Content and properties of syslog messages in CEF format
July 10, 2024
ID 151684
Information about each detected event is relayed as a separate syslog message in CEF format with UTF-8 encoding.
A message in CEF format consists of a message body and header. Each Syslog message contains the following fields defined by the Syslog protocol settings in the operating system:
- Date and time of the event
- Name of the host where the event occurred
- Name of the application (always
KSMG)
Syslog event message fields defined by the application settings have the <key>="<value>" format. If a key has multiple values, these values are separated with a comma. Keys are separated by a colon.
The keys and their values contained in a message depend on the specific class of the event.
Example:
|
The maximum size of a syslog message about a detected event depends on the values of syslog settings on the server on which KSMG is installed.
