1C:Enterprise Technological Log
1C:Enterprise 8.3.27 technological-log JSON records (SCALL, CALL, TLOCK, EXCP) of one rphost process serving fourteen client and service sessions of one infobase, in an ECS envelope. About 44,000 records a day: interactive users follow a working day in UTC, background jobs keep the same pace day and night. Managed locks on document keys are granted at once, queued, or time out after 20 seconds. Recurring episodes are lock convoys: one very long posting blocks a busy document key until six distinct sessions have timed out on it within 50 minutes.
Quick Start
uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
--path generators/application-1c-techjournal/generator.yml \
--id onec-techjournal \
--live-mode trueEvent Types
| Event ID | Description | Frequency | Category |
|---|---|---|---|
| SCALL | Outgoing call of the server process, for example to the lock service | 67% of records without episodes | remote call |
| CALL | Incoming client call, written when the call ends; duration spans the whole call | 18% of records without episodes | remote call |
| TLOCK | Managed transaction lock; about 95% are granted at once with empty WaitConnections | 14% of records without episodes, varying from day to day with the posting workload | lock |
| EXCP | Managed-lock wait timeout exception | 0.3% of records without episodes, varying from day to day with the posting workload | error |
Realism Features
- About 44,000 records a day (±3% from day to day): about 58 a minute at 09:00-13:00 and 14:00-17:00 UTC, 40 at 08:00-09:00, 13:00-14:00 and 17:00-18:00, 21 at 07:00-08:00 and 18:00-20:00, and 13 from 20:00 to 07:00. Interactive users make about 5% of their daytime calls at night; the background jobs batch_admin (BackgroundJob) and exchange_service (COMConnection) write about 10-12 records a minute around the clock. Every day follows the same UTC curve, weekends included, with no weekly cycle, holidays or time-zone offset; busy and calm periods and the day-to-day posting workload vary at random.
- Each session alternates server calls and think time (mostly seconds, sometimes minutes). A call runs on a free worker thread (OSThread) and writes its SCALL, TLOCK and EXCP records in order, then its CALL; the records of one call follow each other within milliseconds, and a lock wait, transaction or timeout spans exactly the time its duration states. About one read call in a hundred is a report that runs for minutes without locks. Sessions stay connected for the whole run, and work inside a call (SDBL, DBMSSQL) is not logged, so postings and reports show as pauses.
- Write calls take exclusive or shared managed locks on document keys DOC-0031 to DOC-0060 of InfoRg42.DIMS, some much busier than others; most users write in about 40% of their calls, auditor and hr_specialist only read. A compatible request is granted at once; a conflicting one waits, and WaitConnections names the t:connectID of one session whose running call holds a conflicting lock, even when several do. Locks are held until the call ends or an exception rolls the transaction back, and waiting requests are granted in arrival order.
- Four sessions post documents (batch_admin, exchange_service, storekeeper01, storekeeper02): they write in 75-80% of their calls and hold their first lock about 10 s for an ordinary posting, 35-75 s for a long one and a few minutes for one long posting in ten. Long postings are more frequent in busy periods and on busy days, so waits name mostly these four connections.
- A request still waiting after 20 s writes a TLOCK with its 20-second wait, then EXCP. The transaction is rolled back and often retried, or the call ends after zero to two rollback SCALLs and the user sometimes repeats the operation on the same document within seconds. Timeouts average about 130 a day (under 100 to over 250), about 1.7% of calls and 2% of lock requests: 8-16 an hour from 09:00 to 17:00 and one to two an hour at night, mostly background jobs waiting on each other. A long posting sometimes times out one to three sessions; without episodes, at most five distinct sessions time out on one key naming one connection within 50 minutes.
- TTIMEOUT and TDEADLOCK are not generated (mutual waits end in two timeouts), and depth is fixed per event type (TLOCK 5). The 20-second timeout is an assumption with no first-party 1C statement of the default. Shares and rates are synthetic workload settings, not measured 1C rates; contexts, module names and document keys describe a synthetic configuration.
- Complete first-party 8.3.27 JSON records for CALL, TLOCK and EXCP were not found, so their shapes follow the vendor text examples and text-to-JSON rule; native values are JSON strings, duration in microseconds. The file is ECS JSON with the native object in event.original and parsed fields in one_c.techjournal. No Elastic integration exists, and the KUMA 1C TechJournal regexp normalizer is unverified for this JSON profile.
