Kaspersky Administration Kit Database Schema

Kaspersky Administration Kit Database Schema 1.0


View v_akpub_adm_group

Contains administration group attributes.

Column name | Column type (SQL Server) | Column type (MySQL) | Description
nId | INT | INT | Id of administration group
wstrName | NVARCHAR (256) | VARCHAR (256) UNICODE | Name of administration group
nParentId | INT | INT | Id of parent administration group


View v_akpub_host

Contains host properties host.

Column name | Column type (SQL Server) | Column type (MySQL) | Description
nId | INT | INT | Host id
strName | VARCHAR(256) | VARCHAR(256) | Host name – a unique server-generated string
wstrDisplayName | NVARCHAR(256) | VARCHAR(300) UNICODE | Host display name
bIsSlaveServer | BIT | BOOL | Zero if host is a slave server. Non-zero otherwise.
bHasUpadateAgent | BIT | BOOL | Non-zero if host has nagent working as update agent installed. Zero otherwise.
wstrDnsName | NVARCHAR(256) | VARCHAR(256) UNICODE | DNS name without DNS suffix
wstrDnsDomain | NVARCHAR(256) | VARCHAR(256) UNICODE | DNS suffix
wstrWinName | NVARCHAR(256) | VARCHAR(256) UNICODE | Host windows (NetBIOS) name
wstrWinDomain | NVARCHAR(256) | VARCHAR(256) UNICODE | Name of NT domain or workgroup
tmLastVisible | DATETIME | DATETIME | Last host visibility UTC time.
tmLastInfoUpdate | DATETIME | DATETIME | Last update host information UTC time.
tmLastUpdate | DATETIME | DATETIME | Last anti-virus update UTC time
tmLastNagentConnected | DATETIME | DATETIME | Last Network Agent connection UTC time.
tmLastFullScan | DATETIME | DATETIME | UTC time of last full scan for viruses
nGroup | INT | INT | Id of administration group where host is located *
nStatus INT INT Host status, bit set
  • bit 0 set if host is visible,
  • bit 2 set if Network Agent is installed
  • bit 3 set if Network Agent is "alive"
  • bit 4 set if real-time protection is installed
nVersionMajor | INT | INT | Major part of operating system version
nVersionMinor | INT | INT | Minor part of operating system version
nComputerType INT INT "Computer type". Bit set.
  • Bit 0 – Workstation
  • Bit 1 – Server
  • Bit 2 – Any server running with Microsoft SQL Server
  • Bit 3 – Primary domain controller
  • Bit 4 – Backup domain controller
  • Bit 5 – Server running the Timesource service
  • Bit 6 – Apple File Protocol server
  • Bit 7 – Novell server
  • Bit 8 – Domain member
  • Bit 9 – Server sharing print queue
  • Bit 10 – Server running dial-in service
  • Bit 11 – Some Unix
  • Bit 12 – Windows NT/2000/XP/2003/Vista workstation or server
  • Bit 13 – BSD or Windows for Workgroups (depending on KLHST_WKS_PTYPE)
  • Bit 14 – Microsoft File and Print for NetWare
  • Bit 15 – Windows NT/2000/2003 server that is not a domain controller
  • Bit 16 – Server that can run the browser service
  • Bit 17 – Server running a browser service as backup
  • Bit 18 – Server running the master browser service
  • Bit 19 – Server running the domain master browser
  • Bit 20 – OSF
  • Bit 21 – VMS or Linux (depending on KLHST_WKS_PTYPE)
  • Bit 22 – Windows 9x/Me
  • Bit 23 – Root of a DFS tree
  • Bit 24 – NT Cluster
  • Bit 25 – IBM DSS (Directory and Security Services) or equivalent
nPlatformType INT INT "Platform type". One of following constants.
  • 0 – MSDOS, Windows 3.xx, Windows 9x/Me
  • 1 – OS/2
  • 2 – Windows NT/2000/XP/2003/Vista
  • 3 – OSF
  • 4 – VMS
  • 5 – Novell
  • 6 – Linux
  • 7 – BSD
  • 8 – Windows Mobile
  • 9 – Symbian Mobile
nIp | BIGINT | BIGINT | Host ip address (in little-endian byte order)
nConnectionIp | BIGINT | BIGINT | Host "connection ip" address (in little-endian byte order)
bKeepConnection | BIT | BOOL | "Keep connection" flag – connection between host and administration server will be persistent if this attribute is set to true. Use with care – persistent connection took much system resources on server.
nVirusCount | INT | INT | Number of viruses found.
nUncured | INT | INT | Number of uncured objects (Administration Kit v. 7 and higher).
nLastRtpState INT INT State of real-time protection. Possible values are listed below.
  • 0 – Unknown
  • 1 – Stopped
  • 2 – Suspended
  • 3 – Starting
  • 4 – Running (if anti-virus application does not support categories of state Running)
  • 5 – Running with maximum protection
  • 6 – Running for maximum speed
  • 7 – Running with recommended settings
  • 8 – Running with custom settings
  • 9 – Failure

