fentry, false);
-}
-
-/**
  * Load and attach
  *
  * Load and attach the eBPF code in kernel.
@@ -316,9 +291,6 @@ static inline int ebpf_cachestat_load_and_attach(struct cachestat_bpf *obj, ebpf
 
     ebpf_cachestat_adjust_map(obj, em);
 
-    if (!em->apps_charts && !em->cgroup_charts)
-        ebpf_cachestat_disable_release_task(obj);
-
     int ret = cachestat_bpf__load(obj);
     if (ret) {
         return ret;
diff --git a/collectors/ebpf.plugin/ebpf_cachestat.h b/collectors/ebpf.plugin/ebpf_cachestat.h
index ba2b128331..c037090540 100644
--- a/collectors/ebpf.plugin/ebpf_cachestat.h
+++ b/collectors/ebpf.plugin/ebpf_cachestat.h
@@ -69,6 +69,12 @@ enum cachestat_tables {
 };
 
 typedef struct netdata_publish_cachestat_pid {
+    uint64_t ct;
+    uint32_t tgid;
+    uint32_t uid;
+    uint32_t gid;
+    char name[TASK_COMM_LEN];
+
     uint64_t add_to_page_cache_lru;
     uint64_t mark_page_accessed;
     uint64_t account_page_dirtied;
diff --git a/collectors/ebpf.plugin/ebpf_dcstat.c b/collectors/ebpf.plugin/ebpf_dcstat.c
index 6653cf0ff1..e967d6cc92 100644
--- a/collectors/ebpf.plugin/ebpf_dcstat.c
+++ b/collectors/ebpf.plugin/ebpf_dcstat.c
@@ -75,7 +75,6 @@ static inline void ebpf_dc_disable_probes(struct dc_bpf *obj)
 {
     bpf_program__set_autoload(obj->progs.netdata_lookup_fast_kprobe, false);
     bpf_program__set_autoload(obj->progs.netdata_d_lookup_kretprobe, false);
-    bpf_program__set_autoload(obj->progs.netdata_dcstat_release_task_kprobe, false);
 }
 
 /*
@@ -89,7 +88,6 @@ static inline void ebpf_dc_disable_trampoline(struct dc_bpf *obj)
 {
     bpf_program__set_autoload(obj->progs.netdata_lookup_fast_fentry, false);
     bpf_program__set_autoload(obj->progs.netdata_d_lookup_fexit, false);
-    bpf_program__set_autoload(obj->progs.netdata_dcstat_release_task_fentry, false);
 }
 
 /**
@@ -106,9 +104,6 @@ static void ebpf_dc_set_trampoline_target(struct dc_bpf *obj)
 
     bpf_program__set_attach_target(obj->progs.netdata_d_lookup_fexit, 0,
                                    dc_targets[NETDATA_DC_TARGET_D_LOOKUP].name);
-
-    bpf_program__set_attach_target(obj->progs.netdata_dcstat_release_task_fentry, 0,
-                                   EBPF_COMMON_FNCT_CLEAN_UP);
 }
 
 /**
@@ -140,13 +135,6 @@ static int ebpf_dc_attach_probes(struct dc_bpf *obj)
     if (ret)
         return -1;
 
-    obj->links.netdata_dcstat_release_task_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_dcstat_release_task_kprobe,
-                                                                       false,
-                                                                       EBPF_COMMON_FNCT_CLEAN_UP);
-    ret = libbpf_get_error(obj->links.netdata_dcstat_release_task_kprobe);
-    if (ret)
-        return -1;
-
     return 0;
 }
 
@@ -206,19 +194,6 @@ netdata_ebpf_program_loaded_t ebpf_dc_update_load(ebpf_module_t *em)
 }
 
 /**
- *  Disable Release Task
- *
- *  Disable release task when apps is not enabled.
- *
- *  @param obj is the main structure for bpf objects.
- */
-static void ebpf_dc_disable_release_task(struct dc_bpf *obj)
-{
-    bpf_program__set_autoload(obj->progs.netdata_dcstat_release_task_kprobe, false);
-    bpf_program__set_autoload(obj->progs.netdata_dcstat_release_task_fentry, false);
-}
-
-/**
  * Load and attach
  *
  * Load and attach the eBPF code in kernel.
@@ -241,9 +216,6 @@ static inline int ebpf_dc_load_and_attach(struct dc_bpf *obj, ebpf_module_t *em)
 
     ebpf_dc_adjust_map(obj, em);
 
