eBPF socket function (#15850)

1 files changed, 723 insertions, 1979 deletions

diff --git a/collectors/ebpf.plugin/ebpf_socket.c b/collectors/ebpf.plugin/ebpf_socket.c
index e4798b30c8..33a82dec0e 100644
--- a/collectors/ebpf.plugin/ebpf_socket.c
+++ b/collectors/ebpf.plugin/ebpf_socket.c
@@ -5,9 +5,6 @@
 #include "ebpf.h"
 #include "ebpf_socket.h"
 
-// ----------------------------------------------------------------------------
-// ARAL vectors used to speed up processing
-
 /*****************************************************************
  *
  *  GLOBAL VARIABLES
@@ -23,16 +20,7 @@ static char *socket_id_names[NETDATA_MAX_SOCKET_VECTOR] = { "tcp_cleanup_rbuf",
                                                             "tcp_connect_v4", "tcp_connect_v6", "inet_csk_accept_tcp",
                                                             "inet_csk_accept_udp" };
 
-static ebpf_local_maps_t socket_maps[] = {{.name = "tbl_bandwidth",
-                                           .internal_input = NETDATA_COMPILED_CONNECTIONS_ALLOWED,
-                                           .user_input = NETDATA_MAXIMUM_CONNECTIONS_ALLOWED,
-                                           .type = NETDATA_EBPF_MAP_RESIZABLE | NETDATA_EBPF_MAP_PID,
-                                           .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED,
-#ifdef LIBBPF_MAJOR_VERSION
-                                           .map_type = BPF_MAP_TYPE_PERCPU_HASH
-#endif
-                                          },
-                                          {.name = "tbl_global_sock",
+static ebpf_local_maps_t socket_maps[] = {{.name = "tbl_global_sock",
                                            .internal_input = NETDATA_SOCKET_COUNTER,
                                            .user_input = 0, .type = NETDATA_EBPF_MAP_STATIC,
                                            .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED,
@@ -48,16 +36,7 @@ static ebpf_local_maps_t socket_maps[] = {{.name = "tbl_bandwidth",
                                            .map_type = BPF_MAP_TYPE_PERCPU_HASH
 #endif
                                            },
-                                          {.name = "tbl_conn_ipv4",
-                                           .internal_input = NETDATA_COMPILED_CONNECTIONS_ALLOWED,
-                                           .user_input = NETDATA_MAXIMUM_CONNECTIONS_ALLOWED,
-                                           .type = NETDATA_EBPF_MAP_STATIC,
-                                           .map_fd = ND_EBPF_MAP_FD_NOT_INITIALIZED,
-#ifdef LIBBPF_MAJOR_VERSION
-                                           .map_type = BPF_MAP_TYPE_PERCPU_HASH
-#endif
-                                          },
-                                          {.name = "tbl_conn_ipv6",
+                                           {.name = "tbl_nd_socket",
                                            .internal_input = NETDATA_COMPILED_CONNECTIONS_ALLOWED,
                                            .user_input = NETDATA_MAXIMUM_CONNECTIONS_ALLOWED,
                                            .type = NETDATA_EBPF_MAP_STATIC,
@@ -93,11 +72,6 @@ static netdata_idx_t *socket_hash_values = NULL;
 static netdata_syscall_stat_t socket_aggregated_data[NETDATA_MAX_SOCKET_VECTOR];
 static netdata_publish_syscall_t socket_publish_aggregated[NETDATA_MAX_SOCKET_VECTOR];
 
-static ebpf_bandwidth_t *bandwidth_vector = NULL;
-
-pthread_mutex_t nv_mutex;
-netdata_vector_plot_t inbound_vectors = { .plot = NULL, .next = 0, .last = 0 };
-netdata_vector_plot_t outbound_vectors = { .plot = NULL, .next = 0, .last = 0 };
 netdata_socket_t *socket_values;
 
 ebpf_network_viewer_port_list_t *listen_ports = NULL;
@@ -108,28 +82,30 @@ struct config socket_config = { .first_section = NULL,
     .index = { .avl_tree = { .root = NULL, .compar = appconfig_section_compare },
         .rwlock = AVL_LOCK_INITIALIZER } };
 