nLastRtpErrorCode | INT | INT | Real-time protection error code (if nLastRtpState is 9)
wstrComment | NVARCHAR (256) | VARCHAR (256) UNICODE | Comments


View v_akpub_host_status

Contains extended status for a host.

Column name | Column type (SQL Server) | Column type (MySQL) | Description
nId | INT | INT | Host id
nStatus INT INT Extended status id
  • 0 – OK
  • 1 – Warning
  • 2 – Critical
nStatusMask INT INT Extended status mask, bit set
  • bit 0 – Host with Network Agent installed is online but network agent is inactive
  • bit 1 – Anti-virus application is installed but real-time protection is not running
  • bit 2 – Anti-virus application is installed but not running
  • bit 3 – Number of viruses detected is too much
  • bit 4 – Anti-virus application is installed but real-time protection status differs from one set by the security administrator
  • bit 5 – Anti-virus application is not installed
  • bit 6 – Full scan for viruses performed too long ago
  • bit 7 – Anti-virus bases were updated too long ago
  • bit 8 – Network agent is inactive too long
  • bit 9 – Old license (Administration Kit v. 7 and higher)
  • bit 10 – Number of uncured objects is too much (Administration Kit v. 7 and higher)


View v_akpub_hst_prdstate

Contains information about products installed on a host.

Column name | Column type (SQL Server) | Column type (MySQL) | Description
nHost | INT | INT | Host id
wstrProductNameId | NVARCHAR(32) | VARCHAR(32) UNICODE | Product name id *
wstrProductVersionId | NVARCHAR(32) | VARCHAR(32) UNICODE | Product version id *
wstrProductDisplayName | NVARCHAR(300) | VARCHAR(300) UNICODE | Product display name.
wstrProductBuildNumber | NVARCHAR(50) | VARCHAR(50) UNICODE | Product build.
tmInstallDate | DATETIME | DATETIME | Product installation UTC time.
nState INT INT One of following values
  • 0 - product is inactive
  • 1 - product is running
tmAvbasesDate | DATETIME | DATETIME | Anti-virus bases UTC time
nAvbasesRecords | INT | INT | Number of records in anti-virus bases


View v_akpub_ev_event

Contains events occured on hosts.

Column name | Column type (SQL Server) | Column type (MySQL) | Description
nId | INT | INT | Event id.
nSeverity INT INT Event severity. May have following values.
  • 1 – severity "Information"
  • 2 – severity "Warning"
  • 3 – severity "Error"
  • 4 – severity "Critical"
wstrTaskDisplayName | NVARCHAR(100) | VARCHAR(100) UNICODE | Display name of the task
nGroup | INT | INT | ID of the group where host is located
wstrGroupName | NVARCHAR(256) | VARCHAR(256) UNICODE | Name of the group where host is located
strHostname | VARCHAR(256) | VARCHAR(256) | Host name – a unique server-generated string
wstrProductNameId | NVARCHAR(32) | VARCHAR(32) UNICODE | Product name id *
wstrProductVersionId | NVARCHAR(32) | VARCHAR(32) UNICODE | Product version name id *
wstrProductBuildNumber | NVARCHAR(32) | VARCHAR(32) UNICODE | Product build
strEventType VARCHAR(50) VARCHAR(50) Name of the event type. Following values are possible.
  • "KLPRCI_TaskState" – Task state changed, see "task_new_state" attribute.
  • "GNRL_EV_SUSPICIOUS_OBJECT_FOUND" – Suspicious object found.
  • "GNRL_EV_VIRUS_FOUND" – Virus found.
  • "GNRL_EV_OBJECT_CURED" – Object was cured.
  • "GNRL_EV_OBJECT_DELETED" – Object was deleted.
  • "GNRL_EV_PASSWD_ARCHIVE_FOUND" – Password-protected archive was found.
  • "GNRL_EV_OBJECT_QUARANTINED" – Object was put into quarantine.
  • "GNRL_EV_OBJECT_NOTCURED" – Object wasn't cured.
wstrEventTypeDisplayName | NVARCHAR(100) | NVARCHAR(100) | User-friendly name for event type.
wstrDescription | NVARCHAR(1000) | NVARCHAR(1000) | Event description.
tmRiseTime | DATETIME | DATETIME | UTC time when the event was published.
tmRegistrationTime | DATETIME | DATETIME | UTC time when the event was registered at the Administration Server.
nTaskState INT INT Task state (for events of type "KLPRCI_TaskState"). Following values are possible.
  • 1 – Task running
  • 2 – Task suspended
  • 3 – Task failed
  • 4 – Task completed successfully
wstrPar1 | NVARHAR(512) | VARHAR(512) UNICODE | Extra event parameters depending on event type "event_type".
wstrPar2 | NVARHAR(512) | VARHAR(512) UNICODE
wstrPar3 | NVARHAR(512) | VARHAR(512) UNICODE
wstrPar4 | NVARHAR(512) | VARHAR(512) UNICODE
wstrPar5 | NVARHAR(512) | VARHAR(512) UNICODE
wstrPar6 | NVARHAR(512) | VARHAR(512) UNICODE
wstrPar7 | NVARHAR(512) | VARHAR(512) UNICODE
wstrPar8 | NVARHAR(512) | VARHAR(512) UNICODE
wstrPar9 | NVARHAR(512) | VARHAR(512) UNICODE


