---

properties:
  # TODO determine proper values
  max_attribute_id_length: 35
  max_attribute_title_length: 24

event_types:

# "application.*" events

- id: application.starting
  title: Application Starting 
  # TODO: add the local node's persistent and session ids
  desc: The application is starting and has passed basic initialization, including profile selection.
  attributes:
  - id: user_home
    title: User home directory
    desc: The "home" directory of the user running the application.
  - id: user_name
    title: User system id
    desc: The technical/system name of the user running the application.
  - id: profile_location
    title: Profile location
    desc: The file system location of the profile that the application is using.
  - id: work_dir
    title: Working directory
    desc: The selected "working directory" when starting the application.
    note: The runtime value of this is likely to be changed in future releases
  - id: rce_version
    title: RCE version id
    desc: The full RCE version string.
  - id: os_name
    title: OS name and version
    desc: The name of the underlying operating system, as reported by the JRE.
  - id: jvm_version
    title: JVM version
    desc: The Java version, as reported by the JRE.
    
- id: application.shutdown.requested
  title: Application Shutdown Requested 
  desc: A user or technical process has requested this instance to shut down, e.g. via GUI, console command, or system shell command.
        If available, information about the cause should be logged as "Shutdown trigger"/"method".
  attributes:
  - id: method
    title: Shutdown trigger
    desc: The kind of event that initiated/requested the shutdown.
          Currently not strictly specified, for informational use only.
          Current examples are "console command", "CLI/network signal", and null (unspecified)
    optional: yes
  - id: is_restart
    title: Part of a restart
    desc: "\"yes\" if the shutdown request is part of a restart request, i.e., a new application session will start after shutdown."
    values:
    - "yes"
    - "no"

- id: application.terminating
  title: Application Terminating 
  desc: A marker event logged at the latest possible time during a regular shutdown of the application.
  # TODO attributes: add uptime?
  # TODO attributes: add instance session id?

# "serverport.*" events
  
- id: serverport.opened
  title: Server Port Opened
  desc: A network server port (typically TCP) was opened by the application.
  attributes:
  - id: type
    title: Port type
    desc: The technical type and/or protocol of the server port.
    values:
    - localnet
    - ssh/uplink
  - id: port
    title: IP port number
    desc: The IP port number.
    values:
    - Integer (1-65535)
  - id: bind_ip
    title: IP bind address
    desc: The IP address the port is bound to, which affects from which network interfaces it can be accessed.
    
- id: serverport.closed
  title: Server Port Closed
  desc: A network server port (typically TCP) was closed by the application.
  attributes:
  - id: type
    title: copy-from:(serverport.opened)
    desc: copy-from:(serverport.opened)
    values: copy-from:(serverport.opened)
  - id: port
    title: copy-from:(serverport.opened)
    desc: copy-from:(serverport.opened)
    values: copy-from:(serverport.opened)
  - id: bind_ip
    title: copy-from:(serverport.opened)
    desc: The IP address the port was bound to.

# "connection.*" events

- id: connection.incoming.accepted
  title: Incoming Connection Accepted  
  desc: An incoming connection has been successfully established.
        This should be logged as late as reasonably possible to avoid "accepted" events where the connection is
        immediately closed again due to a validation or version mismatch error.
        Mutually exclusive with the "connection.incoming.refused" event, but may be reached after one or more
        "connection.incoming.auth.failed" events if the server allows multiple login attempts.
  attributes:
  - id: type
    title: Connection type
    desc: The technical type and/or protocol of the connection.
          Usually equal to the server port's type.
    values:
    - localnet
    - ssh/uplink
  - id: connection_id
    title: Connection id
    desc: An association id for this connection.
          The only assumptions that should be made about its content is that it is a string of "reasonable" 
          length, not empty, suitable for log output, and unique within the application's session.
  - id: remote_node_id
    title: Remote node id
    desc: The id of the remote RCE node, if available from the protocol type's connection process.
          This id can by any of the four supported id types, but will typically be an "instance session id". 
    optional: yes 
  - id: login_name
    title: Login/user name 
    desc: The user/login/account identifier successfully used for authentication/authorization, if applicable.
    optional: yes
  - id: auth_method
    title: Authentication method
    desc: The kind of authentication/authorization (e.g. passphrase or private key) that was successfully used, if applicable.
    optional: yes
  - id: auth_failure_count
    title: Failure count
    desc: The number of failed authentication/authorization attempts for this connection, if applicable.
    optional: yes
  - id: remote_ip
    title: Remote IP address
    desc: The remote IP address of the incoming connection.
  - id: remote_port
    title: Remote IP port 
    desc: The remote IP port number of the incoming connection.
  - id: server_port
    title: Server IP port
    desc: The local server IP port number that the incoming connection is connected to.

