diff --git a/includes/netdata_cache.h b/includes/netdata_cache.h
index 4c85eecd..80abf180 100644
--- a/includes/netdata_cache.h
+++ b/includes/netdata_cache.h
@@ -5,19 +5,20 @@
 
 typedef struct netdata_cachestat {
     __u64 ct;
+    __u32 tgid;
+    __u32 uid;
+    __u32 gid;
     char name[TASK_COMM_LEN];
 
-    __u64 add_to_page_cache_lru;
-    __u64 mark_page_accessed;
-    __u64 account_page_dirtied;
-    __u64 mark_buffer_dirty;
+    __s64 total;
+    __s64 misses;
+    __u64 dirty;
 } netdata_cachestat_t;
 
 enum cachestat_counters {
-    NETDATA_KEY_CALLS_ADD_TO_PAGE_CACHE_LRU,
-    NETDATA_KEY_CALLS_MARK_PAGE_ACCESSED,
-    NETDATA_KEY_CALLS_ACCOUNT_PAGE_DIRTIED,
-    NETDATA_KEY_CALLS_MARK_BUFFER_DIRTY,
+    NETDATA_KEY_TOTAL,
+    NETDATA_KEY_MISSES,
+    NETDATA_KEY_DIRTY,
 
     // Keep this as last and don't skip numbers as it is used as element counter
     NETDATA_CACHESTAT_END
diff --git a/includes/netdata_common.h b/includes/netdata_common.h
index 7e96dfbe..ea7ce507 100644
--- a/includes/netdata_common.h
+++ b/includes/netdata_common.h
@@ -21,7 +21,12 @@ static __always_inline void libnetdata_update_u64(__u64 *res, __u64 value)
     }
 }
 
-static __always_inline void libnetdata_update_global(void *tbl,__u32 key, __u64 value)
+static __always_inline void libnetdata_update_s64(__u64 *res, __s64 value)
+{
+    __sync_fetch_and_add(res, value);
+}
+
+static __always_inline void libnetdata_update_global(void *tbl, __u32 key, __u64 value)
 {
     __u64 *res;
     res = bpf_map_lookup_elem(tbl, &key);
@@ -31,6 +36,23 @@ static __always_inline void libnetdata_update_global(void *tbl,__u32 key, __u64
         bpf_map_update_elem(tbl, &key, &value, BPF_EXIST);
 }
 
+static __always_inline void libnetdata_update_sglobal(void *tbl, __u32 key, __s64 value)
+{
+    __s64 *res;
+    res = bpf_map_lookup_elem(tbl, &key);
+    if (res)
+        libnetdata_update_s64(res, value) ;
+    else
+        bpf_map_update_elem(tbl, &key, &value, BPF_EXIST);
+}
+
+static __always_inline void libnetdata_update_uid_gid(__u32 *uid, __u32 *gid)
+{
+    __u64 uid_gid = bpf_get_current_uid_gid();
+    *uid = (__u32)uid_gid;
+    *gid = (__u32)(uid_gid>>32);
+}
+
 /**
  * The motive we are using log2 to plot instead the raw value is well explained
  * inside this paper https://www.fsl.cs.stonybrook.edu/docs/osprof-osdi2006/osprof.pdf
@@ -150,27 +172,32 @@ static __always_inline __u32 netdata_get_parent_pid()
     return ppid;
 }
 
-static __always_inline __u32 netdata_get_current_pid()
+static __always_inline __u32 netdata_get_current_pid(__u32 *tgid)
 {
     __u32 pid;
     __u64 pid_tgid = bpf_get_current_pid_tgid();
-    pid = (__u32)(pid_tgid >> 32);
+    pid = (__u32)pid_tgid;
+    *tgid = (__u32)(pid_tgid>>32);
 
     return pid;
 }
 
-static __always_inline __u32 netdata_get_pid(void *ctrl_tbl)
+static __always_inline __u32 netdata_get_pid(void *ctrl_tbl, __u32 *tgid)
 {
     __u32 key = NETDATA_CONTROLLER_APPS_LEVEL;
 