-    if (!em->apps_charts && !em->cgroup_charts)
-        ebpf_dc_disable_release_task(obj);
-
     int ret = dc_bpf__load(obj);
     if (ret) {
         return ret;
diff --git a/collectors/ebpf.plugin/ebpf_dcstat.h b/collectors/ebpf.plugin/ebpf_dcstat.h
index 4d6aff12e8..1b058c123b 100644
--- a/collectors/ebpf.plugin/ebpf_dcstat.h
+++ b/collectors/ebpf.plugin/ebpf_dcstat.h
@@ -64,6 +64,12 @@ enum directory_cache_targets {
 };
 
 typedef struct netdata_publish_dcstat_pid {
+    uint64_t ct;
+    uint32_t tgid;
+    uint32_t uid;
+    uint32_t gid;
+    char name[TASK_COMM_LEN];
+
     uint64_t cache_access;
     uint64_t file_system;
     uint64_t not_found;
diff --git a/collectors/ebpf.plugin/ebpf_fd.c b/collectors/ebpf.plugin/ebpf_fd.c
index 8f7f5818f7..165e47529f 100644
--- a/collectors/ebpf.plugin/ebpf_fd.c
+++ b/collectors/ebpf.plugin/ebpf_fd.c
@@ -73,7 +73,6 @@ static inline void ebpf_fd_disable_probes(struct fd_bpf *obj)
 {
     bpf_program__set_autoload(obj->progs.netdata_sys_open_kprobe, false);
     bpf_program__set_autoload(obj->progs.netdata_sys_open_kretprobe, false);
-    bpf_program__set_autoload(obj->progs.netdata_release_task_fd_kprobe, false);
     if (!strcmp(fd_targets[NETDATA_FD_SYSCALL_CLOSE].name, close_targets[NETDATA_FD_CLOSE_FD])) {
         bpf_program__set_autoload(obj->progs.netdata___close_fd_kretprobe, false);
         bpf_program__set_autoload(obj->progs.netdata___close_fd_kprobe, false);
@@ -118,7 +117,6 @@ static inline void ebpf_disable_trampoline(struct fd_bpf *obj)
     bpf_program__set_autoload(obj->progs.netdata_close_fd_fexit, false);
     bpf_program__set_autoload(obj->progs.netdata___close_fd_fentry, false);
     bpf_program__set_autoload(obj->progs.netdata___close_fd_fexit, false);
-    bpf_program__set_autoload(obj->progs.netdata_release_task_fd_fentry, false);
 }
 
 /*
@@ -150,7 +148,6 @@ static void ebpf_set_trampoline_target(struct fd_bpf *obj)
 {
     bpf_program__set_attach_target(obj->progs.netdata_sys_open_fentry, 0, fd_targets[NETDATA_FD_SYSCALL_OPEN].name);
     bpf_program__set_attach_target(obj->progs.netdata_sys_open_fexit, 0, fd_targets[NETDATA_FD_SYSCALL_OPEN].name);
-    bpf_program__set_attach_target(obj->progs.netdata_release_task_fd_fentry, 0, EBPF_COMMON_FNCT_CLEAN_UP);
 
     if (!strcmp(fd_targets[NETDATA_FD_SYSCALL_CLOSE].name, close_targets[NETDATA_FD_CLOSE_FD])) {
         bpf_program__set_attach_target(
@@ -187,13 +184,6 @@ static int ebpf_fd_attach_probe(struct fd_bpf *obj)
     if (ret)
         return -1;
 
-    obj->links.netdata_release_task_fd_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_release_task_fd_kprobe,
-                                                                           false,
-                                                                           EBPF_COMMON_FNCT_CLEAN_UP);
-    ret = libbpf_get_error(obj->links.netdata_release_task_fd_kprobe);
-    if (ret)
-        return -1;
-
     if (!strcmp(fd_targets[NETDATA_FD_SYSCALL_CLOSE].name, close_targets[NETDATA_FD_CLOSE_FD])) {
         obj->links.netdata_close_fd_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_close_fd_kretprobe, true,
                                                                            fd_targets[NETDATA_FD_SYSCALL_CLOSE].name);
@@ -302,19 +292,6 @@ static void ebpf_fd_adjust_map(struct fd_bpf *obj, ebpf_module_t *em)
 }
 
