8.15 peinit.job.started

  • Event type: peinit.job.started
  • Defined in: peinit.evman
  • Tier: standard
  • Gating: none — every job whose process starts is recorded
  • Cardinality: one record per occurrence

A job's process exists and has been executed: the moment a process is running as object.job.token.sid on peinit's behalf.

Formerly job.started.

8.15.1 Fields #

FieldTypePresenceMeaning
object.job.guidbin.guidrequiredThe job the event is about.
object.job.typestr.enumrequiredWhat the job is for.
object.job.statestr.enumrequiredAlways running.
object.service.namestrwhen object.job.type != submittedThe name of the service the event is about, as its definition names it.
object.job.activation-generationuintwhen object.job.type != submittedThe activation generation of the service the job belongs to, at the time the job was created.
object.operation.guidbin.guidoptionalThe peinit operation the event is about: a start, stop, restart, reload or reset of one service, from the moment it is requested to the moment it ends.
object.process.piduintrequiredThe job's process.
object.cgroup.pathstr.pathrequiredThe cgroup the job's process runs in.
object.job.token.sidbin.sidrequiredThe user SID of the token the job's process runs as.
object.job.token.groupsbin.sid[]requiredThe group SIDs of the token the job's process runs as, in the token's order.
object.job.token.privilegesuint.flagsrequiredThe privileges present on the token the job's process runs as, as the flags of the 64-bit privilege word of uapi/pkm/token.h, one KACS_SE_*_PRIVILEGE bit each.
object.job.token.privileges-enableduint.flagsrequiredWhich of the privileges in object.job.token.privileges are enabled, as flags in the same 64-bit word.

Every record also carries the header fields of the envelope, which no payload repeats.

Generated from peinit.evman by pkm/tools/gen-events-book.py. Edit the fragment, not this page.

Edit this page