Appendix B Constants
Wire-protocol constants — the framing, the ingestion limits, the query message ceiling — belong to the interfaces rather than to eventd and are in PSPU §3.A.
B.1 Access rights #
| Right | Bit | Value | Meaning |
|---|---|---|---|
EVENTD_READ | 0 | 0x0001 | Read records matching the pattern. |
EVENTD_CLEAR | 1 | 0x0002 | Delete records matching the pattern. Reserved; nothing uses it yet (§7.1). |
EVENTD_ADMINISTER | 2 | 0x0004 | Change eventd's own policy — the INDEX command. |
B.2 Generic mapping #
Passed to AccessCheck in the generic_read, generic_write,
generic_execute and generic_all fields.
| Generic right | Value | Composed of |
|---|---|---|
GENERIC_READ | 0x00020001 | EVENTD_READ | READ_CONTROL |
GENERIC_WRITE | 0x00020006 | EVENTD_CLEAR | EVENTD_ADMINISTER | READ_CONTROL |
GENERIC_EXECUTE | 0x00020001 | EVENTD_READ | READ_CONTROL |
GENERIC_ALL | 0x000F0007 | EVENTD_READ | EVENTD_CLEAR | EVENTD_ADMINISTER | DELETE | READ_CONTROL | WRITE_DAC | WRITE_OWNER |
EVENTD_ADMINISTER is in GENERIC_WRITE and deliberately not in
GENERIC_READ or GENERIC_EXECUTE (§7.1).
B.3 Field GUID namespace #
EVENTD_FIELD_NAMESPACE = {e7d3a1b0-5c2f-4e8a-9b1d-0a6f3c8e2d4b}
Field GUIDs are uuid_v5(EVENTD_FIELD_NAMESPACE, field_name) with
field_name as UTF-8 (§7.3).
B.4 Data type root GUIDs #
The level-0 node of an object type list.
| Data type | GUID |
|---|---|
| Events | {a1b2c3d4-0001-4000-8000-000000000001} |
| Logs | {a1b2c3d4-0001-4000-8000-000000000002} |
| Metrics | {a1b2c3d4-0001-4000-8000-000000000003} |
B.5 Field names #
Field GUIDs are computed from the algorithm, never hardcoded. The names they are computed from are these.
Event header fields. timestamp, cpu_id, sequence,
origin_class, event_type, effective_token_guid,
true_token_guid, process_guid, boot_id.
Log fields. timestamp, origin, is_error, message, job_id,
boot_id.
Fixed metric fields. timestamp, boot_id, name, type,
value.
Event payload fields use the flattened dot path (PSPU §3.22). Suppressed paths and paths colliding with a header name are not query-language fields and have no GUID.
Metric label keys use the key itself: core produces
uuid_v5(EVENTD_FIELD_NAMESPACE, "core"). A label key can never be one
of the five fixed metric field names, because ingestion rejects records
whose labels collide with them.
B.6 Origin class #
| Value | Origin |
|---|---|
| 0 | userspace |
| 1 | KMES |
| 2 | KACS |
| 3 | LCS |
The query language accepts these names as aliases (PSPU §3.23).
B.7 Synthetic event types #
| Type | Emitted when |
|---|---|
synthetic.startup | eventd starts and attaches to KMES. |
synthetic.shutdown | Graceful shutdown begins. |
synthetic.gap | A sequence gap is detected on a CPU. |
synthetic.config_change | A configuration value is applied at runtime. |
synthetic.storage_error | A write to any store fails. |
Payload schemas are in §3.2.
B.8 Metric types #
| Value | Type |
|---|---|
| 0 | counter |
| 1 | gauge |
| 2 | histogram |
Stored in series.type. The query language exposes the names, not the
numbers (PSPU §3.22).
B.9 Rollup functions #
| Value | Function |
|---|---|
| 0 | AVG |
| 1 | MIN |
| 2 | MAX |
| 3 | SUM |
| 4 | RATE |
| 5 | DELTA |
These name per-series rollup functions. Window aggregation keywords
have no identifiers of their own: AVG_OVER, MIN_OVER, MAX_OVER and
SUM_OVER map to AVG, MIN, MAX and SUM when no transform is present,
and RATE and DELTA rollups carry covered_ns for exact composition
(§5.6).
P50, P95 and P99 have no identifiers because percentiles are not composable and are never rolled up.
B.10 Log severity #
| Value | Meaning |
|---|---|
| 0 | Normal — standard output. |
| 1 | Error — standard error, or explicitly marked. |
Stored as an integer in logs.is_error; exposed as a boolean by the
query language, which accepts both forms (§4.2).
B.11 Series hashing #
FNV-1a, 64-bit, over the exact bytes of the canonical label string or the boundary blob.
| Parameter | Value |
|---|---|
| Offset basis | 0xcbf29ce484222325 |
| Prime | 0x100000001b3 |
| Stored as | hash & 0x7fff_ffff_ffff_ffff |
The high bit is cleared so the value fits SQLite's signed INTEGER.
Hashes narrow lookups; identity is always confirmed against the full
string or blob (§5.2).
B.12 Schema versions #
| Store | Version |
|---|---|
| Event shard | 1 |
| Log store | 1 |
| Metric store | 1 |
eventd-meta.db | 1 |
An unrecognised version is never migrated. For a required store it fails startup; for a historical shard it excludes the shard from the query path; for the metadata database it recreates from defaults (§3.3, §3.5).