 /**
- *  Disable Release Task
- *
- *  Disable release task when apps is not enabled.
- *
- *  @param obj is the main structure for bpf objects.
- */
-static void ebpf_fd_disable_release_task(struct fd_bpf *obj)
-{
-    bpf_program__set_autoload(obj->progs.netdata_release_task_fd_kprobe, false);
-    bpf_program__set_autoload(obj->progs.netdata_release_task_fd_fentry, false);
-}
-
-/**
  * Load and attach
  *
  * Load and attach the eBPF code in kernel.
@@ -339,8 +316,6 @@ static inline int ebpf_fd_load_and_attach(struct fd_bpf *obj, ebpf_module_t *em)
         ebpf_disable_specific_trampoline(obj);
 
         ebpf_set_trampoline_target(obj);
-        // TODO: Remove this in next PR, because this specific trampoline has an error.
-        bpf_program__set_autoload(obj->progs.netdata_release_task_fd_fentry, false);
     } else {
         ebpf_disable_trampoline(obj);
         ebpf_disable_specific_probes(obj);
@@ -348,9 +323,6 @@ static inline int ebpf_fd_load_and_attach(struct fd_bpf *obj, ebpf_module_t *em)
 
     ebpf_fd_adjust_map(obj, em);
 
-    if (!em->apps_charts && !em->cgroup_charts)
-        ebpf_fd_disable_release_task(obj);
-
     int ret = fd_bpf__load(obj);
     if (ret) {
         return ret;
diff --git a/collectors/ebpf.plugin/ebpf_fd.h b/collectors/ebpf.plugin/ebpf_fd.h
index 00986673eb..eb32f54133 100644
--- a/collectors/ebpf.plugin/ebpf_fd.h
+++ b/collectors/ebpf.plugin/ebpf_fd.h
@@ -38,6 +38,12 @@
 #define NETDATA_EBPF_FD_ARAL_NAME "ebpf_fd"
 
 typedef struct netdata_fd_stat {
+    uint64_t ct;
+    uint32_t tgid;
+    uint32_t uid;
+    uint32_t gid;
+    char name[TASK_COMM_LEN];
+
     uint32_t open_call;                    // Open syscalls (open and openat)
     uint32_t close_call;                   // Close syscall (close)
 
diff --git a/collectors/ebpf.plugin/ebpf_shm.c b/collectors/ebpf.plugin/ebpf_shm.c
index fa8b08b380..2377ad8d97 100644
--- a/collectors/ebpf.plugin/ebpf_shm.c
+++ b/collectors/ebpf.plugin/ebpf_shm.c
@@ -89,7 +89,6 @@ static void ebpf_disable_probe(struct shm_bpf *obj)
     bpf_program__set_autoload(obj->progs.netdata_shmat_probe, false);
     bpf_program__set_autoload(obj->progs.netdata_shmdt_probe, false);
     bpf_program__set_autoload(obj->progs.netdata_shmctl_probe, false);
-    bpf_program__set_autoload(obj->progs.netdata_shm_release_task_probe, false);
 }
 
 /*
@@ -105,7 +104,6 @@ static void ebpf_disable_trampoline(struct shm_bpf *obj)
     bpf_program__set_autoload(obj->progs.netdata_shmat_fentry, false);
     bpf_program__set_autoload(obj->progs.netdata_shmdt_fentry, false);
     bpf_program__set_autoload(obj->progs.netdata_shmctl_fentry, false);
-    bpf_program__set_autoload(obj->progs.netdata_shm_release_task_fentry, false);
 }
 
 /**
@@ -138,9 +136,6 @@ static void ebpf_set_trampoline_target(struct shm_bpf *obj)
                             shm_targets[NETDATA_KEY_SHMCTL_CALL].name, running_on_kernel);
     bpf_program__set_attach_target(obj->progs.netdata_shmctl_fentry, 0,
                                    syscall);
-
-    bpf_program__set_attach_target(obj->progs.netdata_shm_release_task_fentry, 0,
-                                   EBPF_COMMON_FNCT_CLEAN_UP);
 }
 
 /**
@@ -188,13 +183,6 @@ static int ebpf_shm_attach_probe(struct shm_bpf *obj)
     if (ret)
         return -1;
 