     __u64 *level = bpf_map_lookup_elem(ctrl_tbl ,&key);
     if (level) {
-        if (*level == NETDATA_APPS_LEVEL_REAL_PARENT)
+        if (*level == NETDATA_APPS_LEVEL_REAL_PARENT) {
+            __u64 pid_tgid = bpf_get_current_pid_tgid();
+            *tgid = (__u32)(pid_tgid>>32);
             return netdata_get_real_parent_pid();
-        else if (*level == NETDATA_APPS_LEVEL_PARENT)
+        } else if (*level == NETDATA_APPS_LEVEL_PARENT) {
+            __u64 pid_tgid = bpf_get_current_pid_tgid();
+            *tgid = (__u32)(pid_tgid>>32);
             return netdata_get_parent_pid();
-        else if (*level == NETDATA_APPS_LEVEL_ALL)
-            return netdata_get_current_pid();
+        } else if (*level == NETDATA_APPS_LEVEL_ALL)
+            return netdata_get_current_pid(tgid);
         else if (*level == NETDATA_APPS_LEVEL_IGNORE) // Ignore PID
             return 0;
     }
@@ -178,9 +205,9 @@ static __always_inline __u32 netdata_get_pid(void *ctrl_tbl)
     return netdata_get_real_parent_pid();
 }
 
-static __always_inline void *netdata_get_pid_structure(__u32 *store_pid, void *ctrl_tbl, void *pid_tbl)
+static __always_inline void *netdata_get_pid_structure(__u32 *store_pid, __u32 *store_tgid, void *ctrl_tbl, void *pid_tbl)
 {
-    __u32 pid =  netdata_get_pid(ctrl_tbl);
+    __u32 pid =  netdata_get_pid(ctrl_tbl, store_tgid);
 
     *store_pid = pid;
 
diff --git a/includes/netdata_dc.h b/includes/netdata_dc.h
index ed7d56a4..8b64c687 100644
--- a/includes/netdata_dc.h
+++ b/includes/netdata_dc.h
@@ -5,9 +5,11 @@
 
 typedef struct netdata_dc_stat {
     __u64 ct;
+    __u32 tgid;
+    __u32 uid;
+    __u32 gid;
     char name[TASK_COMM_LEN];
 
-
     __u64 references;
     __u64 slow;
     __u64 missed;
diff --git a/includes/netdata_fd.h b/includes/netdata_fd.h
index 7d9b4dc2..366289ae 100644
--- a/includes/netdata_fd.h
+++ b/includes/netdata_fd.h
@@ -5,6 +5,9 @@
 
 struct netdata_fd_stat_t {
     __u64 ct;
+    __u32 tgid;
+    __u32 uid;
+    __u32 gid;
     char name[TASK_COMM_LEN];
 
     //Counter
diff --git a/includes/netdata_process.h b/includes/netdata_process.h
index ff02c0eb..d538a255 100644
--- a/includes/netdata_process.h
+++ b/includes/netdata_process.h
@@ -30,6 +30,8 @@ typedef struct netdata_sched_process_exec {
 
 struct netdata_pid_stat_t {
     __u64 ct;
+    __u32 uid;
+    __u32 gid;
     char name[TASK_COMM_LEN];
 
     __u32 tgid;                         //Task id
diff --git a/includes/netdata_shm.h b/includes/netdata_shm.h
index 7086aae2..b8514f33 100644
--- a/includes/netdata_shm.h
+++ b/includes/netdata_shm.h
@@ -5,6 +5,9 @@
 
 typedef struct netdata_shm {
     __u64 ct;
+    __u32 tgid;
+    __u32 uid;
+    __u32 gid;
     char name[TASK_COMM_LEN];
 