Sample Output
{
"@timestamp": "2026-09-14T08:03:32.989296+00:00",
"ecs": {
"version": "8.17.0"
},
"event": {
"action": "TLOCK",
"dataset": "1c.techjournal",
"kind": "event",
"original": "{\"ts\":\"2026-09-14T08:03:32.989296\",\"duration\":\"20000235\",\"name\":\"TLOCK\",\"depth\":\"5\",\"level\":\"INFO\",\"process\":\"rphost\",\"p:processName\":\"accounting\",\"OSThread\":\"23200\",\"t:clientID\":\"552\",\"t:applicationName\":\"1CV8C\",\"t:computerName\":\"client-11\",\"t:connectID\":\"26\",\"SessionID\":\"125\",\"Usr\":\"manager_sales01\",\"AppID\":\"1CV8C\",\"Regions\":\"InfoRg42.DIMS\",\"Locks\":\"InfoRg42.DIMS Exclusive Fld43=\\\"DOC-0031\\\"\",\"WaitConnections\":\"16\",\"Context\":\"\u0414\u043e\u043a\u0443\u043c\u0435\u043d\u0442.\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0422\u043e\u0432\u0430\u0440\u043e\u0432\u0423\u0441\u043b\u0443\u0433.\u041c\u043e\u0434\u0443\u043b\u044c\u041e\u0431\u044a\u0435\u043a\u0442\u0430 : 214 : \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430\u0414\u0430\u043d\u043d\u044b\u0445.\u0417\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c();\"}",
"type": [
"info"
]
},
"host": {
"name": "onec-app-01"
},
"one_c": {
"techjournal": {
"AppID": "1CV8C",
"Context": "\u0414\u043e\u043a\u0443\u043c\u0435\u043d\u0442.\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0422\u043e\u0432\u0430\u0440\u043e\u0432\u0423\u0441\u043b\u0443\u0433.\u041c\u043e\u0434\u0443\u043b\u044c\u041e\u0431\u044a\u0435\u043a\u0442\u0430 : 214 : \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430\u0414\u0430\u043d\u043d\u044b\u0445.\u0417\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c();",
"Locks": "InfoRg42.DIMS Exclusive Fld43=\"DOC-0031\"",
"OSThread": "23200",
"Regions": "InfoRg42.DIMS",
"SessionID": "125",
"Usr": "manager_sales01",
"WaitConnections": "16",
"depth": "5",
"duration": "20000235",
"level": "INFO",
"name": "TLOCK",
"p:processName": "accounting",
"process": "rphost",
"t:applicationName": "1CV8C",
"t:clientID": "552",
"t:computerName": "client-11",
"t:connectID": "26",
"ts": "2026-09-14T08:03:32.989296"
}
},
"process": {
"name": "rphost"
},
"user": {
"name": "manager_sales01"
}
}Parameters
| Parameter | Default | Description |
|---|---|---|
| anomaly_mode | true | Include recurring lock convoys; false produces background only |
| anomaly_interval_hours | 2 | Hours between episodes, 0.5 to 8,760; the next is due one interval after the previous actual start, and episodes fall between 08:00 and 17:00 UTC |
| host_name | onec-app-01 | Server host; also t:computerName of background jobs |
| infobase | accounting | Infobase name (p:processName) |
| process_name | rphost | 1C process |
Related Generators
1C:Enterprise Event Log
1C:Enterprise 8.3.27 event-log collector projection for a client/server, single-data-area infobase: ECS-style JSON with snake_case source fields under one_c.event_log, not a native XML or .lgf export and without event.original. Six staff accounts, four reusable temporary account names and five configured objects with explicit permissions. Recurring episodes, weekly by default, join an administrator's failed logins, a temporary FullAccess account, its payroll reads, its deletion and an event-log reduction.
Nextcloud Admin Audit
Nextcloud 35.0.0 admin_audit HTTP records from the dedicated audit.log file backend, with each native JSON line in event.original and parsed under nextcloud.audit, for testing detections on logins, file access and public links. 180 users work in sessions over 1,154 files, about 10,800 records a day. Recurring episodes show a guessed password followed by publishing a file for outside access through a public link.
Atlassian Jira security logs
About 6,600 records/day from one Jira node and 512 accounts, with native security messages and ECS enrichment.