VMware ACE Management Server Administrator's Manual page 61

Appendix: Database Schema and Audit Event Log Data
ACE Management Server event logging contains an experimental tamper evidence feature. Every record in the
event log (except the first one) must have a unique reference to the previous event, further enforced by the
database foreign key and unique constraint. Each successive record has a unique ID incremented by 1, so
missing records are immediately evident. If a user with direct access to the database changes, adds, or removes
some records, the user must change either the previous event pointer or other data in the remaining event
records. Data within every record is hashed together with a server key and is stored in the eventSignature field.
For more information about event categories, configuring levels of event logging for each category, and
purging old events to keep the table size in check, see "Logging Events" on page 37.
VMware, Inc. 61