     __u32 get;
diff --git a/includes/netdata_swap.h b/includes/netdata_swap.h
index 30a01216..0876a511 100644
--- a/includes/netdata_swap.h
+++ b/includes/netdata_swap.h
@@ -5,6 +5,9 @@
 
 typedef struct netdata_swap_access {
     __u64 ct;
+    __u32 tgid;
+    __u32 uid;
+    __u32 gid;
     char name[TASK_COMM_LEN];
 
     __u64 read;
diff --git a/includes/netdata_vfs.h b/includes/netdata_vfs.h
index 59b95604..55a0e6f2 100644
--- a/includes/netdata_vfs.h
+++ b/includes/netdata_vfs.h
@@ -5,6 +5,9 @@
 
 struct netdata_vfs_stat_t {
     __u64 ct;
+    __u32 tgid;
+    __u32 uid;
+    __u32 gid;
     char name[TASK_COMM_LEN];
 
     //Counter
diff --git a/kernel/cachestat_kern.c b/kernel/cachestat_kern.c
index 51d5885d..58628f3c 100644
--- a/kernel/cachestat_kern.c
+++ b/kernel/cachestat_kern.c
@@ -74,24 +74,27 @@ SEC("kprobe/add_to_page_cache_lru")
 int netdata_add_to_page_cache_lru(struct pt_regs* ctx)
 {
     netdata_cachestat_t *fill, data = {};
-    libnetdata_update_global(&cstat_global, NETDATA_KEY_CALLS_ADD_TO_PAGE_CACHE_LRU, 1);
+    libnetdata_update_global(&cstat_global, NETDATA_KEY_MISSES, 1);
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&cstat_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &cstat_ctrl, &cstat_pid);
+    fill = netdata_get_pid_structure(&key, &tgid, &cstat_ctrl, &cstat_pid);
     if (fill) {
-        libnetdata_update_u64(&fill->add_to_page_cache_lru, 1);
+        libnetdata_update_s64(&fill->misses, 1);
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
         data.name[0] = '\0';
 #endif
 
-        data.add_to_page_cache_lru = 1;
+        data.misses = 1;
         bpf_map_update_elem(&cstat_pid, &key, &data, BPF_ANY);
 
         libnetdata_update_global(&cstat_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1);
@@ -104,24 +107,27 @@ SEC("kprobe/mark_page_accessed")
 int netdata_mark_page_accessed(struct pt_regs* ctx)
 {
     netdata_cachestat_t *fill, data = {};
-    libnetdata_update_global(&cstat_global, NETDATA_KEY_CALLS_MARK_PAGE_ACCESSED, 1);
+    libnetdata_update_global(&cstat_global, NETDATA_KEY_TOTAL, 1);
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&cstat_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &cstat_ctrl, &cstat_pid);
+    fill = netdata_get_pid_structure(&key, &tgid, &cstat_ctrl, &cstat_pid);
     if (fill) {
-        libnetdata_update_u64(&fill->mark_page_accessed, 1);
+        libnetdata_update_s64(&fill->total, 1);
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
         data.name[0] = '\0';
 #endif
 
-        data.mark_page_accessed = 1;
+        data.total = 1;
         bpf_map_update_elem(&cstat_pid, &key, &data, BPF_ANY);
 
         libnetdata_update_global(&cstat_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1);
@@ -153,24 +159,27 @@ int netdata_set_page_dirty(struct pt_regs* ctx)
 #endif
 
     netdata_cachestat_t *fill, data = {};
-    libnetdata_update_global(&cstat_global, NETDATA_KEY_CALLS_ACCOUNT_PAGE_DIRTIED, 1);
+    libnetdata_update_sglobal(&cstat_global, NETDATA_KEY_MISSES, -1);
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&cstat_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &cstat_ctrl, &cstat_pid);
+    fill = netdata_get_pid_structure(&key, &tgid, &cstat_ctrl, &cstat_pid);
     if (fill) {
-        libnetdata_update_u64(&fill->account_page_dirtied, 1);
+        libnetdata_update_s64(&fill->misses, -1);
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
         data.name[0] = '\0';
 #endif
 