- id: connection.incoming.auth.failed
  title: Incoming Connection Failed To Authenticate
  desc: As part of establishing an incoming connection, an authentication/authorization attempt was made but failed.
        Whether this failure is fatal for the overall connection attempt or not is implementation-specific.
        If this is ultimately followed up by a successful authentication/authorization attempt (in case another attempt was
        allowed in the first place), this event should be succeeded by a "connection.incoming.accepted" event.
        Otherwise, this should always be succeeded by a "connection.incoming.refused" event.
  attributes:
  - id: type
    title: copy-from:(connection.incoming.accepted)
    desc: copy-from:(connection.incoming.accepted)
    values: copy-from:(connection.incoming.accepted)
  - id: connection_id
    title: copy-from:(connection.incoming.accepted)
    desc: copy-from:(connection.incoming.accepted)
  - id: login_name
    title: copy-from:(connection.incoming.accepted)
    desc: The user/login/account identifier used for the failed authentication/authorization attempt. 
  - id: auth_method
    title: copy-from:(connection.incoming.accepted)
    desc: The kind of authentication/authorization (e.g. passphrase or private key) that was attempted.
  - id: auth_failure_reason
    title: Failure reason
    desc: The reason why authentication/authorization failed (e.g., wrong password or unknown user).
  - id: auth_failure_count
    title: copy-from:(connection.incoming.accepted)
    desc: The number of failed authentication/authorization attempts for this connection.
  - id: remote_ip
    title: copy-from:(connection.incoming.accepted)
    desc: copy-from:(connection.incoming.accepted)
  - id: remote_port
    title: copy-from:(connection.incoming.accepted)
    desc: copy-from:(connection.incoming.accepted)
  - id: server_port
    title: copy-from:(connection.incoming.accepted)
    desc: copy-from:(connection.incoming.accepted)

- id: connection.incoming.refused
  title: Incoming Connection Refused
  desc: An incoming connection has failed to complete its login process or has been refused for some other reason.
        Mutually exclusive with the "connection.incoming.accepted" and "connection.incoming.closed" events.
        Both incorrect authentication attempts as well as authentication timeouts (e.g. when an SSH client makes
        no authentication attempt at all) are both represented by this event.
        These sub-types can be distinguished by the "last_auth_failure_reason" attribute.
  attributes:
  - id: type
    title: copy-from:(connection.incoming.accepted)
    desc: copy-from:(connection.incoming.accepted)
    values: copy-from:(connection.incoming.accepted)
  - id: connection_id
    title: copy-from:(connection.incoming.accepted)
    desc: copy-from:(connection.incoming.accepted)
  - id: close_reason
    title: Reason
    desc: The human-readable reason why this connection was refused.
  # optional attributes if there was at least one auth failure
  - id: last_login_name
    title: Last login/user name
    desc: The user/login/account identifier used for the last failed authentication/authorization attempt, if applicable.
    optional: yes
  - id: last_auth_failure_reason
    title: Last auth. failure
    desc: The last reason why authentication/authorization failed (e.g., wrong password or unknown user), if applicable.
    optional: yes
  - id: last_auth_method
    title: Last auth. method
    desc: The last kind of authentication/authorization (e.g. passphrase or private key) that was attempted, if applicable.
    optional: yes
  - id: auth_failure_count
    title: Auth. failure count
    desc: The number of failed authentication/authorization attempts for this connection, if applicable.
    optional: yes
  - id: remote_ip
    title: copy-from:(connection.incoming.accepted)
    desc: copy-from:(connection.incoming.accepted)
  - id: remote_port
    title: copy-from:(connection.incoming.accepted)
    desc: copy-from:(connection.incoming.accepted)
  - id: server_port
    title: copy-from:(connection.incoming.accepted)
    desc: copy-from:(connection.incoming.accepted)
  - id: duration
    title: Duration
    desc: The duration (in msec) that this connection was open/established for.
          The precise start and end times for this calculation are implementation- and type-dependent. 