-netdata_ebpf_targets_t socket_targets[] = { {.name = "inet_csk_accept", .mode = EBPF_LOAD_TRAMPOLINE},
-                                            {.name = "tcp_retransmit_skb", .mode = EBPF_LOAD_TRAMPOLINE},
-                                            {.name = "tcp_cleanup_rbuf", .mode = EBPF_LOAD_TRAMPOLINE},
-                                            {.name = "tcp_close", .mode = EBPF_LOAD_TRAMPOLINE},
-                                            {.name = "udp_recvmsg", .mode = EBPF_LOAD_TRAMPOLINE},
-                                            {.name = "tcp_sendmsg", .mode = EBPF_LOAD_TRAMPOLINE},
-                                            {.name = "udp_sendmsg", .mode = EBPF_LOAD_TRAMPOLINE},
-                                            {.name = "tcp_v4_connect", .mode = EBPF_LOAD_TRAMPOLINE},
-                                            {.name = "tcp_v6_connect", .mode = EBPF_LOAD_TRAMPOLINE},
+netdata_ebpf_targets_t socket_targets[] = { {.name = "inet_csk_accept", .mode = EBPF_LOAD_PROBE},
+                                            {.name = "tcp_retransmit_skb", .mode = EBPF_LOAD_PROBE},
+                                            {.name = "tcp_cleanup_rbuf", .mode = EBPF_LOAD_PROBE},
+                                            {.name = "tcp_close", .mode = EBPF_LOAD_PROBE},
+                                            {.name = "udp_recvmsg", .mode = EBPF_LOAD_PROBE},
+                                            {.name = "tcp_sendmsg", .mode = EBPF_LOAD_PROBE},
+                                            {.name = "udp_sendmsg", .mode = EBPF_LOAD_PROBE},
+                                            {.name = "tcp_v4_connect", .mode = EBPF_LOAD_PROBE},
+                                            {.name = "tcp_v6_connect", .mode = EBPF_LOAD_PROBE},
                                             {.name = NULL, .mode = EBPF_LOAD_TRAMPOLINE}};
 
-struct netdata_static_thread socket_threads = {
-    .name = "EBPF SOCKET READ",
-    .config_section = NULL,
-    .config_name = NULL,
-    .env_name = NULL,
-    .enabled = 1,
-    .thread = NULL,
-    .init_routine = NULL,
-    .start_routine = NULL
+struct netdata_static_thread ebpf_read_socket = {
+        .name = "EBPF_READ_SOCKET",
+        .config_section = NULL,
+        .config_name = NULL,
+        .env_name = NULL,
+        .enabled = 1,
+        .thread = NULL,
+        .init_routine = NULL,
+        .start_routine = NULL
 };
 
+ARAL *aral_socket_table = NULL;
+
 #ifdef NETDATA_DEV_MODE
 int socket_disable_priority;
 #endif
@@ -145,7 +121,9 @@ int socket_disable_priority;
 static void ebpf_socket_disable_probes(struct socket_bpf *obj)
 {
     bpf_program__set_autoload(obj->progs.netdata_inet_csk_accept_kretprobe, false);
+    bpf_program__set_autoload(obj->progs.netdata_tcp_v4_connect_kprobe, false);
     bpf_program__set_autoload(obj->progs.netdata_tcp_v4_connect_kretprobe, false);
+    bpf_program__set_autoload(obj->progs.netdata_tcp_v6_connect_kprobe, false);
     bpf_program__set_autoload(obj->progs.netdata_tcp_v6_connect_kretprobe, false);
     bpf_program__set_autoload(obj->progs.netdata_tcp_retransmit_skb_kprobe, false);
     bpf_program__set_autoload(obj->progs.netdata_tcp_cleanup_rbuf_kprobe, false);
@@ -156,7 +134,6 @@ static void ebpf_socket_disable_probes(struct socket_bpf *obj)
     bpf_program__set_autoload(obj->progs.netdata_tcp_sendmsg_kprobe, false);
     bpf_program__set_autoload(obj->progs.netdata_udp_sendmsg_kretprobe, false);
     bpf_program__set_autoload(obj->progs.netdata_udp_sendmsg_kprobe, false);
-    bpf_program__set_autoload(obj->progs.netdata_socket_release_task_kprobe, false);
 }
 