-        data.account_page_dirtied = 1;
+        data.misses = -1;
         bpf_map_update_elem(&cstat_pid, &key, &data, BPF_ANY);
 
         libnetdata_update_global(&cstat_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1);
@@ -187,24 +196,27 @@ SEC("kprobe/account_page_dirtied")
 int netdata_account_page_dirtied(struct pt_regs* ctx)
 {
     netdata_cachestat_t *fill, data = {};
-    libnetdata_update_global(&cstat_global, NETDATA_KEY_CALLS_ACCOUNT_PAGE_DIRTIED, 1);
+    libnetdata_update_sglobal(&cstat_global, NETDATA_KEY_MISSES, -1);
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&cstat_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &cstat_ctrl, &cstat_pid);
+    fill = netdata_get_pid_structure(&key, &tgid, &cstat_ctrl, &cstat_pid);
     if (fill) {
-        libnetdata_update_u64(&fill->account_page_dirtied, 1);
+        libnetdata_update_s64(&fill->misses, -1);
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
         data.name[0] = '\0';
 #endif
 
-        data.account_page_dirtied = 1;
+        data.misses = -1;
         bpf_map_update_elem(&cstat_pid, &key, &data, BPF_ANY);
 
         libnetdata_update_global(&cstat_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1);
@@ -218,24 +230,30 @@ SEC("kprobe/mark_buffer_dirty")
 int netdata_mark_buffer_dirty(struct pt_regs* ctx)
 {
     netdata_cachestat_t *fill, data = {};
-    libnetdata_update_global(&cstat_global, NETDATA_KEY_CALLS_MARK_BUFFER_DIRTY, 1);
+    libnetdata_update_sglobal(&cstat_global, NETDATA_KEY_TOTAL, -1);
+    libnetdata_update_global(&cstat_global, NETDATA_KEY_DIRTY, 1);
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&cstat_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &cstat_ctrl, &cstat_pid);
+    fill = netdata_get_pid_structure(&key, &tgid, &cstat_ctrl, &cstat_pid);
     if (fill) {
-        libnetdata_update_u64(&fill->mark_buffer_dirty, 1);
+        libnetdata_update_u64(&fill->total, -1);
+        libnetdata_update_u64(&fill->dirty, 1);
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
         data.name[0] = '\0';
 #endif
 
-        data.mark_buffer_dirty = 1;
+        data.dirty = 1;
+        data.total = -1;
         bpf_map_update_elem(&cstat_pid, &key, &data, BPF_ANY);
 
         libnetdata_update_global(&cstat_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1);
diff --git a/kernel/dc_kern.c b/kernel/dc_kern.c
index c704c61a..e15cda88 100644
--- a/kernel/dc_kern.c
+++ b/kernel/dc_kern.c
@@ -79,14 +79,17 @@ int netdata_lookup_fast(struct pt_regs* ctx)
     libnetdata_update_global(&dcstat_global, NETDATA_KEY_DC_REFERENCE, 1);
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&dcstat_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &dcstat_ctrl, &dcstat_pid);
+    fill = netdata_get_pid_structure(&key, &tgid, &dcstat_ctrl, &dcstat_pid);
     if (fill) {
         libnetdata_update_u64(&fill->references, 1);
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
@@ -111,14 +114,17 @@ int netdata_d_lookup(struct pt_regs* ctx)
     int ret = PT_REGS_RC(ctx);
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&dcstat_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &dcstat_ctrl, &dcstat_pid);
+    fill = netdata_get_pid_structure(&key, &tgid, &dcstat_ctrl, &dcstat_pid);
     if (fill) {
         libnetdata_update_u64(&fill->slow, 1);
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
@@ -134,21 +140,9 @@ int netdata_d_lookup(struct pt_regs* ctx)
     // file not found
     if (ret == 0) {
         libnetdata_update_global(&dcstat_global, NETDATA_KEY_DC_MISS, 1);
-        fill = netdata_get_pid_structure(&key, &dcstat_ctrl, &dcstat_pid);
+        fill = netdata_get_pid_structure(&key, &tgid, &dcstat_ctrl, &dcstat_pid);
         if (fill) {
             libnetdata_update_u64(&fill->missed, 1);
-        } else {
-            data.ct = bpf_ktime_get_ns();
-#if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
-            bpf_get_current_comm(&data.name, TASK_COMM_LEN);
-#else
-            data.name[0] = '\0';
-#endif
-
-            data.missed = 1;
-            bpf_map_update_elem(&dcstat_pid, &key, &data, BPF_ANY);
-
-            libnetdata_update_global(&dcstat_ctrl, NETDATA_CONTROLLER_PID_TABLE_ADD, 1);
         }
     }
 