- id: connection.incoming.closed
  title: Incoming Connection Closed
  desc: An incoming connection has been closed, either by the client, the server, or a network event.
        This event is always preceded by a "connection.incoming.accepted" event.
        Mutually exclusive with the "connection.incoming.refused" event.
  attributes:
  - id: type
    title: copy-from:(connection.incoming.accepted)
    desc: copy-from:(connection.incoming.accepted)
    values: copy-from:(connection.incoming.accepted)
  - id: connection_id
    title: copy-from:(connection.incoming.accepted)
    desc: copy-from:(connection.incoming.accepted)
  - id: remote_node_id
    title: copy-from:(connection.incoming.accepted)
    desc: copy-from:(connection.incoming.accepted)
    optional: yes 
  - id: close_reason
    title: copy-from:(connection.incoming.refused)
    desc: The human-readable reason why this connection was closed.
  - id: remote_ip
    title: copy-from:(connection.incoming.accepted)
    desc: copy-from:(connection.incoming.accepted)
  - id: remote_port
    title: copy-from:(connection.incoming.accepted)
    desc: copy-from:(connection.incoming.accepted)
  - id: server_port
    title: copy-from:(connection.incoming.accepted)
    desc: copy-from:(connection.incoming.accepted)
  - id: duration
    title: copy-from:(connection.incoming.refused)
    desc: copy-from:(connection.incoming.refused)

# uplink-specific events

- id: uplink.incoming.accepted
  title: Incoming Uplink Connection Accepted 
  desc: After the login credentials for an incoming SSH connection were accepted, this subsequent event indicates successful
        completion of the Uplink protocol handshake, too.
        This includes protocol compatibility validation and the successful assignment of an unused Uplink namespace.
  attributes:
  - id: session_id
    title: Uplink session id
    desc: The Uplink-specific session id.
  - id: connection_id
    title: SSH connection id
    desc: The SSH connection id for correlation with "connection.incoming.*" events.
  - id: client_version
    title: Client software id
    desc: The software version of the Uplink client; includes information about the client software used (e.g., "rce/..."). 
  - id: protocol_version
    title: Protocol version
    desc: The Uplink protocol version being used for the connection/session, based on the initial client-server handshake.
  - id: login_name
    title: Effective login name
    desc: The final/effective login name used.
          Due to namespace mapping constraints, this may be different from the original login name; see "original_login_name".
  - id: original_login_name
    title: Original login name
    desc: The login name requested by the client, before any modifications by the server.
          Omitted if equal to the effective login name (see "login_name").
    optional: yes
  - id: client_id
    title: Effective client id
    desc: The final/effective client id used.
          Due to namespace mapping constraints, this may be different from the original client id; see "original_client_id".
  - id: original_client_id
    title: Original client id
    desc: The client id requested by the client, before any modifications by the server.
          Omitted if equal to the effective client id (see "client_id").
    optional: yes
  - id: namespace
    title: Assigned namespace
    desc: The namespace assigned to this client for Uplink destination address mapping. Typically related to the session id.
    
- id: uplink.incoming.refused
  title: Incoming Uplink Connection Refused 
  desc: After the login credentials for an incoming SSH connection were accepted, this subsequent event indicates failure of
        the Uplink protocol handshake.
        This may be due to a version incompatibility or the desired namespace already being used.
        The next event logged after this should be "connection.incoming.closed", as the SSH connection was already "accepted".
        Mutually exclusive with "uplink.incoming.accepted" and "uplink.incoming.closed".
  attributes:
  - id: session_id
    title: copy-from:(uplink.incoming.accepted)
    desc: copy-from:(uplink.incoming.accepted)
  - id: connection_id
    title: copy-from:(uplink.incoming.accepted)
    desc: copy-from:(uplink.incoming.accepted)
  - id: client_version
    title: copy-from:(uplink.incoming.accepted)
    desc: copy-from:(uplink.incoming.accepted)
  - id: protocol_version
    title: copy-from:(uplink.incoming.accepted)
    desc: The protocol version requested by the client.
          May or may not be a version that this server supports.
  - id: login_name
    title: Original login name
    desc: The login name used by the client, without any mapping modification that would have been made on success.
  - id: client_id
    title: Original client id
    desc: The client id sent by the client, without any mapping modification that would have been made on success.
  - id: reason
    title: Reason
    desc: The human-readable reason for refusing the Uplink session.

