3.2 Synthetic Event Payloads
Each of the five synthetic event types (§2.6) carries a MessagePack map
in payload, with the schema below.
The fields
are catalogue fields, defined in eventd's fragment
/usr/share/evman/eventd.evman or in the kernel's (PGSS §6.10), and each
is stored as nested maps, one per segment of its path: store.shard-count
is the value at {store: {shard-count: …}}. A query names a field by its
dotted path, and reads an array field whole.
No field is ever nil. A field with no value is left out of the map (PGSS §6.5), and the table below says when each one can be.
None of them is at a header field's path, so none is suppressed. The
boot and the CPU are read from the columns as event.boot.guid and
event.cpu (§3.1), and no payload repeats the boot.
3.2.1 eventd.daemon.started #
There is no boot ID in the payload: the record's own event.boot.guid
is the boot it describes.
store.restarted is the boot-boundary decision of §3.7 recorded as
data, which makes "did eventd crash during this boot, and how often"
answerable by query rather than by inference from gaps.
3.2.2 eventd.daemon.stopped #
When eventd cannot read its committed receipts at shutdown, both arrays are left out and the payload is an empty map. It never writes zeroes in their place, so a 0 is always a real value.
Diagnostic only. Startup derives recovery coverage from committed receipt ranges, never from this payload (§2.2).
3.2.3 eventd.events.lost #
The time of the event that revealed the gap is not a payload field: it
is the record's own event.time (§2.5).
The CPU appears both here, as buffer.cpu, and in the cpu_id column
(§2.5).
The
column is what a WHERE event.cpu == N predicate matches and what a
query presents as event.cpu; the payload field is what
WHERE buffer.cpu == N matches, and what a reader of the stored payload
sees without joining anything.
3.2.4 eventd.config.changed #
Every value eventd reloads at runtime is a REG_DWORD or a REG_QWORD
(§A), so both values are integers, and a query can compare them as
numbers.
A side is absent when no value is stored, even though eventd's compiled default then applies. A stored value of the wrong type is reported as the type eventd expects, holding the integer it actually uses.
3.2.5 eventd.store.quarantined #
outcome.detail is diagnostic text and its wording is not stable.
store.kind and store.shard are the fields worth alerting on. The
metadata database is never reported here: a damaged one is rebuilt
(§3.5) and writes no record.