6.2 Terminology

3 min read

Event type. The dotted name an event is written under, in the form of §6.3. kacs.audit.access.checked is an event type.

Segment. One dot-separated part of an event type or of a field path.

Root. The leading segments of an event type that name its owner: a platform root, or a package name (§6.3).

Platform root. A short root reserved for one platform component, listed in §6.A.

Field. One value in an event, named by its path. A field is either in the payload or, for the header fields of §6.4, in the record header.

Path. The dotted name of a field. In a payload, each segment is a map key and the path is the chain of maps leading to the value (§6.4).

Role. The leading segment of a path that names a participant in the event: subject, object, source, destination or emitter (§6.4).

Participant. A party to an event that a role names: who acted, what was acted on, where something came from or went to, and who wrote the record.

Domain. The leading segment of a path that is not a role. A domain names a property of the event itself, such as outcome, or a thing the event happened within, such as a ring buffer (§6.4).

Thing. The segment after a role that says what kind of participant it is: token, process, file, key.

Variant. A field that is another reading of a value with its own field: the value before a change, the value asked for, the value expected. A variant is named by a qualifier (§6.4).

Fragment. A file describing events and fields, in the form of §6.10. The catalogue is every fragment installed on a system.

Tier. How much an event matters to an operator, declared per event type: essential, standard, verbose or debug (§6.8).

Essential. The tier of an event that is never switched off (§6.8).

Emission policy. The registry tree that switches event types on and off (§6.9).

Gating. What decides whether one occurrence of an enabled event type is recorded, where something other than the emission policy decides it: a SACL, a token's audit policy. Declared per event type in its fragment.

Asserted field. A field whose value, on a kernel-originated record, may have been supplied by userspace rather than observed by the kernel (§6.7).

Terms defined in PSPK §2 — event, header, payload, origin class, sequence — are used here with the same meaning and are not redefined, and nor are those of PCDS (SID, GUID, LUID, security descriptor, SACL, ACE), those of the registry (key, value, REG_DWORD, Machine\), which are the Peios Kernel TRM's, or package name, which is PSPU §5.3's. MessagePack is the format of the MessagePack specification, version 2.0.

6.2.1 Notation #

6.2.1.1 Field types #

A field's type is written storage.semantic: how the value is stored on the wire, then what it means. bin.sid is a binary SID, uint.time a point in time carried as an unsigned integer. One name carries both, so a reader knows the wire form and the rendering without a lookup. A type followed by [] is an array of that type. The types are listed in §6.5.

6.2.1.2 Pseudocode #

The pseudocode in §6.9 uses the corpus conventions of the Conventions book §2.3, and in addition:

Edit this page