ebpf plugin installation failing

Problem/Question

I’ve Netdata running as container, on a Linux Machine. I was interested in installing ebpf metrics to monitor network stack for apps_group. I mounted ebpf.d.conf to /etc/netdata and also netdata.conf to /etc/netdata, since netdata.conf did not contain ebpf plugin by default when checked in localhost:19999/netdata.conf. How can I enable ebpf plugin to monitor metrics of apps_group?

Relevant docs you followed/actions you took to solve the issue

  1. Monitor, troubleshoot, and debug applications with eBPF metrics | Learn Netdata
  2. netdata/src/collectors/ebpf.plugin/README.md at master · netdata/netdata · GitHub

Environment/Browser/Agent’s version etc

netdata -W buildinfo:
Packaging:
Netdata Version ____________________________________________ : v1.47.4
Installation Type __________________________________________ : oci
Package Architecture _______________________________________ : aarch64
Package Distro _____________________________________________ : unknown
Configure Options __________________________________________ : dummy-configure-command
Default Directories:
User Configurations ________________________________________ : /etc/netdata
Stock Configurations _______________________________________ : /usr/lib/netdata/conf.d
Ephemeral Databases (metrics data, metadata) _______________ : /var/cache/netdata
Permanent Databases ________________________________________ : /var/lib/netdata
Plugins ____________________________________________________ : /usr/libexec/netdata/plugins.d
Static Web Files ___________________________________________ : /usr/share/netdata/web
Log Files __________________________________________________ : /var/log/netdata
Lock Files _________________________________________________ : /var/lib/netdata/lock
Home _______________________________________________________ : /var/lib/netdata
Operating System:
Kernel _____________________________________________________ : Linux
Kernel Version _____________________________________________ : 5.15.136-tegra
Operating System ___________________________________________ : Ubuntu
Operating System ID ________________________________________ : ubuntu
Operating System ID Like ___________________________________ : debian
Operating System Version ___________________________________ : 22.04.4 LTS (Jammy Jellyfish)
Operating System Version ID ________________________________ : 12
Detection __________________________________________________ : /host/etc/os-release
Hardware:
CPU Cores __________________________________________________ : 8
CPU Frequency ______________________________________________ : 1984000000
RAM Bytes __________________________________________________ : 16417783808
Disk Capacity ______________________________________________ : 256060514304
CPU Architecture ___________________________________________ : aarch64
Virtualization Technology __________________________________ : unknown
Virtualization Detection ___________________________________ : none
Container:
Container __________________________________________________ : lxc
Container Detection ________________________________________ : containerenv
Container Orchestrator _____________________________________ : none
Container Operating System _________________________________ : Debian GNU/Linux
Container Operating System ID ______________________________ : debian
Container Operating System ID Like _________________________ : unknown
Container Operating System Version _________________________ : 12 (bookworm)
Container Operating System Version ID ______________________ : 12
Container Operating System Detection _______________________ : /etc/os-release
Features:
Built For __________________________________________________ : Linux
Netdata Cloud ______________________________________________ : YES
Health (trigger alerts and send notifications) _____________ : YES
Streaming (stream metrics to parent Netdata servers) _______ : YES
Back-filling (of higher database tiers) ____________________ : YES
Replication (fill the gaps of parent Netdata servers) ______ : YES
Streaming and Replication Compression ______________________ : YES (zstd lz4 gzip)
Contexts (index all active and archived metrics) ___________ : YES
Tiering (multiple dbs with different metrics resolution) ___ : YES (5)
Machine Learning ___________________________________________ : YES
Database Engines:
dbengine (compression) _____________________________________ : YES (zstd lz4)
alloc ______________________________________________________ : YES
ram ________________________________________________________ : YES
none _______________________________________________________ : YES
Connectivity Capabilities:
ACLK (Agent-Cloud Link: MQTT over WebSockets over TLS) _____ : YES
static (Netdata internal web server) _______________________ : YES
h2o (web server) ___________________________________________ : YES
WebRTC (experimental) ______________________________________ : NO
Native HTTPS (TLS Support) _________________________________ : YES
TLS Host Verification ______________________________________ : YES
Libraries:
LZ4 (extremely fast lossless compression algorithm) ________ : YES
ZSTD (fast, lossless compression algorithm) ________________ : YES
zlib (lossless data-compression library) ___________________ : YES
Brotli (generic-purpose lossless compression algorithm) ____ : NO
protobuf (platform-neutral data serialization protocol) ____ : YES (system)
OpenSSL (cryptography) _____________________________________ : YES
libdatachannel (stand-alone WebRTC data channels) __________ : NO
JSON-C (lightweight JSON manipulation) _____________________ : YES
libcap (Linux capabilities system operations) ______________ : NO
libcrypto (cryptographic functions) ________________________ : YES
libyaml (library for parsing and emitting YAML) ____________ : YES
libmnl (library for working with netfilter) ________________ : YES
Plugins:
apps (monitor processes) ___________________________________ : YES
cgroups (monitor containers and VMs) _______________________ : YES
cgroup-network (associate interfaces to CGROUPS) ___________ : YES
proc (monitor Linux systems) _______________________________ : YES
tc (monitor Linux network QoS) _____________________________ : YES
diskspace (monitor Linux mount points) _____________________ : YES
freebsd (monitor FreeBSD systems) __________________________ : NO
macos (monitor MacOS systems) ______________________________ : NO
statsd (collect custom application metrics) ________________ : YES
timex (check system clock synchronization) _________________ : YES
idlejitter (check system latency and jitter) _______________ : YES
bash (support shell data collection jobs - charts.d) _______ : YES
debugfs (kernel debugging metrics) _________________________ : YES
cups (monitor printers and print jobs) _____________________ : NO
ebpf (monitor system calls) ________________________________ : NO
freeipmi (monitor enterprise server H/W) ___________________ : YES
nfacct (gather netfilter accounting) _______________________ : NO
perf (collect kernel performance events) ___________________ : YES
slabinfo (monitor kernel object caching) ___________________ : YES
Xen ________________________________________________________ : NO
Xen VBD Error Tracking _____________________________________ : NO
Exporters:
AWS Kinesis ________________________________________________ : NO
GCP PubSub _________________________________________________ : NO
MongoDB ____________________________________________________ : YES
Prometheus (OpenMetrics) Exporter __________________________ : YES
Prometheus Remote Write ____________________________________ : YES
Graphite ___________________________________________________ : YES
Graphite HTTP / HTTPS ______________________________________ : YES
JSON _______________________________________________________ : YES
JSON HTTP / HTTPS __________________________________________ : YES
OpenTSDB ___________________________________________________ : YES
OpenTSDB HTTP / HTTPS ______________________________________ : YES
All Metrics API ____________________________________________ : YES
Shell (use metrics in shell scripts) _______________________ : YES
Debug/Developer Features:
Trace All Netdata Allocations (with charts) ________________ : NO
Developer Mode (more runtime checks, slower) _______________ : NO