View v_akpub_infected_item

Contains items stored in quarantine, backup, and uncured items. Supported by Administration Server v. 7 an higher.

Column name | Column type (SQL Server) | Column type (MySQL) | Description
nId | INT | INT | Identifier in DB
strItem | VARCHAR(256) | VARCHAR(256) | Item name
nHostId | INT | INT | Host id, see v_akpub_host.nId column
wstrListName NVARCHAR(256) VARCHAR(256) UNICODE List name. Following values are possible:
  • "Quarantine" - item from quarantine
  • "Backup" - backed up item
  • "TIF" - uncured item
wstrFileTitle | NVARCHAR(256) | VARCHAR(256) UNICODE | File name without path
nStatus INT INT Item status. Following values are possible:
  • 1 - Infected object
  • 2 - Warning
  • 3 - Suspicious object
  • 4 - Put to storage by user
  • 5 - False alarm
  • 6 - Object was cured
  • 7 - Object is clean
  • 8 - Object is password-protected
tmStore | DATETIME | DATETIME | UTC time when the object was put into storage
wstrVirusName | NVARCHAR(256) | VARCHAR(256) UNICODE | Name of virus
nSize | INT | INT | Object size
wstrRestorePath | NVARCHAR(1024) | VARCHAR(1024) UNICODE | Restore path
wstrUserName | NVARCHAR(256) | VARCHAR(256) UNICODE | User name
wstrDescription | NVARCHAR(1024) | VARCHAR(1024) UNICODE | Description
tmAvbasesDate | DATETIME | DATETIME | UTC time of anti-virus bases
tmSentToKL | DATETIME | DATETIME | UTC time when the object was sent to Kaspersky Lab


View v_akpub_application

Contains applications installed on controlled hosts. Supported by Administration Server v. 7 an higher.

Column name | Column type (SQL Server) | Column type (MySQL) | Description
nId | INT | INT | Id of record in DB
strProductID | VARCHAR(64) | VARCHAR(64) | Application Id
nProductId | INT | INT | Application Id in DB
bMsiInstaller | BIT | BOOL | Non-zero value if the application was installed by msi-installer
wstrDisplayName | NVARCHAR(256) | VARCHAR(256) UNICODE | Application display name
wstrBuild | NVARCHAR(256) | VARCHAR(256) UNICODE | Application build
wstrPublisher | NVARCHAR(256) | VARCHAR(256) UNICODE | Vendor name
nLangId | INT | INT | Application language id
wstrComments | NVARCHAR(256) | VARCHAR(256) UNICODE | Vendor provided comments
wstrHelpLink | NVARCHAR(256) | VARCHAR(256) UNICODE | Vendor provided help hyperlink
wstrHelpTelephone | NVARCHAR(256) | VARCHAR(256) UNICODE | Vendor provided help phone
nHostId | INT | INT | Host id, see v_akpub_host.nId column
tmInstallDate | DATETIME | DATETIME | Installation UTC time
wstrPackageCode | VARCHAR(64) | VARCHAR(64) | Package code
wstrInstallDir | NVARCHAR(256) | VARCHAR(256) UNICODE | Installation directory


View v_akpub_app_patches

Contains application patches installed on controlled hosts. Supported by Administration Server v. 7 an higher.