-    obj->links.netdata_shm_release_task_probe = bpf_program__attach_kprobe(obj->progs.netdata_shm_release_task_probe,
-                                                                           false, EBPF_COMMON_FNCT_CLEAN_UP);
-    ret = (int)libbpf_get_error(obj->links.netdata_shm_release_task_probe);
-    if (ret)
-        return -1;
-
-
     return 0;
 }
 
@@ -211,19 +199,6 @@ static void ebpf_shm_set_hash_tables(struct shm_bpf *obj)
 }
 
 /**
- *  Disable Release Task
- *
- *  Disable release task when apps is not enabled.
- *
- *  @param obj is the main structure for bpf objects.
- */
-static void ebpf_shm_disable_release_task(struct shm_bpf *obj)
-{
-    bpf_program__set_autoload(obj->progs.netdata_shm_release_task_probe, false);
-    bpf_program__set_autoload(obj->progs.netdata_shm_release_task_fentry, false);
-}
-
-/**
  * Adjust Map Size
  *
  * Resize maps according input from users.
@@ -271,8 +246,6 @@ static inline int ebpf_shm_load_and_attach(struct shm_bpf *obj, ebpf_module_t *e
     }
 
     ebpf_shm_adjust_map(obj, em);
-    if (!em->apps_charts && !em->cgroup_charts)
-        ebpf_shm_disable_release_task(obj);
 
     int ret = shm_bpf__load(obj);
     if (!ret) {
diff --git a/collectors/ebpf.plugin/ebpf_shm.h b/collectors/ebpf.plugin/ebpf_shm.h
index a415006e66..979f33f913 100644
--- a/collectors/ebpf.plugin/ebpf_shm.h
+++ b/collectors/ebpf.plugin/ebpf_shm.h
@@ -32,6 +32,9 @@
 #define NETDATA_EBPF_SHM_ARAL_NAME "ebpf_shm"
 
 typedef struct netdata_publish_shm {
+    uint64_t ct;
+    char name[TASK_COMM_LEN];
+
     uint64_t get;
     uint64_t at;
     uint64_t dt;
diff --git a/collectors/ebpf.plugin/ebpf_socket.h b/collectors/ebpf.plugin/ebpf_socket.h
index a6d3e03b6d..77e436afc7 100644
--- a/collectors/ebpf.plugin/ebpf_socket.h
+++ b/collectors/ebpf.plugin/ebpf_socket.h
@@ -269,6 +269,8 @@ extern ebpf_network_viewer_options_t network_viewer_opt;
  * Structure to store socket information
  */
 typedef struct netdata_socket {
+    char name[TASK_COMM_LEN];
+
     // Timestamp
     uint64_t first_timestamp;
     uint64_t current_timestamp;
diff --git a/collectors/ebpf.plugin/ebpf_swap.c b/collectors/ebpf.plugin/ebpf_swap.c
index c86516ac27..8964e80d5c 100644
--- a/collectors/ebpf.plugin/ebpf_swap.c
+++ b/collectors/ebpf.plugin/ebpf_swap.c
@@ -77,7 +77,6 @@ static void ebpf_swap_disable_trampoline(struct swap_bpf *obj)
 {
     bpf_program__set_autoload(obj->progs.netdata_swap_readpage_fentry, false);
     bpf_program__set_autoload(obj->progs.netdata_swap_writepage_fentry, false);
-    bpf_program__set_autoload(obj->progs.netdata_release_task_fentry, false);
 }
 
 /**
@@ -94,9 +93,6 @@ static void ebpf_swap_set_trampoline_target(struct swap_bpf *obj)
 
     bpf_program__set_attach_target(obj->progs.netdata_swap_writepage_fentry, 0,
                                    swap_targets[NETDATA_KEY_SWAP_WRITEPAGE_CALL].name);
-
-    bpf_program__set_attach_target(obj->progs.netdata_release_task_fentry, 0,
-                                   EBPF_COMMON_FNCT_CLEAN_UP);
 }
 
 /**
@@ -160,18 +156,6 @@ static void ebpf_swap_adjust_map(struct swap_bpf *obj, ebpf_module_t *em)
 }
 