diff --git a/kernel/fd_kern.c b/kernel/fd_kern.c
index a504862c..a347110c 100644
--- a/kernel/fd_kern.c
+++ b/kernel/fd_kern.c
@@ -105,10 +105,11 @@ int netdata_sys_open(struct pt_regs* ctx)
 #endif
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&fd_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &fd_ctrl, &tbl_fd_pid);
+    fill = netdata_get_pid_structure(&key, &tgid, &fd_ctrl, &tbl_fd_pid);
     if (fill) {
         libnetdata_update_u32(&fill->open_call, 1) ;
 
@@ -119,6 +120,8 @@ int netdata_sys_open(struct pt_regs* ctx)
 #endif
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
@@ -181,10 +184,11 @@ int netdata_close(struct pt_regs* ctx)
 #endif
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&fd_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &fd_ctrl, &tbl_fd_pid);
+    fill = netdata_get_pid_structure(&key, &tgid, &fd_ctrl, &tbl_fd_pid);
     if (fill) {
         libnetdata_update_u32(&fill->close_call, 1) ;
 
@@ -195,6 +199,8 @@ int netdata_close(struct pt_regs* ctx)
 #endif
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
diff --git a/kernel/process_kern.c b/kernel/process_kern.c
index 517c97e4..560451bd 100644
--- a/kernel/process_kern.c
+++ b/kernel/process_kern.c
@@ -78,10 +78,11 @@ struct bpf_map_def SEC("maps") process_ctrl = {
 static inline void netdata_fill_common_process_data(struct netdata_pid_stat_t *data)
 {
     __u64 pid_tgid = bpf_get_current_pid_tgid();
-    __u32 tgid = (__u32)( 0x00000000FFFFFFFF & pid_tgid);
-    __u32 pid = (__u32) pid_tgid>>32;
+    __u32 tgid = (__u32)pid_tgid >>32;
+    __u32 pid = (__u32)pid_tgid;
 
     data->ct = bpf_ktime_get_ns();
+    libnetdata_update_uid_gid(&data->uid, &data->gid);
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
     bpf_get_current_comm(&data->name, TASK_COMM_LEN);
 #else
@@ -105,10 +106,11 @@ int netdata_tracepoint_sched_process_exit(struct netdata_sched_process_exit *ptr
 
     libnetdata_update_global(&tbl_total_stats, NETDATA_KEY_CALLS_DO_EXIT, 1);
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&process_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &process_ctrl, &tbl_pid_stats);
+    fill = netdata_get_pid_structure(&key, &tgid, &process_ctrl, &tbl_pid_stats);
     if (fill) {
         libnetdata_update_u32(&fill->exit_call, 1) ;
     }
@@ -123,10 +125,11 @@ int netdata_release_task(struct pt_regs* ctx)
 
     libnetdata_update_global(&tbl_total_stats, NETDATA_KEY_CALLS_RELEASE_TASK, 1);
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&process_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &process_ctrl, &tbl_pid_stats);
+    fill = netdata_get_pid_structure(&key, &tgid, &process_ctrl, &tbl_pid_stats);
     if (fill) {
         libnetdata_update_u32(&fill->release_call, 1) ;
 
