fx_probe_refresh rebuilds the probe relations from the live system (or a fixture root for tests) inside a single transaction: delete-all existing tuples, then add fresh. fx-init is the sole writer of the runtime DB, so the probe is the only thing that populates these relations.
| Relation | Columns |
|---|---|
| process | pid, ppid, uid, comm, state, rss_kb. |
| fs | path, fstype, total_kb, used_kb, avail_kb. |
| file | path, size, mode, uid, gid, mtime. |
| device | name, major, minor, type, size. |
| kernel | version, release, hostname, uptime_s, load1_x100, mem_total_kb, mem_free_kb. |
| net | iface, addr, mac, state, rx_bytes, tx_bytes. |
| env | key, value. |
The log DB is a separate datalog DB from the runtime DB, held for life by fx-init. Its single relation is log(ts_epoch_s, svc, level, msg). The svc, level and msg strings are interned via dl_intern_str, so repeated text collapses to one symbol — the DAFSA shared-suffix store means a thousand copies of the same log line cost one message plus a thousand small tuples.
Service stdout/stderr is piped to init and drained line-buffered into the log DB, so a service's output is searchable through fxctl alongside init's own status lines.
Two search modes over the same log DB, both streamed to the fxctl caller as ts<TAB>svc<TAB>level<TAB>msg lines. grep runs a regex walk; search tokenizes terms and uses the auxiliary __postings__(term, msg) index for a full-text AND query.
The log DB rotates: when it exceeds the cap (default 100 000 tuples) fx-init drops the oldest quarter by timestamp, so the log stays bounded without losing recent history.