 /**
@@ -168,8 +145,10 @@ static void ebpf_socket_disable_probes(struct socket_bpf *obj)
  */
 static void ebpf_socket_disable_trampoline(struct socket_bpf *obj)
 {
-    bpf_program__set_autoload(obj->progs.netdata_inet_csk_accept_fentry, false);
+    bpf_program__set_autoload(obj->progs.netdata_inet_csk_accept_fexit, false);
+    bpf_program__set_autoload(obj->progs.netdata_tcp_v4_connect_fentry, false);
     bpf_program__set_autoload(obj->progs.netdata_tcp_v4_connect_fexit, false);
+    bpf_program__set_autoload(obj->progs.netdata_tcp_v6_connect_fentry, false);
     bpf_program__set_autoload(obj->progs.netdata_tcp_v6_connect_fexit, false);
     bpf_program__set_autoload(obj->progs.netdata_tcp_retransmit_skb_fentry, false);
     bpf_program__set_autoload(obj->progs.netdata_tcp_cleanup_rbuf_fentry, false);
@@ -180,7 +159,6 @@ static void ebpf_socket_disable_trampoline(struct socket_bpf *obj)
     bpf_program__set_autoload(obj->progs.netdata_tcp_sendmsg_fexit, false);
     bpf_program__set_autoload(obj->progs.netdata_udp_sendmsg_fentry, false);
     bpf_program__set_autoload(obj->progs.netdata_udp_sendmsg_fexit, false);
-    bpf_program__set_autoload(obj->progs.netdata_socket_release_task_fentry, false);
 }
 
 /**
@@ -190,12 +168,18 @@ static void ebpf_socket_disable_trampoline(struct socket_bpf *obj)
  */
 static void ebpf_set_trampoline_target(struct socket_bpf *obj)
 {
-    bpf_program__set_attach_target(obj->progs.netdata_inet_csk_accept_fentry, 0,
+    bpf_program__set_attach_target(obj->progs.netdata_inet_csk_accept_fexit, 0,
                                    socket_targets[NETDATA_FCNT_INET_CSK_ACCEPT].name);
 
+    bpf_program__set_attach_target(obj->progs.netdata_tcp_v4_connect_fentry, 0,
+                                   socket_targets[NETDATA_FCNT_TCP_V4_CONNECT].name);
+
     bpf_program__set_attach_target(obj->progs.netdata_tcp_v4_connect_fexit, 0,
                                    socket_targets[NETDATA_FCNT_TCP_V4_CONNECT].name);
 
+    bpf_program__set_attach_target(obj->progs.netdata_tcp_v6_connect_fentry, 0,
+                                   socket_targets[NETDATA_FCNT_TCP_V6_CONNECT].name);
+
     bpf_program__set_attach_target(obj->progs.netdata_tcp_v6_connect_fexit, 0,
                                    socket_targets[NETDATA_FCNT_TCP_V6_CONNECT].name);
 
@@ -205,7 +189,8 @@ static void ebpf_set_trampoline_target(struct socket_bpf *obj)
     bpf_program__set_attach_target(obj->progs.netdata_tcp_cleanup_rbuf_fentry, 0,
                                    socket_targets[NETDATA_FCNT_CLEANUP_RBUF].name);
 
-    bpf_program__set_attach_target(obj->progs.netdata_tcp_close_fentry, 0, socket_targets[NETDATA_FCNT_TCP_CLOSE].name);
+    bpf_program__set_attach_target(obj->progs.netdata_tcp_close_fentry, 0,
+                                   socket_targets[NETDATA_FCNT_TCP_CLOSE].name);
 
     bpf_program__set_attach_target(obj->progs.netdata_udp_recvmsg_fentry, 0,
                                    socket_targets[NETDATA_FCNT_UDP_RECEVMSG].name);
@@ -224,8 +209,6 @@ static void ebpf_set_trampoline_target(struct socket_bpf *obj)
 
     bpf_program__set_attach_target(obj->progs.netdata_udp_sendmsg_fexit, 0,
                                    socket_targets[NETDATA_FCNT_UDP_SENDMSG].name);
-
-    bpf_program__set_attach_target(obj->progs.netdata_socket_release_task_fentry, 0, EBPF_COMMON_FNCT_CLEAN_UP);
 }
 