- id: uplink.incoming.closed
  title: Incoming Uplink Connection Closed
  desc: After a previous "uplink.incoming.accepted" event, this indicates the end of the application-level Uplink session.
        This event should be logged for any kind of connection termination, from graceful disconnect to low-level
        connection errors.
        Mutually exclusive with "uplink.incoming.refused".
  attributes:
  - id: session_id
    title: copy-from:(uplink.incoming.accepted)
    desc: copy-from:(uplink.incoming.accepted)
  - id: connection_id
    title: copy-from:(uplink.incoming.accepted)
    desc: copy-from:(uplink.incoming.accepted)
  - id: final_state
    title: Final connection state
    desc: The final (technical) state of the Uplink connection; indicates the reason for terminating the session.
    
    
# "network.*" events

- id: network.node.named
  title: Network Node Discovered/Named
  desc: Either a new node in the logical RCE network has been discovered, or an existing node has changed its title.
        Relevant for determining which technical node was behind a given display name at a certain time.
        Besides general logging, this is also a basic security trail for potential node "impersonation" attempts.
  attributes:
  - id: instance_id
    title: Persistent instance id
    desc: The persistent part (the "instance node id") of the logical RCE-specific network address.
  - id: session_id
    title: Instance session id
    desc: The per-session suffix of the of the logical RCE-specific network address.
          Used to distinguish runs of the same instance, i.e., the session id always changes on an instance's restart.
  - id: logical_sub_node_id
    title: Logical sub-node id
    desc: The logical "sub-node" selector within the logical RCE-specific network address.
          If absent, then this event represents a change of the "root" name of an instance/node.
          If present, then a logical "sub-node" has changed its specific name, while the "root" name was unchanged.
    optional: yes
  - id: name
    title: Announced name
    desc: The title/name of the RCE instance, as defined by its user or administrator.
  - id: is_local_node
    title: Is local/own node
    desc: \"yes\" if the observed node is the local node.
          This is a convenience property to simplify event filtering.
    values:
    - "yes"
    - "no"
    derived: yes
    optional: yes
    
# TODO consider adding a "network.node.restarted" event

# workflow / component events

- id: workflow.request.initiated
  title: Workflow Request Initiated (Request Sent)
  desc: A workflow run was initiated from the local node.
        The designated workflow controller may be either the local or a remote node. 
  attributes:
  - id: workflow_run_id
    title: Workflow run id
    desc: The id string assigned to this workflow run. Can be considered globally unique for all practical purposes.
  - id: workflow_controller_node
    title: Workflow controller node
    desc: The logical node id of the node designated to run the workflow controller.
  - id: workflow_controller_is_local_node
    title: Controller is local
    desc: A convenience attribute designating whether the workflow controller node is the local node. 
    values:
    - "yes"
    - "no"
    derived: yes
  - id: local_workflow_file
    title: Workflow file path
    desc: The path of the local workflow file that was submitted for execution, if applicable; OTHERWISE absent.
    optional: yes
  - id: workflow_metadata
    title: Workflow metadata (WIP)
    desc: TODO specify contents; structured data
#  - id: workflow_parameters
#    desc: TODO decide whether this should be in the event log, including confidentiality considerations; if yes, it will most likely be structured data
  - id: success
    title: success
    desc: Whether the workflow was successfully initiated, i.e., whether the request was made and accepted by the designated execution node.
    values:
    - "yes"
    - "no"

- id: workflow.execution.requested
  title: Workflow Execution Requested (Request Received)
  desc: A workflow run was requested, and an attempt was made to initialize its workflow controller on the local node.
        If controller initialization fails, this event MUST still be logged to make the request visible, as the ".initiated" event may have been logged be on a remote node.
  attributes:
  - id: workflow_run_id
    title: copy-from:(workflow.request.initiated)
    desc: copy-from:(workflow.request.initiated)
  - id: start_ts
    title: Start timestamp
    desc: On success, the canonical start time of the workflow, which will usually be close, but not necessarily equal to the timestamp of this event; OTHERWISE absent.
          (TODO specify format)
    optional: yes
  - id: initiator_node
    title: Initiator node
    desc: The logical session node id of the node that initiated this workflow run.
          Note that in RCE 10.x and earlier, this value is NOT strongly verified, and should be considered informational only.
  - id: initiator_is_local_node
    title: Initiator is local
    desc: A convenience attribute designating whether the node that initiated this workflow run is the local node.
          Note that in RCE 10.x and earlier, this value is NOT strongly verified, and should be considered informational only.
    values:
    - "yes"
    - "no"
    derived: yes
  - id: workflow_metadata
    title: copy-from:(workflow.request.initiated)
    desc: TODO specify contents; structured data
#  - id: workflow_parameters
#    desc: TODO decide whether this should be in the event log, including confidentiality considerations; if yes, it will most likely be structured data
  - id: success
    title: copy-from:(workflow.request.initiated)
    desc: Whether the workflow was successfully initialized.
    values:
    - "yes"
    - "no"
  