@@ -145,10 +148,11 @@ int netdata_tracepoint_sched_process_exec(struct netdata_sched_process_exec *ptr
     libnetdata_update_global(&tbl_total_stats, NETDATA_KEY_CALLS_PROCESS, 1);
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&process_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &process_ctrl, &tbl_pid_stats);
+    fill = netdata_get_pid_structure(&key, &tgid, &process_ctrl, &tbl_pid_stats);
     if (fill) {
         fill->release_call = 0;
         libnetdata_update_u32(&fill->create_process, 1) ;
@@ -180,10 +184,11 @@ int netdata_tracepoint_sched_process_fork(struct netdata_sched_process_fork *ptr
     }
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&process_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &process_ctrl, &tbl_pid_stats);
+    fill = netdata_get_pid_structure(&key, &tgid, &process_ctrl, &tbl_pid_stats);
     if (fill) {
         fill->release_call = 0;
         libnetdata_update_u32(&fill->create_process, 1);
@@ -234,10 +239,11 @@ int netdata_fork(struct pt_regs* ctx)
 #endif
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&process_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &process_ctrl, &tbl_pid_stats);
+    fill = netdata_get_pid_structure(&key, &tgid, &process_ctrl, &tbl_pid_stats);
     if (fill) {
         fill->release_call = 0;
 
@@ -284,10 +290,11 @@ int netdata_sys_clone(struct pt_regs *ctx)
 #endif
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&process_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &process_ctrl, &tbl_pid_stats);
+    fill = netdata_get_pid_structure(&key, &tgid, &process_ctrl, &tbl_pid_stats);
     if (fill) {
         fill->release_call = 0;
 
diff --git a/kernel/shm_kern.c b/kernel/shm_kern.c
index 347503f0..7e684f5a 100644
--- a/kernel/shm_kern.c
+++ b/kernel/shm_kern.c
@@ -72,14 +72,17 @@ int netdata_syscall_shmget(struct pt_regs *ctx)
 
     // check if apps is enabled; if not, don't record apps data.
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&shm_ctrl))
         return 0;
 
-    netdata_shm_t *fill = netdata_get_pid_structure(&key, &shm_ctrl, &tbl_pid_shm);
+    netdata_shm_t *fill = netdata_get_pid_structure(&key, &tgid, &shm_ctrl, &tbl_pid_shm);
     if (fill) {
         libnetdata_update_u32(&fill->get, 1);
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
@@ -108,14 +111,17 @@ int netdata_syscall_shmat(struct pt_regs *ctx)
 
     // check if apps is enabled; if not, don't record apps data.
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&shm_ctrl))
         return 0;
 
-    netdata_shm_t *fill = netdata_get_pid_structure(&key, &shm_ctrl, &tbl_pid_shm);
+    netdata_shm_t *fill = netdata_get_pid_structure(&key, &tgid, &shm_ctrl, &tbl_pid_shm);
     if (fill) {
         libnetdata_update_u32(&fill->at, 1);
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
@@ -144,14 +150,17 @@ int netdata_syscall_shmdt(struct pt_regs *ctx)
 
     // check if apps is enabled; if not, don't record apps data.
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&shm_ctrl))
         return 0;
 
-    netdata_shm_t *fill = netdata_get_pid_structure(&key, &shm_ctrl, &tbl_pid_shm);
+    netdata_shm_t *fill = netdata_get_pid_structure(&key, &tgid, &shm_ctrl, &tbl_pid_shm);
     if (fill) {
         libnetdata_update_u32(&fill->dt, 1);
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
@@ -180,14 +189,17 @@ int netdata_syscall_shmctl(struct pt_regs *ctx)
 