 
@@ -241,9 +224,13 @@ static inline void ebpf_socket_disable_specific_trampoline(struct socket_bpf *ob
 {
     if (sel == MODE_RETURN) {
         bpf_program__set_autoload(obj->progs.netdata_tcp_sendmsg_fentry, false);
+        bpf_program__set_autoload(obj->progs.netdata_tcp_v4_connect_fentry, false);
+        bpf_program__set_autoload(obj->progs.netdata_tcp_v6_connect_fentry, false);
         bpf_program__set_autoload(obj->progs.netdata_udp_sendmsg_fentry, false);
     } else {
         bpf_program__set_autoload(obj->progs.netdata_tcp_sendmsg_fexit, false);
+        bpf_program__set_autoload(obj->progs.netdata_tcp_v4_connect_fexit, false);
+        bpf_program__set_autoload(obj->progs.netdata_tcp_v6_connect_fexit, false);
         bpf_program__set_autoload(obj->progs.netdata_udp_sendmsg_fexit, false);
     }
 }
@@ -260,9 +247,13 @@ static inline void ebpf_socket_disable_specific_probe(struct socket_bpf *obj, ne
 {
     if (sel == MODE_RETURN) {
         bpf_program__set_autoload(obj->progs.netdata_tcp_sendmsg_kprobe, false);
+        bpf_program__set_autoload(obj->progs.netdata_tcp_v4_connect_kprobe, false);
+        bpf_program__set_autoload(obj->progs.netdata_tcp_v6_connect_kprobe, false);
         bpf_program__set_autoload(obj->progs.netdata_udp_sendmsg_kprobe, false);
     } else {
         bpf_program__set_autoload(obj->progs.netdata_tcp_sendmsg_kretprobe, false);
+        bpf_program__set_autoload(obj->progs.netdata_tcp_v4_connect_kretprobe, false);
+        bpf_program__set_autoload(obj->progs.netdata_tcp_v6_connect_kretprobe, false);
         bpf_program__set_autoload(obj->progs.netdata_udp_sendmsg_kretprobe, false);
     }
 }
@@ -275,26 +266,12 @@ static inline void ebpf_socket_disable_specific_probe(struct socket_bpf *obj, ne
  * @param obj is the main structure for bpf objects.
  * @param sel option selected by user.
  */
-static int ebpf_socket_attach_probes(struct socket_bpf *obj, netdata_run_mode_t sel)
+static long ebpf_socket_attach_probes(struct socket_bpf *obj, netdata_run_mode_t sel)
 {
     obj->links.netdata_inet_csk_accept_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_inet_csk_accept_kretprobe,
                                                                               true,
                                                                               socket_targets[NETDATA_FCNT_INET_CSK_ACCEPT].name);
-    int ret = libbpf_get_error(obj->links.netdata_inet_csk_accept_kretprobe);
-    if (ret)
-            return -1;
-
-    obj->links.netdata_tcp_v4_connect_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_tcp_v4_connect_kretprobe,
-                                                                             true,
-                                                                             socket_targets[NETDATA_FCNT_TCP_V4_CONNECT].name);
-    ret = libbpf_get_error(obj->links.netdata_tcp_v4_connect_kretprobe);
-    if (ret)
-        return -1;
-
-    obj->links.netdata_tcp_v6_connect_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_tcp_v6_connect_kretprobe,
-                                                                             true,
-                                                                             socket_targets[NETDATA_FCNT_TCP_V6_CONNECT].name);
-    ret = libbpf_get_error(obj->links.netdata_tcp_v6_connect_kretprobe);
+    long ret = libbpf_get_error(obj->links.netdata_inet_csk_accept_kretprobe);
     if (ret)
         return -1;
 
@@ -347,6 +324,20 @@ static int ebpf_socket_attach_probes(struct socket_bpf *obj, netdata_run_mode_t
         ret = libbpf_get_error(obj->links.netdata_udp_sendmsg_kretprobe);
         if (ret)
             return -1;
+
+        obj->links.netdata_tcp_v4_connect_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_tcp_v4_connect_kretprobe,
+                                                                                 true,
+                                                                                 socket_targets[NETDATA_FCNT_TCP_V4_CONNECT].name);
+        ret = libbpf_get_error(obj->links.netdata_tcp_v4_connect_kretprobe);
+        if (ret)
+            return -1;
+
+        obj->links.netdata_tcp_v6_connect_kretprobe = bpf_program__attach_kprobe(obj->progs.netdata_tcp_v6_connect_kretprobe,
+                                                                                 true,
+                                                                                 socket_targets[NETDATA_FCNT_TCP_V6_CONNECT].name);
+        ret = libbpf_get_error(obj->links.netdata_tcp_v6_connect_kretprobe);
+        if (ret)
+            return -1;
     } else {
         obj->links.netdata_tcp_sendmsg_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_tcp_sendmsg_kprobe,
                                                                            false,
@@ -361,13 +352,21 @@ static int ebpf_socket_attach_probes(struct socket_bpf *obj, netdata_run_mode_t
         ret = libbpf_get_error(obj->links.netdata_udp_sendmsg_kprobe);
         if (ret)
             return -1;
-    }
 