- id: workflow.execution.completed
  title: Workflow Execution Completed
  desc: The end of a local workflow controller's execution.
        (TODO clarify whether this may be logged on a failed ".requested" event or not.)   
  attributes:
  - id: workflow_run_id
    title: copy-from:(workflow.request.initiated)
    desc: copy-from:(workflow.request.initiated)
  - id: end_ts
    title: End timestamp
    desc: The canonical end time of the workflow, which will usually be close, but not necessarily equal to the timestamp of this event.
          (TODO specify format)
  - id: duration
    title: Duration
    desc: A convenience attribute specifying the duration of this workflow run.
          (TODO specify format)
    derived: yes
  - id: final_state
    title: Final workflow state
    desc: The final state of the workflow, as defined by the workflow engine.
    values:
    - FINISHED
    - CANCELLED
    - FAILED
    - RESULTS_REJECTED

- id: workflow.request.completed
  title: Workflow Request Completed
  desc: The final event of a workflow run that was initiated by the local node.
        (TODO clarify whether this may be logged on a failed ".initiate" event or not.)
  attributes:
  - id: workflow_run_id
    title: copy-from:(workflow.request.initiated)
    desc: copy-from:(workflow.request.initiated)
  - id: final_state
    title: copy-from:(workflow.execution.completed)
    desc: copy-from:(workflow.execution.completed)
    values: copy-from:(workflow.execution.completed)

- id: component.request.initiated
  title: Component/Tool Execution Initiated (Request Sent)
  desc: A workflow component run was initiated from the local node, which is always the workflow controller.
        The node controlling the component's execution may be the local or a remote one. 
  attributes:
  - id: workflow_run_id
    title: copy-from:(workflow.request.initiated)
    desc: copy-from:(workflow.request.initiated)
  - id: component_run_id
    title: Component run id
    desc: The id string assigned to this component run. Unique within the scope of the associated workflow.
  - id: execution_controller_node
    title: Executing node
    desc: The logical session node id of the node designated to be this component run's execution controller.
  - id: execution_controller_is_local_node
    title: Executing node is local
    desc: A convenience attribute designating whether this component's run execution controller node is the local node.
    values:
    - "yes"
    - "no"
    derived: yes
#  - id: input_data
#    desc: TODO decide whether this should be in the event log, including confidentiality considerations; if yes, it will most likely be structured data
    
- id: component.execution.requested
  title: Component/Tool Execution Requested
  desc: A workflow component run was requested, and an attempt was made to initialize its controller on the local node.
        If controller initialization fails, this event MUST still be logged to make the request visible, as the ".initiated" event may have been logged be on a remote workflow controller node. 
  attributes:
  - id: workflow_run_id
    title: copy-from:(component.request.initiated)
    desc: copy-from:(component.request.initiated)
  - id: component_run_id
    title: copy-from:(component.request.initiated)
    desc: copy-from:(component.request.initiated)
  - id: workflow_controller_node
    title: Workflow controller node
    desc: The logical session node id of the node running the workflow controller.
          Note that in RCE 10.x and earlier, this value is NOT strongly verified, and should be considered informational only.
  - id: workflow_controller_is_local_node
    title: Workflow contr. is local
    desc: A convenience attribute designating whether the workflow controller node is the local node.
          Note that in RCE 10.x and earlier, this value is NOT strongly verified, and should be considered informational only.
  - id: start_ts
    title: Start timestamp
    desc: On success, the canonical start time of the component run, which will usually be close, but not necessarily equal to the timestamp of this event; OTHERWISE absent.
          (TODO specify format)
    optional: yes
#  - id: input_data
#    desc: TODO decide whether this should be in the event log, including confidentiality considerations; if yes, it will most likely be structured data
  
- id: component.execution.completed
  title: Component/Tool Execution Completed
  desc: The end of a local workflow controller's execution.
        (TODO clarify whether this may be logged on a failed ".requested" event or not.)
  attributes:
  - id: workflow_run_id
    title: copy-from:(component.request.initiated)
    desc: copy-from:(component.request.initiated)
  - id: component_run_id
    title: copy-from:(component.request.initiated)
    desc: copy-from:(component.request.initiated)
  - id: end_ts
    title: End timestamp
    desc: The canonical end time of the component run, which will usually be close, but not necessarily equal to the timestamp of this event.
          (TODO specify format)
  - id: duration
    title: Duration
    desc: A convenience attribute specifying the wall-clock duration of this component run.
          (TODO specify format)
    derived: yes
#  - id: output_data
#    desc: TODO decide whether this should be in the event log, including confidentiality considerations; if yes, it will most likely be structured data
  - id: final_state
    title: Final component state
    desc: The final state of the component, as defined by the workflow engine.
    values:
    - FINISHED
    - CANCELLED
    - FAILED
    - RESULTS_REJECTED

