2.7

Table Of Contents
VMware, Inc. 59
Appendix: Database Schema and Audit Event Log Data
ACEManagementServereventloggingcontainsanexperimentaltamperevidencefeature.Everyrecordinthe
eventlog(exceptthefirstone)musthaveauniquereferencetothepreviousevent,furtherenforcedbythe
databaseforeignkeyanduniqueconstraint.EachsuccessiverecordhasauniqueIDincrementedby1,so
missingrecordsareimmediatelyevident.Ifauserwithdirectaccesstothedatabasechanges,adds,orremoves
somerecords,theusermustchangeeitherthepreviouseventpointerorotherdataintheremainingevent
records.Datawithineveryrecordishashedtogetherwithaserverkeyandis
storedintheeventSignaturefield.
Formoreinformationabouteventcategories,configuringlevelsofeventloggingforeachcategory,and
purgingoldeventstokeepthetablesizeincheck,see“LoggingEvents”onpage 35.