-    obj->links.netdata_socket_release_task_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_socket_release_task_kprobe,
-                                                                               false,  EBPF_COMMON_FNCT_CLEAN_UP);
-    ret = libbpf_get_error(obj->links.netdata_socket_release_task_kprobe);
-    if (ret)
-        return -1;
+        obj->links.netdata_tcp_v4_connect_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_tcp_v4_connect_kprobe,
+                                                                              false,
+                                                                              socket_targets[NETDATA_FCNT_TCP_V4_CONNECT].name);
+        ret = libbpf_get_error(obj->links.netdata_tcp_v4_connect_kprobe);
+        if (ret)
+            return -1;
+
+        obj->links.netdata_tcp_v6_connect_kprobe = bpf_program__attach_kprobe(obj->progs.netdata_tcp_v6_connect_kprobe,
+                                                                              false,
+                                                                              socket_targets[NETDATA_FCNT_TCP_V6_CONNECT].name);
+        ret = libbpf_get_error(obj->links.netdata_tcp_v6_connect_kprobe);
+        if (ret)
+            return -1;
+    }
 
     return 0;
 }
@@ -381,11 +380,9 @@ static int ebpf_socket_attach_probes(struct socket_bpf *obj, netdata_run_mode_t
  */
 static void ebpf_socket_set_hash_tables(struct socket_bpf *obj)
 {
-    socket_maps[NETDATA_SOCKET_TABLE_BANDWIDTH].map_fd = bpf_map__fd(obj->maps.tbl_bandwidth);
     socket_maps[NETDATA_SOCKET_GLOBAL].map_fd = bpf_map__fd(obj->maps.tbl_global_sock);
     socket_maps[NETDATA_SOCKET_LPORTS].map_fd = bpf_map__fd(obj->maps.tbl_lports);
-    socket_maps[NETDATA_SOCKET_TABLE_IPV4].map_fd = bpf_map__fd(obj->maps.tbl_conn_ipv4);
-    socket_maps[NETDATA_SOCKET_TABLE_IPV6].map_fd = bpf_map__fd(obj->maps.tbl_conn_ipv6);
+    socket_maps[NETDATA_SOCKET_OPEN_SOCKET].map_fd = bpf_map__fd(obj->maps.tbl_nd_socket);
     socket_maps[NETDATA_SOCKET_TABLE_UDP].map_fd = bpf_map__fd(obj->maps.tbl_nv_udp);
     socket_maps[NETDATA_SOCKET_TABLE_CTRL].map_fd = bpf_map__fd(obj->maps.socket_ctrl);
 }
@@ -400,22 +397,13 @@ static void ebpf_socket_set_hash_tables(struct socket_bpf *obj)
  */
 static void ebpf_socket_adjust_map(struct socket_bpf *obj, ebpf_module_t *em)
 {
-    ebpf_update_map_size(obj->maps.tbl_bandwidth, &socket_maps[NETDATA_SOCKET_TABLE_BANDWIDTH],
-                         em, bpf_map__name(obj->maps.tbl_bandwidth));
-
-    ebpf_update_map_size(obj->maps.tbl_conn_ipv4, &socket_maps[NETDATA_SOCKET_TABLE_IPV4],
-                         em, bpf_map__name(obj->maps.tbl_conn_ipv4));
-
-    ebpf_update_map_size(obj->maps.tbl_conn_ipv6, &socket_maps[NETDATA_SOCKET_TABLE_IPV6],
-                         em, bpf_map__name(obj->maps.tbl_conn_ipv6));
+    ebpf_update_map_size(obj->maps.tbl_nd_socket, &socket_maps[NETDATA_SOCKET_OPEN_SOCKET],
+                         em, bpf_map__name(obj->maps.tbl_nd_socket));
 
     ebpf_update_map_size(obj->maps.tbl_nv_udp, &socket_maps[NETDATA_SOCKET_TABLE_UDP],
                          em, bpf_map__name(obj->maps.tbl_nv_udp));
 