ebpf.d.conf file looks like:
[global]
ebpf load mode = entry
apps = yes
cgroups = no
update every = 5
pid table size = 32768
btf path = /sys/kernel/btf/
maps per core = yes
lifetime = 3
[ebpf programs]
cachestat = no
dcstat = no
disk = no
fd = no
filesystem = no
hardirq = no
mdflush = no
mount = no
oomkill = no
process = no
shm = no
socket = no
softirq = no
sync = no
swap = no
vfs = no
network connections = yes

netdata.conf looks like:
[plugins]
ebps = yes

Netdata version:
Netdata Agent:
v1.47.4

System Info:
Type:lxc
O/S version:Ubuntu, 22.04.4 LTS (Jammy Jellyfish)
Architecture:aarch64
Kernel:Linux, 5.15.136-tegra

What I expected to happen

  1. Plugins section contain ebpf when I visit localhost:19999/netdata.conf
    [plugins]
    ebpf = yes

  2. ebpf metrics charts appear under Applications (apps_group).

What I observed

  1. The [plugins] section in netdata.conf showed this:
    [plugins]
    option ‘ebpf’ is not used.
    ebpf = yes

  2. No ebpf metrics charts observed under Applications (apps_group) section.

Hello @meghnamscs ,

When I was developing the plugin, we had an internal discussion, and I was informed that running a plugin within a container requires specific configurations for the container environment. Additionally, at that time, the Alpine distribution did not enable the ebpf syscall by default, which could also impact functionality.

If you run the plugin directly on your host machine, it should work as expected. However, unless there have been updates or changes on the container side since then, it is still not feasible to run the plugin inside a container without making the necessary adjustments.

Please let me know if you need further clarification.

Best regards,

Thiago