- id: component.request.completed
  title: Component/Tool Execution Request Completed
  desc: The final event of a component run that was initiated by a workflow controller running on the local node.
        (TODO clarify whether this may be logged on a failed ".initiate" event or not.)
  attributes:
  - id: workflow_run_id
    title: copy-from:(component.request.initiated)
    desc: copy-from:(component.request.initiated)
  - id: component_run_id
    title: copy-from:(component.request.initiated)
    desc: copy-from:(component.request.initiated)
  - id: end_ts
    title: copy-from:(component.execution.completed)
    desc: The canonical end time of the component run, which will usually be close, but not necessarily equal to the timestamp of this event.
          (TODO specify format)
  - id: duration
    title: copy-from:(workflow.execution.completed)
    desc: A convenience attribute specifying the wall-clock duration of this component run.
          (TODO specify format)
    derived: yes
#  - id: output_data
#    desc: TODO decide whether this should be in the event log, including confidentiality considerations; if yes, it will most likely be structured data
  - id: final_state
    title: copy-from:(component.execution.completed)
    desc: copy-from:(component.execution.completed)
    values: copy-from:(component.execution.completed)


# other events
    
- id: accounts.initialized
  title: Login/Account Data Initialized
  desc: A set of accounts has been initialized, typically at application or subsystem startup.
  attributes:
  - id: type
    title: Account type
    desc: The type of accounts that were initialized, e.g. "ssh".
    values:
    - ssh
  - id: number_of_accounts
    title: New number of accounts
    desc: Indicates the total number of registered accounts after initialization.
  - id: origin
    title: Account data origin
    desc: Indicates the data source from which the initial account data was read.
          Absent if not applicable for the current account type.
    optional: yes

- id: accounts.updated
  title: Login/Account Data Updated
  desc: A set of accounts has been updated at application runtime, after being already initialized.
  attributes:
  - id: type
    title: copy-from:(accounts.initialized)
    desc: The type of accounts that were updated, e.g. "ssh".
    values: copy-from:(accounts.initialized)
  - id: number_of_accounts
    title: copy-from:(accounts.initialized)
    desc: Indicates the total number of registered accounts after the update (NOT the number of changes!).
  - id: origin
    title: copy-from:(accounts.initialized)
    desc: Indicates the data source from which the updated account data was read.
          Absent if not applicable for the current account type.
    optional: yes
    
- id: sysmon.initialized
  title: System Monitoring Initialized
  desc: Indicates that the system monitoring subsystem was initialized and logs static system information.
  attributes:
  - id: jvm_pid
    title: Java process id
    desc: The PID of the main process running the JVM.
          Depending on the operating system, this process may either be the RCE executable or a separate Java process.
  - id: jvm_processor_count
    title: Processor count (JVM)
    desc: The number of processors, as reported by the JVM.
  - id: jvm_heap_limit
    title: Heap limit (JVM)
    desc: The configured heap (Java RAM) limit, as reported by the JVM.
  - id: system_total_ram
    title: System RAM (native)
    desc: The total system RAM in bytes, as reported by the system monitoring library.
  - id: system_logical_cpus
    title: Logical CPUs (native)
    desc: The number of "logical CPUs", as reported by the system monitoring library.

- id: custom
  title: Custom Event
  desc: A custom event type, allowing extensions or plugins to make use of the event logging system.
        This event type is special in the way that its list of attributes is not pre-defined, except for "type".
        This allows custom events to log all kinds of extra attributes.
        Consequently, any event log validation code must have a special rule to accept those attributes.
        Note that while custom attribute keys are supported, there are still certain rules for them.
        For now, they must start with a-z, end with a-z or a digit, and not exceed the maximum length defined above.
        It is also recommended to keep them lowercase and dot-separated for consistency. 
  attributes:
  - id: type
    title: Custom event type id
    desc: A custom type id describing the logged event.
          It should generally follow the naming pattern of the standard events,
          and plugins/extensions should strive to make those ids collision-free.
