CEF log message format

MetaDefender Email Gateway Security supports sending log messages in CEF (Common Event Format) to local or remote syslog servers.

Common Event Format (CEF) is an extensible, text-based format designed to support multiple device types by offering the most relevant information. Message syntaxes are reduced to work with ESM normalization. CEF specifically defines a syntax for log records containing a standard header and a variable extension, formatted as key-value pairs.

CEF is a text-based log format developed by ArcSight™ and used by HP ArcSight™ products. It uses syslog as transport. The full format includes a syslog header or "prefix", a CEF "header", and a CEF "extension". The extension contains a list of key-value pairs. Standard key names are provided, and user-defined extensions can be used for additional key names. In some cases, the CEF format is used with the syslog header omitted.

The following example shows a message received locally.

The syslog prefix is in the following structure in the example:

The syslog prefix value is:

While the extension for the above example was:

The following example shows the message received by a remote log server. Please note the additional syslog prefix added to the original local syslog prefix by the receiving syslog server.

Header field definitions

Extension field

The Extension field contains a collection of key-value pairs in the structure key=value. An event can contain any number of key-value pairs in any order, separated by spaces (" ").

The extension provides additional details about the event covered by the message.

For further details about CEF see https://www.microfocus.com/documentation/arcsight/arcsight-smartconnectors-8.4/pdfdoc/cef-implementation-standard/cef-implementation-standard.pdf.