-
-    ebpf_update_map_type(obj->maps.tbl_bandwidth, &socket_maps[NETDATA_SOCKET_TABLE_BANDWIDTH]);
-    ebpf_update_map_type(obj->maps.tbl_conn_ipv4, &socket_maps[NETDATA_SOCKET_TABLE_IPV4]);
-    ebpf_update_map_type(obj->maps.tbl_conn_ipv6, &socket_maps[NETDATA_SOCKET_TABLE_IPV6]);
+    ebpf_update_map_type(obj->maps.tbl_nd_socket, &socket_maps[NETDATA_SOCKET_OPEN_SOCKET]);
     ebpf_update_map_type(obj->maps.tbl_nv_udp, &socket_maps[NETDATA_SOCKET_TABLE_UDP]);
     ebpf_update_map_type(obj->maps.socket_ctrl, &socket_maps[NETDATA_SOCKET_TABLE_CTRL]);
     ebpf_update_map_type(obj->maps.tbl_global_sock, &socket_maps[NETDATA_SOCKET_GLOBAL]);
@@ -459,7 +447,7 @@ static inline int ebpf_socket_load_and_attach(struct socket_bpf *obj, ebpf_modul
     if (test == EBPF_LOAD_TRAMPOLINE) {
         ret = socket_bpf__attach(obj);
     } else {
-        ret = ebpf_socket_attach_probes(obj, em->mode);
+        ret = (int)ebpf_socket_attach_probes(obj, em->mode);
     }
 
     if (!ret) {
@@ -479,211 +467,392 @@ static inline int ebpf_socket_load_and_attach(struct socket_bpf *obj, ebpf_modul
  *****************************************************************/
 
 /**
- * Clean internal socket plot
+ * Socket Free
  *
- * Clean all structures allocated with strdupz.
+ * Cleanup variables after child threads to stop
  *
- * @param ptr the pointer with addresses to clean.
+ * @param ptr thread data.
  */
-static inline void clean_internal_socket_plot(netdata_socket_plot_t *ptr)
+static void ebpf_socket_free(ebpf_module_t *em )
 {
-    freez(ptr->dimension_recv);
-    freez(ptr->dimension_sent);
-    freez(ptr->resolved_name);
-    freez(ptr->dimension_retransmit);
+    pthread_mutex_lock(&ebpf_exit_cleanup);
+    em->enabled = NETDATA_THREAD_EBPF_STOPPED;
+    ebpf_update_stats(&plugin_statistics, em);
+    ebpf_update_kernel_memory_with_vector(&plugin_statistics, em->maps, EBPF_ACTION_STAT_REMOVE);
+    pthread_mutex_unlock(&ebpf_exit_cleanup);
 }
 
 /**
- * Clean socket plot
+ *  Obsolete Systemd Socket Charts
  *
- * Clean the allocated data for inbound and outbound vectors.
-static void clean_allocated_socket_plot()
-{
-    if (!network_viewer_opt.enabled)
-        return;
-
-    uint32_t i;
-    uint32_t end = inbound_vectors.last;
-    netdata_socket_plot_t *plot = inbound_vectors.plot;
-    for (i = 0; i < end; i++) {
-        clean_internal_socket_plot(&plot[i]);
-    }
-
-    clean_internal_socket_plot(&plot[inbound_vectors.last]);
-
-    end = outbound_vectors.last;
-    plot = outbound_vectors.plot;
-    for (i = 0; i < end; i++) {
-        clean_internal_socket_plot(&plot[i]);
-    }
-    clean_internal_socket_plot(&plot[outbound_vectors.last]);
-}
- */
-
-/**
- * Clean network ports allocated during initialization.
+ *  Obsolete charts when systemd is enabled
  *
- * @param ptr a pointer to the link list.
-static void clean_network_ports(ebpf_network_viewer_port_list_t *ptr)
+ *  @param update_every value to overwrite the update frequency set by the server.
+ **/
+static void ebpf_obsolete_systemd_socket_charts(int update_every)
 {
-    if (unlikely(!ptr))
-        return;
-
-    while (ptr) {
-        ebpf_network_viewer_port_list_t *next = ptr->next;
-        freez(ptr->value);
-        freez(ptr);
-        ptr = next;
-    }
+    int order = 20080;
+    ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              NETDATA_NET_APPS_CONNECTION_TCP_V4,
+                              "Calls to tcp_v4_connection",
+                              EBPF_COMMON_DIMENSION_CONNECTIONS,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NETDATA_SERVICES_SOCKET_TCP_V4_CONN_CONTEXT,
+                              order++,
+                              update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              NETDATA_NET_APPS_CONNECTION_TCP_V6,
+                              "Calls to tcp_v6_connection",
+                              EBPF_COMMON_DIMENSION_CONNECTIONS,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NETDATA_SERVICES_SOCKET_TCP_V6_CONN_CONTEXT,
+                              order++,
+                              update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_RECV,
+                              "Bytes received",
+                              EBPF_COMMON_DIMENSION_BITS,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NETDATA_SERVICES_SOCKET_BYTES_RECV_CONTEXT,
+                              order++,
+                              update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_SENT,
+                              "Bytes sent",
+                              EBPF_COMMON_DIMENSION_BITS,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NETDATA_SERVICES_SOCKET_BYTES_SEND_CONTEXT,
+                              order++,
+                              update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_TCP_RECV_CALLS,
+                              "Calls to tcp_cleanup_rbuf.",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NETDATA_SERVICES_SOCKET_TCP_RECV_CONTEXT,
+                              order++,
+                              update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_TCP_SEND_CALLS,
+                              "Calls to tcp_sendmsg.",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NETDATA_SERVICES_SOCKET_TCP_SEND_CONTEXT,
+                              order++,
+                              update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_TCP_RETRANSMIT,
+                              "Calls to tcp_retransmit",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NETDATA_SERVICES_SOCKET_TCP_RETRANSMIT_CONTEXT,
+                              order++,
+                              update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_UDP_SEND_CALLS,
+                              "Calls to udp_sendmsg",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NETDATA_SERVICES_SOCKET_UDP_SEND_CONTEXT,
+                              order++,
+                              update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_SERVICE_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_UDP_RECV_CALLS,
+                              "Calls to udp_recvmsg",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NETDATA_SERVICES_SOCKET_UDP_RECV_CONTEXT,
+                              order++,
+                              update_every);
 }
- */
 