     // check if apps is enabled; if not, don't record apps data.
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&shm_ctrl))
         return 0;
 
-    netdata_shm_t *fill = netdata_get_pid_structure(&key, &shm_ctrl, &tbl_pid_shm);
+    netdata_shm_t *fill = netdata_get_pid_structure(&key, &tgid, &shm_ctrl, &tbl_pid_shm);
     if (fill) {
         libnetdata_update_u32(&fill->ctl, 1);
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
diff --git a/kernel/socket_kern.c b/kernel/socket_kern.c
index 13a8ac21..3be5e3b4 100644
--- a/kernel/socket_kern.c
+++ b/kernel/socket_kern.c
@@ -155,7 +155,8 @@ static __always_inline __u16 set_idx_value(netdata_socket_idx_t *nsi, struct ine
         return AF_UNSPEC;
 
 
-    nsi->pid = netdata_get_pid(&socket_ctrl);
+    __u32 tgid = 0;
+    nsi->pid = netdata_get_pid(&socket_ctrl, &tgid);
 
     return family;
 }
@@ -331,8 +332,8 @@ int netdata_inet_csk_accept(struct pt_regs* ctx)
     bpf_probe_read(&idx.port, sizeof(u16), &sk->__sk_common.skc_num);
 
     __u64 pid_tgid = bpf_get_current_pid_tgid();
-    __u32 tgid = (__u32)(pid_tgid);
-    __u32 pid = (__u32)(pid_tgid >> 32);
+    __u32 tgid = (__u32)pid_tgid >>32;
+    __u32 pid = (__u32)pid_tgid;
 
     netdata_passive_connection_t *value = (netdata_passive_connection_t *)bpf_map_lookup_elem(&tbl_lports, &idx);
     if (value) {
diff --git a/kernel/swap_kern.c b/kernel/swap_kern.c
index 2500dbc6..5f6de99f 100644
--- a/kernel/swap_kern.c
+++ b/kernel/swap_kern.c
@@ -79,14 +79,17 @@ int netdata_swap_readpage(struct pt_regs* ctx)
     libnetdata_update_global(&tbl_swap, NETDATA_KEY_SWAP_READPAGE_CALL, 1);
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&swap_ctrl))
         return 0;
 
-    netdata_swap_access_t *fill = netdata_get_pid_structure(&key, &swap_ctrl, &tbl_pid_swap);
+    netdata_swap_access_t *fill = netdata_get_pid_structure(&key, &tgid, &swap_ctrl, &tbl_pid_swap);
     if (fill) {
         libnetdata_update_u64(&fill->read, 1);
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
@@ -110,14 +113,17 @@ int netdata_swap_writepage(struct pt_regs* ctx)
     libnetdata_update_global(&tbl_swap, NETDATA_KEY_SWAP_WRITEPAGE_CALL, 1);
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&swap_ctrl))
         return 0;
 
-    netdata_swap_access_t *fill = netdata_get_pid_structure(&key, &swap_ctrl, &tbl_pid_swap);
+    netdata_swap_access_t *fill = netdata_get_pid_structure(&key, &tgid, &swap_ctrl, &tbl_pid_swap);
     if (fill) {
         libnetdata_update_u64(&fill->write, 1);
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
diff --git a/kernel/vfs_kern.c b/kernel/vfs_kern.c
index eaacc09f..f9421514 100644
--- a/kernel/vfs_kern.c
+++ b/kernel/vfs_kern.c
@@ -89,6 +89,7 @@ int netdata_sys_write(struct pt_regs* ctx)
     __u64 tot;
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&vfs_ctrl))
         return 0;
 
@@ -103,7 +104,7 @@ int netdata_sys_write(struct pt_regs* ctx)
     tot = libnetdata_log2l(ret);
     libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_BYTES_VFS_WRITE, tot);
 
-    fill = netdata_get_pid_structure(&key, &vfs_ctrl, &tbl_vfs_pid);
+    fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid);
     if (fill) {
         libnetdata_update_u32(&fill->write_call, 1) ;
 
