Appendix A Configuration Keys

7 min read

Every key lives under Machine\System\eventd\. eventd ignores unknown keys in the subtree. An invalid value is ignored and the value already in use is retained, and eventd emits an eventd.config.changed event for every change actually applied (§8.3).

A.1 Required #

No compiled-in defaults. A missing or invalid value fails startup (§8.2).

KeyTypeDescription
EventStorePathREG_SZProvisioned directory for event shards and eventd-meta.db; standard deployment /var/state/eventd/events/.
LogStorePathREG_SZProvisioned directory for logs.db; standard deployment /var/state/eventd/logs/.
MetricStorePathREG_SZProvisioned directory for metrics.db; standard deployment /var/state/eventd/metrics/.
QuerySocketPathREG_SZUnix socket path for queries.
LogSocketPathREG_SZUnix socket path for log ingestion.
MetricSocketPathREG_SZUnix socket path for metric ingestion.

A.2 SQLite storage #

KeyTypeDefaultRangeDescription
WalCheckpointPagesREG_DWORD1000100–100000WAL page threshold triggering a passive checkpoint, on shard, log, metric and metadata databases alike.

A.3 Event ingestion #

KeyTypeDefaultRangeDescription
StorageShardsREG_DWORD00–256Number of event shards. 0 means the successfully attached KMES-buffer count. Each shard costs at least three file descriptors, plus about two for every running query that reads every shard; a high count needs eventd's LimitNOFILE raised (§2.3).
MaxBatchSizeREG_DWORD10000100–100000Maximum events per writer transaction.
MaxBatchLatencyMsREG_DWORD10010–5000Maximum ms before an event batch commits.

A.4 Log ingestion #

KeyTypeDefaultRangeDescription
LogMaxBatchSizeREG_DWORD5000100–100000Maximum log records per transaction.
LogMaxBatchLatencyMsREG_DWORD50010–5000Maximum ms before a log batch commits.
MaxLogDatagramBytesREG_DWORD262144262144–1048576Maximum accepted log datagram size; the PSPU portable floor cannot be lowered.

A.5 Metric ingestion #

KeyTypeDefaultRangeDescription
MetricMaxBatchSizeREG_DWORD5000100–100000Maximum metric samples per transaction.
MetricMaxBatchLatencyMsREG_DWORD100010–5000Maximum ms before a metric batch commits.
MaxMetricDatagramBytesREG_DWORD262144262144–1048576Maximum accepted metric datagram size; the PSPU portable floor cannot be lowered.
MetricSeriesCacheSizeREG_DWORD500001000–1000000Entries in the LRU series resolution cache.
MetricAuthorizationCacheSizeREG_DWORD16384256–1000000Cached KACS publication verdicts, invalidated by security-policy generation.
HealthMetricIntervalSecondsREG_DWORD150–3600How often eventd records its own health as eventd.* metrics; 0 turns them off (§5.7).

A.6 Adaptive indexing #

KeyTypeDefaultRangeDescription
AdaptiveIndexWindowHoursREG_DWORD241–168Rolling window over which query frequency is measured.
AdaptiveIndexPolicyIntervalMinutesREG_DWORD6060–1440How often the desired index set is recomputed. The minimum of 60 prevents index churn.
AdaptiveIndexCreateThresholdREG_DWORD10010–10000Queries on a field within the window needed to add it.
AdaptiveIndexDropThresholdREG_DWORD101–1000Queries below which it is removed. Less than the create threshold, which is what supplies the hysteresis.

A.7 Index shedding #

KeyTypeDefaultRangeDescription
SheddingWindowSecondsREG_DWORD3010–300Sliding window for graduated shedding.
SheddingBatchPercentREG_DWORD7550–100Percentage of batches in the window exceeding 75% of MaxBatchSize that triggers graduated shedding.
EmergencySheddingBufferPercentREG_DWORD7550–95Ring buffer fill percentage triggering emergency shedding.

A.8 Retention #

KeyTypeDefaultRangeDescription
EventRetentionDaysREG_DWORD301–3650Maximum age of events.
EventRetentionMaxBytesREG_QWORD00–2^64−1Maximum total logical live size of the event shards. 0 means no limit.
LogRetentionDaysREG_DWORD141–3650Maximum age of log entries.
LogRetentionMaxBytesREG_QWORD00–2^64−1Maximum logical live size of the log store. 0 means no limit.
MetricRetentionDaysREG_DWORD901–3650Maximum age of metric samples.
MetricRetentionMaxBytesREG_QWORD1073741824 (1 GiB)0–2^64−1Maximum logical live size of the metric store. 0 explicitly disables the limit.
RetentionCheckIntervalMinutesREG_DWORD601–1440How often the retention coordinator runs.
RetentionDeleteBatchRowsREG_DWORD10000100–100000Maximum rows deleted in one retention transaction.

A.9 Querying #

KeyTypeDefaultRangeDescription
QueryTimeoutMsREG_DWORD300001000–300000Maximum query execution time.
MaxConcurrentQueriesREG_DWORD1281–4096Concurrent queries globally, streaming and non-streaming.
MaxStreamingQueriesREG_DWORD641–1024Concurrent streaming queries globally.
MaxQueriesPerUserREG_DWORD161–4096Concurrent queries, streaming or not, held by one caller's user SID; SYSTEM's are not counted (§6.5).
MaxDistinctStreamValuesREG_DWORD1000001000–10000000Values tracked by one DISTINCT streaming query.
MaxQueryRequestBytesREG_DWORD655361024–16777216Hard maximum query request payload.
QueryResponseTargetBytesREG_DWORD655361024–16777216Soft response batching target; one complete record may exceed it (§6).
MaxQueryHeldBytesREG_DWORD268435456 (256 MiB)16777216–4294967295What every running query together may hold to answer: sorted rows, aggregation groups and watch batches. A query in the default order holds nothing against it (§6.5).

A.10 Adaptive metric rollups #

KeyTypeDefaultRangeDescription
AdaptiveRollupMinSamplesREG_DWORD1000100–1000000Minimum raw inputs an eligible window query must scan before it may seed rollups.
AdaptiveRollupBatchRowsREG_DWORD51216–4096Maximum missing windows submitted in one bounded writer command.
AdaptiveRollupMaxRowsREG_DWORD1000000–10000000Global rollup-cache row cap. 0 disables cache reads and writes without changing results.

A.11 Cross-type filtering #

KeyTypeDefaultRangeDescription
CrossTypeWindowMsREG_DWORD150001000–300000Centred window for cross-type event and log existence checks.
CrossTypeMaxLookbackSecondsREG_DWORD6048003600–2592000Maximum range a cross-type filter may scan.

A.12 The security subtree #

Read-path descriptors live under Machine\System\eventd\Security\ and are not configuration in the sense above (§7.2):

Machine\System\eventd\Security\Events\*
Machine\System\eventd\Security\Events\<pattern>
Machine\System\eventd\Security\Logs\*
Machine\System\eventd\Security\Logs\<pattern>
Machine\System\eventd\Security\Metrics\*
Machine\System\eventd\Security\Metrics\<pattern>
Machine\System\eventd\Security\Admin

Security\Admin governs EVENTD_ADMINISTER, especially INDEX, and defaults to SYSTEM and Administrators. It is registry-protected policy, not data in eventd-meta.db (§3.5, §7.2).

A.13 When a change takes effect #

ChangeEffect
Every tuning parameter aboveApplied immediately.
Socket pathsRestart.
Store pathsRestart.
StorageShardsRestart.
Security descriptorsNext query; the registry watch invalidates the cache.

Edit this page