+static void ebpf_obsolete_specific_socket_charts(char *type, int update_every);
 /**
- * Clean service names
+ * Obsolete cgroup chart
  *
- * Clean the allocated link list that stores names.
+ * Send obsolete for all charts created before to close.
  *
- * @param names the link list.
-static void clean_service_names(ebpf_network_viewer_dim_name_t *names)
-{
-    if (unlikely(!names))
-        return;
-
-    while (names) {
-        ebpf_network_viewer_dim_name_t *next = names->next;
-        freez(names->name);
-        freez(names);
-        names = next;
-    }
-}
+ * @param em a pointer to `struct ebpf_module`
  */
+static inline void ebpf_obsolete_socket_cgroup_charts(ebpf_module_t *em) {
+    pthread_mutex_lock(&mutex_cgroup_shm);
 
-/**
- * Clean hostnames
- *
- * @param hostnames the hostnames to clean
-static void clean_hostnames(ebpf_network_viewer_hostname_list_t *hostnames)
-{
-    if (unlikely(!hostnames))
-        return;
+    ebpf_obsolete_systemd_socket_charts(em->update_every);
+
+    ebpf_cgroup_target_t *ect;
+    for (ect = ebpf_cgroup_pids; ect ; ect = ect->next) {
+        if (ect->systemd)
+            continue;
 
-    while (hostnames) {
-        ebpf_network_viewer_hostname_list_t *next = hostnames->next;
-        freez(hostnames->value);
-        simple_pattern_free(hostnames->value_pattern);
-        freez(hostnames);
-        hostnames = next;
+        ebpf_obsolete_specific_socket_charts(ect->name, em->update_every);
     }
+    pthread_mutex_unlock(&mutex_cgroup_shm);
 }
- */
 