@@ -118,6 +119,8 @@ int netdata_sys_write(struct pt_regs* ctx)
 #endif
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
@@ -171,10 +174,11 @@ int netdata_sys_writev(struct pt_regs* ctx)
     libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_BYTES_VFS_WRITEV, tot);
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&vfs_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &vfs_ctrl, &tbl_vfs_pid);
+    fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid);
     if (fill) {
         libnetdata_update_u32(&fill->writev_call, 1) ;
 
@@ -189,6 +193,8 @@ int netdata_sys_writev(struct pt_regs* ctx)
 #endif
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
@@ -242,10 +248,11 @@ int netdata_sys_read(struct pt_regs* ctx)
     libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_BYTES_VFS_READ, tot);
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&vfs_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &vfs_ctrl, &tbl_vfs_pid);
+    fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid);
     if (fill) {
         libnetdata_update_u32(&fill->read_call, 1) ;
 
@@ -260,6 +267,8 @@ int netdata_sys_read(struct pt_regs* ctx)
 #endif
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
@@ -313,10 +322,11 @@ int netdata_sys_readv(struct pt_regs* ctx)
     libnetdata_update_global(&tbl_vfs_stats, NETDATA_KEY_BYTES_VFS_READV, tot);
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&vfs_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &vfs_ctrl, &tbl_vfs_pid);
+    fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid);
     if (fill) {
         libnetdata_update_u32(&fill->readv_call, 1) ;
 
@@ -332,6 +342,8 @@ int netdata_sys_readv(struct pt_regs* ctx)
 #endif
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
@@ -379,10 +391,11 @@ int netdata_sys_unlink(struct pt_regs* ctx)
 #endif
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&vfs_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &vfs_ctrl, &tbl_vfs_pid);
+    fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid);
     if (fill) {
         libnetdata_update_u32(&fill->unlink_call, 1) ;
 
@@ -393,6 +406,8 @@ int netdata_sys_unlink(struct pt_regs* ctx)
 #endif
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
@@ -440,10 +455,11 @@ int netdata_vfs_fsync(struct pt_regs* ctx)
 #endif
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&vfs_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &vfs_ctrl, &tbl_vfs_pid);
+    fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid);
     if (fill) {
         libnetdata_update_u32(&fill->fsync_call, 1) ;
 
@@ -454,6 +470,8 @@ int netdata_vfs_fsync(struct pt_regs* ctx)
 #endif
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
@@ -501,10 +519,11 @@ int netdata_vfs_open(struct pt_regs* ctx)
 #endif
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&vfs_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &vfs_ctrl, &tbl_vfs_pid);
+    fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid);
     if (fill) {
         libnetdata_update_u32(&fill->open_call, 1) ;
 
@@ -515,6 +534,8 @@ int netdata_vfs_open(struct pt_regs* ctx)
 #endif
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else
@@ -562,10 +583,11 @@ int netdata_vfs_create(struct pt_regs* ctx)
 #endif
 
     __u32 key = 0;
+    __u32 tgid = 0;
     if (!monitor_apps(&vfs_ctrl))
         return 0;
 
-    fill = netdata_get_pid_structure(&key, &vfs_ctrl, &tbl_vfs_pid);
+    fill = netdata_get_pid_structure(&key, &tgid, &vfs_ctrl, &tbl_vfs_pid);
     if (fill) {
         libnetdata_update_u32(&fill->create_call, 1) ;
 
@@ -576,6 +598,8 @@ int netdata_vfs_create(struct pt_regs* ctx)
 #endif
     } else {
         data.ct = bpf_ktime_get_ns();
+        libnetdata_update_uid_gid(&data.uid, &data.gid);
+        data.tgid = tgid;
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(4,11,0))
         bpf_get_current_comm(&data.name, TASK_COMM_LEN);
 #else