 /**
- *  Disable Release Task
- *
- *  Disable release task when apps is not enabled.
- *
- *  @param obj is the main structure for bpf objects.
- */
-static void ebpf_swap_disable_release_task(struct swap_bpf *obj)
-{
-    bpf_program__set_autoload(obj->progs.netdata_release_task_fentry, false);
-}
-
-/**
  * Load and attach
  *
  * Load and attach the eBPF code in kernel.
@@ -196,9 +180,6 @@ static inline int ebpf_swap_load_and_attach(struct swap_bpf *obj, ebpf_module_t
 
     ebpf_swap_adjust_map(obj, em);
 
-    if (!em->apps_charts && !em->cgroup_charts)
-        ebpf_swap_disable_release_task(obj);
-
     int ret = swap_bpf__load(obj);
     if (ret) {
         return ret;
diff --git a/collectors/ebpf.plugin/ebpf_swap.h b/collectors/ebpf.plugin/ebpf_swap.h
index 79e9a01aca..3e1025c5ac 100644
--- a/collectors/ebpf.plugin/ebpf_swap.h
+++ b/collectors/ebpf.plugin/ebpf_swap.h
@@ -25,6 +25,12 @@
 #define NETDATA_SYSTEMD_SWAP_WRITE_CONTEXT "services.swap_write"
 
 typedef struct netdata_publish_swap {
+    uint64_t ct;
+    uint32_t tgid;
+    uint32_t uid;
+    uint32_t gid;
+    char name[TASK_COMM_LEN];
+
     uint64_t read;
     uint64_t write;
 } netdata_publish_swap_t;
diff --git a/collectors/ebpf.plugin/ebpf_vfs.c b/collectors/ebpf.plugin/ebpf_vfs.c
index de4b19aa5c..47df4840b9 100644
--- a/collectors/ebpf.plugin/ebpf_vfs.c
+++ b/collectors/ebpf.plugin/ebpf_vfs.c
@@ -90,7 +90,6 @@ static void ebpf_vfs_disable_probes(struct vfs_bpf *obj)
     bpf_program__set_autoload(obj->progs.netdata_vfs_open_kretprobe, false);
     bpf_program__set_autoload(obj->progs.netdata_vfs_create_kprobe, false);
     bpf_program__set_autoload(obj->progs.netdata_vfs_create_kretprobe, false);
-    bpf_program__set_autoload(obj->progs.netdata_vfs_release_task_kprobe, false);
 }
 
 /*
@@ -116,7 +115,6 @@ static void ebpf_vfs_disable_trampoline(struct vfs_bpf *obj)
     bpf_program__set_autoload(obj->progs.netdata_vfs_open_fentry, false);
     bpf_program__set_autoload(obj->progs.netdata_vfs_open_fexit, false);
     bpf_program__set_autoload(obj->progs.netdata_vfs_create_fentry, false);
-    bpf_program__set_autoload(obj->progs.netdata_vfs_release_task_fentry, false);
 }
 
 /**
@@ -155,8 +153,6 @@ static void ebpf_vfs_set_trampoline_target(struct vfs_bpf *obj)
     bpf_program__set_attach_target(obj->progs.netdata_vfs_open_fexit, 0, vfs_targets[NETDATA_EBPF_VFS_OPEN].name);
 
     bpf_program__set_attach_target(obj->progs.netdata_vfs_create_fentry, 0, vfs_targets[NETDATA_EBPF_VFS_CREATE].name);
-
-    bpf_program__set_attach_target(obj->progs.netdata_vfs_release_task_fentry, 0, EBPF_COMMON_FNCT_CLEAN_UP);
 }
 
 /**
@@ -302,13 +298,6 @@ static int ebpf_vfs_attach_probe(struct vfs_bpf *obj)
     if (ret)
         return -1;
 
-    obj->links.netdata_vfs_release_task_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_vfs_release_task_fentry,
-                                                                            true,
-                                                                            EBPF_COMMON_FNCT_CLEAN_UP);
-    ret = libbpf_get_error(obj->links.netdata_vfs_release_task_kprobe);
-    if (ret)
-        return -1;
-
     return 0;
 }
 
@@ -345,19 +334,6 @@ static void ebpf_vfs_set_hash_tables(struct vfs_bpf *obj)
 }
 