 /**
- * Clean port Structure
+ * Create apps charts
  *
- * Clean the allocated list.
+ * Call ebpf_create_chart to create the charts on apps submenu.
  *
- * @param clean the list that will be cleaned
+ * @param em   a pointer to the structure with the default values.
  */
-void clean_port_structure(ebpf_network_viewer_port_list_t **clean)
+void ebpf_socket_obsolete_apps_charts(struct ebpf_module *em)
 {
-    ebpf_network_viewer_port_list_t *move = *clean;
-    while (move) {
-        ebpf_network_viewer_port_list_t *next = move->next;
-        freez(move->value);
-        freez(move);
-
-        move = next;
-    }
-    *clean = NULL;
-}
-
-/**
- * Clean IP structure
- *
- * Clean the allocated list.
+    int order = 20080;
+    ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
+                              NETDATA_NET_APPS_CONNECTION_TCP_V4,
+                              "Calls to tcp_v4_connection",
+                              EBPF_COMMON_DIMENSION_CONNECTIONS,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
+                              NETDATA_NET_APPS_CONNECTION_TCP_V6,
+                              "Calls to tcp_v6_connection",
+                              EBPF_COMMON_DIMENSION_CONNECTIONS,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_SENT,
+                              "Bytes sent",
+                              EBPF_COMMON_DIMENSION_BITS,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_RECV,
+                               "bytes received",
+                              EBPF_COMMON_DIMENSION_BITS,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_TCP_SEND_CALLS,
+                              "Calls for tcp_sendmsg",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_TCP_RECV_CALLS,
+                              "Calls for tcp_cleanup_rbuf",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_TCP_RETRANSMIT,
+                              "Calls for tcp_retransmit",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_UDP_SEND_CALLS,
+                              "Calls for udp_sendmsg",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_APPS_FAMILY,
+                              NETDATA_NET_APPS_BANDWIDTH_UDP_RECV_CALLS,
+                              "Calls for udp_recvmsg",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_APPS_NET_GROUP,
+                              NETDATA_EBPF_CHART_TYPE_STACKED,
+                              NULL,
+                              order++,
+                              em->update_every);
+}
+
+/**
+ * Obsolete global charts
+ *
+ * Obsolete charts created.
  *
- * @param clean the list that will be cleaned
+ * @param em a pointer to the structure with the default values.
  */
-static void clean_ip_structure(ebpf_network_viewer_ip_list_t **clean)
+static void ebpf_socket_obsolete_global_charts(ebpf_module_t *em)
 {
-    ebpf_network_viewer_ip_list_t *move = *clean;
-    while (move) {
-        ebpf_network_viewer_ip_list_t *next = move->next;
-        freez(move->value);
-        freez(move);
+    int order = 21070;
+    ebpf_write_chart_obsolete(NETDATA_EBPF_IP_FAMILY,
+                              NETDATA_INBOUND_CONNECTIONS,
+                              "Inbound connections.",
+                              EBPF_COMMON_DIMENSION_CONNECTIONS,
+                              NETDATA_SOCKET_KERNEL_FUNCTIONS,
+                              NETDATA_EBPF_CHART_TYPE_LINE,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_EBPF_IP_FAMILY,
+                              NETDATA_TCP_OUTBOUND_CONNECTIONS,
+                              "TCP outbound connections.",
+                              EBPF_COMMON_DIMENSION_CONNECTIONS,
+                              NETDATA_SOCKET_KERNEL_FUNCTIONS,
+                              NETDATA_EBPF_CHART_TYPE_LINE,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+
+    ebpf_write_chart_obsolete(NETDATA_EBPF_IP_FAMILY,
+                              NETDATA_TCP_FUNCTION_COUNT,
+                              "Calls to internal functions",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_SOCKET_KERNEL_FUNCTIONS,
+                              NETDATA_EBPF_CHART_TYPE_LINE,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_EBPF_IP_FAMILY,
+                              NETDATA_TCP_FUNCTION_BITS,
+                              "TCP bandwidth",
+                              EBPF_COMMON_DIMENSION_BITS,
+                              NETDATA_SOCKET_KERNEL_FUNCTIONS,
+                              NETDATA_EBPF_CHART_TYPE_LINE,
+                              NULL,
+                              order++,
+                              em->update_every);
 
-        move = next;
+    if (em->mode < MODE_ENTRY) {
+        ebpf_write_chart_obsolete(NETDATA_EBPF_IP_FAMILY,
+                                  NETDATA_TCP_FUNCTION_ERROR,
+                                  "TCP errors",
+                                  EBPF_COMMON_DIMENSION_CALL,
+                                  NETDATA_SOCKET_KERNEL_FUNCTIONS,
+                                  NETDATA_EBPF_CHART_TYPE_LINE,
+                                  NULL,
+                                  order++,
+                                  em->update_every);
+    }
+
+    ebpf_write_chart_obsolete(NETDATA_EBPF_IP_FAMILY,
+                              NETDATA_TCP_RETRANSMIT,
+                              "Packages retransmitted",
+                              EBPF_COMMON_DIMENSION_CALL,
+                              NETDATA_SOCKET_KERNEL_FUNCTIONS,
+                              NETDATA_EBPF_CHART_TYPE_LINE,
+                              NULL,
+                              order++,
+                              em->update_every);
+
+    ebpf_write_chart_obsolete(NETDATA_EBPF_IP_FAMILY