Column name | Column type (SQL Server) | Column type (MySQL) | Description
nId | INT | INT | Id of record in DB
strProductID | VARCHAR(64) | VARCHAR(64) | Application Id, see v_akpub_application.strProductID column
nProductId | INT | INT | Application Id in DB, see v_akpub_application.nProductId column
bMsiInstaller | BIT | BOOL | Non-zero value if the patch was installed by msi-installer
wstrDisplayName | NVARCHAR(256) | VARCHAR(256) UNICODE | Patch display name
wstrBuild | NVARCHAR(256) | VARCHAR(256) UNICODE | Patch build
wstrPublisher | NVARCHAR(256) | VARCHAR(256) UNICODE | Vendor name
wstrComments | NVARCHAR(256) | VARCHAR(256) UNICODE | Vendor provided comments
wstrHelpLink | NVARCHAR(256) | VARCHAR(256) UNICODE | Vendor provided help hyperlink
wstrHelpTelephone | NVARCHAR(256) | VARCHAR(256) UNICODE | Vendor provided help phone
nHostId | INT | INT | Host id, see v_akpub_host.nId column
wstrClassification | NVARCHAR(256) | VARCHAR(256) UNICODE | Vendor provided patch classification string
wstrMoreInfoURL | NVARCHAR(256) | VARCHAR(256) UNICODE | Vendor provided "more info" URL


Parameters for some events

Some event types.

Event type | Description
"GNRL_EV_VIRUS_FOUND" | An infected object found.
"GNRL_EV_OBJECT_CURED" | Infected object was successfully cured.
"GNRL_EV_OBJECT_DELETED" | Infected object was deleted.
"GNRL_EV_PASSWD_ARCHIVE_FOUND" | Cannot check password-protected archive for viruses.
"GNRL_EV_OBJECT_QUARANTINED" | Object was put to quarantine.
"GNRL_EV_OBJECT_NOTCURED" | Infected object was not cured.
"GNRL_EV_SUSPICIOUS_OBJECT_FOUND" | Suspicious object found.
"GNRL_EV_ATTACK_DETECTED" | Network attack was detected.

Parameters for some events are listed below.

Events (column v_akpub_ev_event.strEventType) Parameters (columns v_akpub_ev_event.wstrPar*)
  • "GNRL_EV_OBJECT_CURED"
  • "GNRL_EV_OBJECT_DELETED"
  • "GNRL_EV_PASSWD_ARCHIVE_FOUND"
  • "GNRL_EV_OBJECT_QUARANTINED"
  • "GNRL_EV_OBJECT_NOTCURED"

  • "wstrPar2" – Object name
  • "GNRL_EV_SUSPICIOUS_OBJECT_FOUND"
  • "wstrPar2" – Object name
  • "wstrPar5" – Virus name
  • "GNRL_EV_VIRUS_FOUND"
  • "wstrPar2" – Object name
  • "wstrPar5" – Virus name
  • "wstrPar7" – User name
  • "wstrPar8" – Danger type. One of following.
    • "0" – unknown or unspecified
    • "60" – Virus
    • "61" – Trojan
    • "62" – Malware
    • "63" – Backdoor
    • "64" – Worm
    • "65" – Riskware
  • "GNRL_EV_ATTACK_DETECTED"
  • "wstrPar1" – Attack name
  • "wstrPar2" – Protocol name
  • "wstrPar3" – IP-address in host byte order, for example, "2886729929" for "172.16.0.201"
  • "wstrPar4" – Port


List of product/version ids for some products

Contains host properties host.

Product | Product Id | Version Id
Kaspersky Administration Server | "1093" | "1.0.0.0"
Kaspersky Network Agent | "1103" | "1.0.0.0"
Kaspersky Anti-Virus 5.0 for Windows Workstation | "Workstation" | "5.0.0.0"
Kaspersky Anti-Virus 5.0 for Windows File Server | "Fileserver" | "5.0.0.0"
Kaspersky Anti-Virus 6.0 for Windows Workstation | "KAVWKS6" | "6.0.0.0"
Kaspersky Anti-Virus 6.0 for Windows File Server | "KAVFS6" | "6.0.0.0"
Kaspersky Anti-Virus 6.0 for Windows File Server Enterprise Edition | "KAVFSEE" | "6.0"
Kaspersky Anti-Virus 6.0 for Linux File Server | "KLIN" | "6.0.0.0"