 /**
- *  Disable Release Task
- *
- *  Disable release task when apps is not enabled.
- *
- *  @param obj is the main structure for bpf objects.
- */
-static void ebpf_vfs_disable_release_task(struct vfs_bpf *obj)
-{
-    bpf_program__set_autoload(obj->progs.netdata_vfs_release_task_fentry, false);
-    bpf_program__set_autoload(obj->progs.netdata_vfs_release_task_kprobe, false);
-}
-
-/**
  * Load and attach
  *
  * Load and attach the eBPF code in kernel.
@@ -382,9 +358,6 @@ static inline int ebpf_vfs_load_and_attach(struct vfs_bpf *obj, ebpf_module_t *e
 
     ebpf_vfs_adjust_map(obj, em);
 
-    if (!em->apps_charts && !em->cgroup_charts)
-        ebpf_vfs_disable_release_task(obj);
-
     int ret = vfs_bpf__load(obj);
     if (ret) {
         return ret;
diff --git a/collectors/ebpf.plugin/ebpf_vfs.h b/collectors/ebpf.plugin/ebpf_vfs.h
index 8fe12a7eba..32de14ff47 100644
--- a/collectors/ebpf.plugin/ebpf_vfs.h
+++ b/collectors/ebpf.plugin/ebpf_vfs.h
@@ -74,9 +74,11 @@
 #define NETDATA_EBPF_VFS_ARAL_NAME "ebpf_vfs"
 
 typedef struct netdata_publish_vfs {
-    uint64_t pid_tgid;
-    uint32_t pid;
-    uint32_t pad;
+    uint64_t ct;
+    uint32_t tgid;
+    uint32_t uid;
+    uint32_t gid;
+    char name[TASK_COMM_LEN];
 
     //Counter
     uint32_t write_call;
diff --git a/packaging/ebpf-co-re.checksums b/packaging/ebpf-co-re.checksums
index c51f3ef5fd..e5ea747978 100644
--- a/packaging/ebpf-co-re.checksums
+++ b/packaging/ebpf-co-re.checksums
@@ -1 +1 @@
-7ef8d2a0f485b4c81942f66c50e1aedcd568b7997a933c50c0ebbd8353543c08  netdata-ebpf-co-re-glibc-v1.2.8.tar.xz
+0ada28dc3a19cf40081465cd44bf7a211320c73dab6555d59bb8fbda2aa5b1f4  netdata-ebpf-co-re-glibc-v1.2.14.tar.xz
diff --git a/packaging/ebpf-co-re.version b/packaging/ebpf-co-re.version
index d1f79a9413..0458137156 100644
--- a/packaging/ebpf-co-re.version
+++ b/packaging/ebpf-co-re.version
@@ -1 +1 @@
-v1.2.8
+v1.2.14
diff --git a/packaging/ebpf.checksums b/packaging/ebpf.checksums
index 28f023d524..4b2347bfef 100644
--- a/packaging/ebpf.checksums
+++ b/packaging/ebpf.checksums
@@ -1,3 +1,3 @@
-9035b6b8dda5230c1ddc44991518a3ee069bd497ad5a8e5448b79dc4b8c51c43  ./netdata-kernel-collector-glibc-v1.2.8.tar.xz
-e5b1a141475f75c60c282a2e3ce8e3914893e75d474c976bad95f66d4c9846c5  ./netdata-kernel-collector-musl-v1.2.8.tar.xz
-d6081a2fedc9435d1ab430697cb101123cebaac07b62fb91d790ca526923f4e3  ./netdata-kernel-collector-static-v1.2.8.tar.xz
+a44096c5b42f1a75a13e5499e9427b9ba4180c37c856b560f108ec0dff545616  ./netdata-kernel-collector-glibc-v1.2.13.tar.xz
+d1d2a2cc12a8d6a059edfa9ca42e2e3914ec70e0d54378600d3a93e7e3955d96  ./netdata-kernel-collector-musl-v1.2.13.tar.xz
+fa6142867d9dc1bfe222ac5a06e609c34e2eb11a5ee33d5d5a0832a0c8b8a2ef  ./netdata-kernel-collector-static-v1.2.13.tar.xz
diff --git a/packaging/ebpf.version b/packaging/ebpf.version
index d1f79a9413..c679343cbd 100644
--- a/packaging/ebpf.version
+++ b/packaging/ebpf.version
@@ -1 +1 @@
-v1.2.8
+v1.2.13