Add guide: Monitor any process in real-time with Netdata (#10338)

* Init process guide

* Continue work on process guide

* Finish initial draft

* Tweak eBPF guide

* Fixes for Amy

2 files changed, 41 insertions, 39 deletions

diff --git a/collectors/apps.plugin/README.md b/collectors/apps.plugin/README.md
index ebe47fa8d6..5529226961 100644
--- a/collectors/apps.plugin/README.md
+++ b/collectors/apps.plugin/README.md
@@ -1,8 +1,7 @@
 <!--
----
 title: "apps.plugin"
+sidebar_label: "Application monitoring (apps.plugin)"
 custom_edit_url: https://github.com/netdata/netdata/edit/master/collectors/apps.plugin/README.md
----
 -->
 
 # apps.plugin
@@ -39,35 +38,35 @@ that fork/spawn other short lived processes hundreds of times per second.
 
 Each of these sections provides the same number of charts:
 
--   CPU Utilization
+-   CPU utilization (`apps.cpu`)
     -   Total CPU usage
-    -   User / System CPU usage
+    -   User/system CPU usage (`apps.cpu_user`/`apps.cpu_system`)
 -   Disk I/O
-    -   Physical Reads / Writes
-    -   Logical Reads / Writes
-    -   Open Unique Files (if a file is found open multiple times, it is counted just once)
+    -   Physical reads/writes (`apps.preads`/`apps.pwrites`)
+    -   Logical reads/writes (`apps.lreads`/`apps.lwrites`)
+    -   Open unique files (if a file is found open multiple times, it is counted just once, `apps.files`)
 -   Memory
-    -   Real Memory Used (non shared)
-    -   Virtual Memory Allocated
-    -   Minor Page Faults (i.e. memory activity)
+    -   Real Memory Used (non-shared, `apps.mem`)
+    -   Virtual Memory Allocated (`apps.vmem`)
+    -   Minor page faults (i.e. memory activity, `apps.minor_faults`)
 -   Processes
-    -   Threads Running
-    -   Processes Running
-    -   Pipes Open
-    -   Carried Over Uptime (since the Netdata restart)
-    -   Minimum Uptime
-    -   Average Uptime
-    -   Maximum Uptime
-
--   Swap Memory
-    -   Swap Memory Used
-    -   Major Page Faults (i.e. swap activity)
+    -   Threads running (`apps.threads`)
+    -   Processes running (`apps.processes`)
+    -   Carried over uptime (since the last Netdata Agent restart, `apps.uptime`)
+    -   Minimum uptime (`apps.uptime_min`)
+    -   Average uptime (`apps.uptime_average`)
+    -   Maximum uptime (`apps.uptime_max`)
+    -   Pipes open (`apps.pipes`)
+-   Swap memory
+    -   Swap memory used (`apps.swap`)
+    -   Major page faults (i.e. swap activiy, `apps.major_faults`)
 -   Network
-    -   Sockets Open
-    
-In addition, if the [eBPF collector](/collectors/ebpf.plugin/README.md) is running, your dashboard will also show
-an additional [list](/collectors/ebpf.plugin/README.md#integration-with-appsplugin) of charts using low-level Linux metrics.    
+    -   Sockets open (`apps.sockets`)
     
+In addition, if the [eBPF collector](/collectors/ebpf.plugin/README.md) is running, your dashboard will also show an
+additional [list of charts](/collectors/ebpf.plugin/README.md#integration-with-appsplugin) using low-level Linux
+metrics.
+
 The above are reported:
 
 -   For **Applications** per target configured.
diff --git a/collectors/ebpf.plugin/README.md b/collectors/ebpf.plugin/README.md
index 0e8ceada43..0179397c7a 100644
--- a/collectors/ebpf.plugin/README.md
+++ b/collectors/ebpf.plugin/README.md
@@ -156,24 +156,27 @@ The eBPF collector also creates charts for each running application through an i
 interact with the Linux kernel.
 
 When the integration is enabled, your dashboard will also show the following charts using low-level Linux metrics:
-    
--   eBPF syscall    
-    -   Number of calls to open files.
-    -   Number of files closed.
-    -   Number of calls to delete files.
-    -   Number of calls to `vfs_write`.
-    -   Number of calls to `vfs_read`.
-    -   Number of bytes written trough `vfs_write`
-    -   Number of bytes read trough `vfs_read`
-    -   Number of process created trough `do_fork`
-    -   Number of threads created trough `do_fork` or `__x86_64_sys_clone`, depending on your system's kernel version.
-    -   Number of times that a process called `do_exit`. 
+
+-   eBPF file
+    -   Number of calls to open files. (`apps.file_open`)
+    -   Number of files closed. (`apps.file_closed`)
     -   Number of calls to open files that returned errors.
     -   Number of calls to close files that returned errors.
+-   eBPF syscall
+    -   Number of calls to delete files. (`apps.file_deleted`)
+    -   Number of calls to `vfs_write`. (`apps.vfs_write_call`)
+    -   Number of calls to `vfs_read`. (`apps.vfs_read_call`)
+    -   Number of bytes written with `vfs_write`. (`apps.vfs_write_bytes`)
+    -   Number of bytes read with `vfs_read`. (`apps.vfs_read_bytes`)
+    -   Number of calls to write a file that returned errors.
     -   Number of calls to read a file that returned errors.
-    -   Number of calls to read a file that returned errors.
+-   eBPF process
+    -   Number of process created with `do_fork`. (`apps.process_create`)
+    -   Number of threads created with `do_fork` or `__x86_64_sys_clone`, depending on your system's kernel version. (`apps.thread_create`)
+    -   Number of times that a process called `do_exit`. (`apps.task_close`)
 -   eBPF net
-    -   Number of bytes transmited per seconds.   
+    -   Number of bytes sent. (`apps.bandwidth_sent`)
+    -   Number of bytes received. (`apps.bandwidth_recv`)
 
 If you want to _disable_ the integration with `apps.plugin` along with the above charts, change the setting `apps` to
 `no`.