2.5

Table Of Contents
VMware, Inc. 83
Appendix: Database Schema and Audit Event Log Data
Ifimmutabledataisstoredpermanentlyelsewhereinthedatabase,itisnotduplicated
inthelogentry.Forexample,whenanewpolicyispublished,thecompletepolicytext
isnotincludedinthelogentry.Instead,itsversionnumberisreferenced,sothatthe
completedataoftheevent
canbereconstructedfromPolicyDb_RuntimePolicyand
PolicyDb_Accesstablesifnecessary.
TheeventtypecodeisassociatedwithalookuptablePolicyDb_EventType,which
containsatextmessagetemplateforeachtypeofevent,category,andloglevelofthe
event.Themessagecancontain%sparameterplaceholders,inwhichcase
theMessage
Parametersfieldinthelogentrycontainsatabdelimitedlistofvaluesforthese
parameters.Forexample,aninstanceadministrationeventwithtype=4110hasthe
followingmessage:
4110 -> "Instance Set Guest Info requested, IP address = %s, MAC
address %s, configuration message \"%s\", machine name \"%s\",
configuration status %s"
Inthisexample,theMessageParametersfieldshows:
10.17.0.3 00:0C:29:1A:2B:3C OK ACETest 0
Theresultingparametersreplacethe%splaceholdersinthemessage
template.
ACEManagementServereventloggingcontainsanexperimentaltamperevidence
feature.Everyrecordintheeventlog(exceptthefirstone)musthaveauniquereference
tothepreviousevent,furtherenforcedbythedatabaseforeignkeyandunique
constraint.EachsuccessiverecordhasauniqueIDincrementedby1,
somissingrecords
areimmediatelyevident.Ifauserwithdirectaccesstothedatabasechanges,adds,or
removessomerecords,theusermustchangeeitherthepreviousev entpointerorother
dataintheremainingeventrecords.Datawithineveryrecordishashedtogetherwith
aserverkeyandis
storedintheeventSignaturefield.
Formoreinformationabouteventcategories,configuringlevelsofeventloggingfor
eachcategory,andpurgingoldeventstokeepthetablesizeincheck,see“Logging
Events”onpage 49.
N
OTEACEManagementServerdoesnotlogsensitivedatalikepasswordsor
encryptionkeys.