Appendix B Constants
Wire-protocol constants — framing, ingestion limits, the query request ceiling and response target — belong to the interfaces rather than to eventd and are in PSPU §3.A.
B.1 Access rights #
| Right | Bit | Value | Meaning |
|---|---|---|---|
EVENTD_READ | 0 | 0x0001 | Read records matching the pattern. |
EVENTD_CLEAR | 1 | 0x0002 | Delete records matching the pattern. Reserved; nothing uses it yet (§7.1). |
EVENTD_ADMINISTER | 2 | 0x0004 | Change eventd's own policy — the INDEX command. |
EVENTD_PUBLISH | 3 | 0x0008 | Publish metric records under the matching name. |
B.2 Generic mapping #
Passed to AccessCheck in the generic_read, generic_write,
generic_execute and generic_all fields.
EVENTD_ADMINISTER and EVENTD_PUBLISH are in GENERIC_WRITE and
deliberately not in GENERIC_READ or GENERIC_EXECUTE (§7.1, §7.6).
B.3 Field GUID namespace #
EVENTD_FIELD_NAMESPACE = {e7d3a1b0-5c2f-4e8a-9b1d-0a6f3c8e2d4b}
Field GUIDs are uuid_v5(EVENTD_FIELD_NAMESPACE, field_name) with
field_name as UTF-8 (§7.3).
B.4 Data type root GUIDs #
The level-0 node of an object type list.
| Data type | GUID |
|---|---|
| Events | {a1b2c3d4-0001-4000-8000-000000000001} |
| Logs | {a1b2c3d4-0001-4000-8000-000000000002} |
| Metrics | {a1b2c3d4-0001-4000-8000-000000000003} |
B.5 Field names #
Field GUIDs are computed from the algorithm, never hardcoded. The names they are computed from are these.
Event header fields. event.time, event.cpu, event.sequence,
emitter.class, event.type, emitter.token.guid,
emitter.true-token.guid, emitter.process.guid, event.boot.guid,
the paths of PSPU §3.22. The events table's column names are not field
names (§3.1).
Log fields. timestamp, origin, is_error, message, job_id,
boot_id.
Fixed metric fields. timestamp, boot_id, name, type,
value.
Event payload fields use the flattened dot path (PSPU §3.22). Suppressed paths, and payload paths at or beneath a header field's path, are not query-language fields and have no GUID.
Metric label keys use the key itself: core produces
uuid_v5(EVENTD_FIELD_NAMESPACE, "core").
A label key
can never be one of the five fixed metric field names, because ingestion
rejects records whose labels collide with them.
B.6 Origin class #
The origin class is the header field emitter.class, held in the
origin_class column, and the query language accepts the names of
classes 0 to 3 as aliases for their values (PSPU §3.23 names no alias
for NTFE).
B.7 Synthetic event types #
All five are tier essential. These five names, and no others, are
reserved: a KMES event of one of these types is not stored (§3.1).
Payload schemas are in §3.2.
B.8 Metric types #
Stored in series.type.
The query language exposes the names, not the numbers (PSPU §3.22).
B.9 Log severity #
Stored as an integer in logs.is_error; exposed as a boolean by the
query language, which accepts both forms (§4.2).
B.10 Series hashing #
FNV-1a, 64-bit, over the exact bytes of the canonical label string or the boundary blob.
| Parameter | Value |
|---|---|
| Offset basis | 0xcbf29ce484222325 |
| Prime | 0x100000001b3 |
| Stored as | hash & 0x7fff_ffff_ffff_ffff |
The high bit is cleared so the value fits SQLite's signed INTEGER.
Hashes narrow lookups; identity is always confirmed against the full
string or blob (§5.2).
B.11 Schema versions #
An unrecognised version is never migrated. For a required store it fails startup; for a historical shard it excludes the shard from the query path; for the metadata database it recreates from defaults (§3.3, §3.5).