Data Storage Structure in ClickHouse
All described tables are created using the ReplacingMergeTree engine.
Do not modify the monitoring data tables main.monitoring_activity and main.monitoring_agent_inspector_log. Doing so may cause critical system failures and data loss.
The "monitoring_activity" table
This table stores information about user activity. The default path to access the table is main.monitoring_activity.
Columns are marked with ✔ and ✖ to indicate presence or absence depending on the monitoring type.
| Column Name | Type | Description | Basic Monitoring | Advanced Monitoring |
|---|---|---|---|---|
agent_version | String | Monitoring agent version | ✔ | ✔ |
computer_name | String | Computer name | ✔ | ✔ |
cpu_loading | UInt32 | CPU usage value in percent (from 0 to 100) | ✖ | ✔ |
domain | String | Domain name | ✔ | ✔ |
element_ctrl | UInt8 | Control type of the element specified in element_name | ✖ | ✔ |
element_hotkey_name | String | Menu item name | ✖ | ✔ |
element_name | String | Name of the element (e.g., button or checkbox) with type 10 or higher | ✖ | ✔ |
employee_account_id | UInt64 | Identifier of the EmployeeAccount entity in the built-in file-based database of the monitoring module | ✔ | ✔ |
executable_path | String | Full path to the executable file | ✔ | ✔ |
file_name | String | Name of the open file; can be empty | ✔ | ✔ |
file_path | String | Full path to the open file; can be empty | ✔ | ✔ |
id | UInt64 | Identifier of the domain entity in the built-in file-based database | ✔ | ✔ |
input_type | UInt8 | Indicates the type of activity: 1 — hardware-based, 0 — software-based | ✔ | ✔ |
location_name | Array(String) | Window hierarchy | ✔ | ✔ |
location_type | Array(UInt32) | Window type | ✔ | ✔ |
main_window | String | Window title | ✔ | ✔ |
memory_loading | UInt32 | Memory usage value in percent (from 0 to 100) | ✖ | ✔ |
parameters_name | Array(String) | Name of the element from which the value was obtained | ✔ | ✔ |
parameters_type | Array(UInt32) | Element type | ✔ | ✔ |
parameters_value | Array(String) | Field value may be displayed in plain text if it is a special field (e.g., Organization) or if hashing is disabled; otherwise, it is displayed as a hash in the format crc32:<32-bit_number> | ✔ | ✔ |
parameters_is_current | Array(UInt8) | Value 1 for the currently edited field and all its extracted parameters; value 0 for non-edited fields | ✔ | ✔ |
program | String | Name of the running program | ✔ | ✔ |
research_id | UInt64 | Research ID for which the screenshot was taken | ✖ | ✔ |
screenshot_id | String | Screenshot identifier | ✖ | ✔ |
tab | String | Main window tab; can be empty | ✔ | ✔ |
time_offset | Int8 | Time zone (offset in hours from UTC time) | ✔ | ✔ |
time | DateTime64 | User-initiated event time, represented as a calendar date and time with millisecond and nanosecond precision | ✔ | ✔ |
| type | Int16 | Event type | ✔ | ✔ |
url_path | String | URL path after the domain | ✔ | ✔ |
version | String | Version of the running program | ✔ | ✔ |
Columns present in basic monitoring are not always filled simultaneously. For each event (except types 1 — start, 2 — stop, and 3 — crash), the following columns are populated:
idtimeemployee_account_idtime_offsetprogramversionexecutable_pathtypeinput_typecomputer_nameagent_version
Depending on the program type, the following additional columns may be filled in basic monitoring:
- Browsers:
main_window,domain, andurl_path - Document processing applications (e.g., Microsoft Office):
file_pathandfile_name - Other desktop applications:
main_window
If the monitoring agent captures a window identifier or an Excel sheet name in the parameters_name column, the following columns may also be filled in basic monitoring:
parameters_nameparameters_valueparameters_is_currentparameters_type
In addition to the default path main.monitoring_activity, automation scripts can use the variable activity_table, which stores the path to the monitoring_activity table. This allows the system to automatically generate the correct table path when infrastructure changes, minimizing the risk of errors. Scripts can reference the table by substituting the variable directly into a query or code.
The value of the activity_table variable is defined in the configuration file com.operavix.subsystem.monitoring.json using the parameters monitoring_database_name and storage_guid.
The monitoring_agent_inspector_log table
This table stores technical logs from monitoring agents, transmitted from workstations to the application server. These logs are used for initial diagnostics of monitoring agent issues. The default path to access the table is main.monitoring_agent_inspector_log.
| Field | Type | Description |
|---|---|---|
time_offset | Int8 | Time offset (UTC) |
time | DateTime64(3, UTC) | UTC time in seconds |
level | String | Logging level |
pid | Int32 | Process ID, 32-bit integer |
tid | Int32 | Thread ID, 32-bit integer |
function | String | Name of the function in the code where the message was logged |
message | String | Log text (logging levels: "info", "warning", "error", "critical") |
machine_guid | String | Machine ID (OS-dependent), used to identify the specific workstation from which the activity originated |
agent_version | String | Agent version |
remote_address | String | IP address of the client, represented as a string |
computer_name | String | Computer name taken from the manifest.json file in the activity archive |
employee_account_id | UInt64 | Identifier of the EmployeeAccount entity in the built-in file-based database of the monitoring module |
type_log | String | Type of activity logs: inspector – inspector logs; service – SYSTEM service logs; timetracking – timetracking logs |
row_number | UInt64 | Sequential record number in the table |
By default, data is retained for 14 days. This retention period can be changed via the partition_life_circle_time parameter in the com.operavix.subsystem.monitoring.json configuration file.
Was the article helpful?