CEF log message format

MetaDefender Email Gateway Security supports sending log messages in CEF (Common Event Format) to local or remote syslog servers.

Common Event Format (CEF) is an extensible, text-based format designed to support multiple device types by offering the most relevant information. Message syntaxes are reduced to work with ESM normalization. CEF specifically defines a syntax for log records containing a standard header and a variable extension, formatted as key-value pairs.

CEF is a text-based log format developed by ArcSight™ and used by HP ArcSight™ products. It uses syslog as transport. The full format includes a syslog header or "prefix", a CEF "header", and a CEF "extension". The extension contains a list of key-value pairs. Standard key names are provided, and user-defined extensions can be used for additional key names. In some cases, the CEF format is used with the syslog header omitted.

CEF message structure
Copy

The following example shows a message received locally.

Local message example
Copy

The syslog prefix is in the following structure in the example:

Example syslog prefix structure
Copy

The syslog prefix value is:

Example syslog prefix value
Copy

While the extension for the above example was:

Example extension
Copy

The following example shows the message received by a remote log server. Please note the additional syslog prefix added to the original local syslog prefix by the receiving syslog server.

Remote message example
Copy

Header field definitions

HeaderEmail Gateway Security valuesExamples
CEF VersionCEF:0
Severity
  • DUMP (0): The most verbose severity level, these entries are for debuggers only.
  • DEBUG (1): Debuggers severity level, mostly used by support issues.
  • INFO (2): Information from the software, such as scan results.
  • WARNING (3): A problem occurred needs investigation and OPSWAT support must be contacted, however the product is supposed to be operational.
  • ERROR (4): Software error happened, please contact support if the issue is persist. Software functionality may be downgraded in these cases.
Device Event Class IDSource module of the messagecommon.workflow
Device ProductMDEMAIL
Device VendorOPSWAT
Device VersionEmail Gateway Security product version5.7.5
NameLog messageExecuting Workflow

Extension field

The Extension field contains a collection of key-value pairs in the structure key=value. An event can contain any number of key-value pairs in any order, separated by spaces (" ").

The extension provides additional details about the event covered by the message.

Example extension
Copy

For further details about CEF see https://www.microfocus.com/documentation/arcsight/arcsight-smartconnectors-8.4/pdfdoc/cef-implementation-standard/cef-implementation-standard.pdf.

Type to search, ESC to discard
Type to search, ESC to discard
Type to search, ESC to discard
Next to read:
SOC log level
On This Page
CEF log message formatHeader field definitionsExtension field