LEEF System Logs
|
LEEF Key
|
Description
|
Value
|
|
Header (timestamp)
|
Local time in the format: "Mmm dd
hh:mm:ss"
|
Example: Dec 5 05:26:45
|
|
Header (host)
|
Hostname without the domain information
|
Example: internalAP1
|
|
Header (logVer)
|
LEEF format version
|
LEEF: 1.0
|
|
Header (vendor)
|
Appliance vendor
|
Trend Micro |
|
Header (pname)
|
Appliance product
|
Deep Discovery Email Inspector |
|
Header (pver)
|
Appliance version
|
Example: 5.1.0.1110
|
|
Header (eventName)
|
Event Name
|
PRODUCT_UPDATE
SYSTEM_EVENT
|
|
deviceGUID
|
Appliance GUID
|
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
|
|
devTime
|
Log generation time
|
Example: Jan 28 2015 02:00:36 GMT+00:00
|
|
devTimeFormat
|
Time format
|
MMM dd yyyy HH:mm:ss z
|
|
dvc
|
Appliance IP address
|
Example: 10.1.144.199
|
|
dvchost
|
Appliance host name
|
Example: localhost
|
|
dvcmac
|
Appliance MAC address
|
Example: 00:0C:29:6E:CB:F9
|
|
msg
|
Event description
|
Example: Scheduled update - Unable to download Script Analyzer
Pattern.
|
|
operationId
|
Event ID
|
|
|
sev
|
Severity
|
3
|
 |
NoteWhen using the LEEF log syntax, separate event attributes with \0x09 as
a tab delimiter.
|
Log sample:
May 15 16:00:47 localhost LEEF:1.0|Trend Micro|Deep Discovery Email Inspector|2.5.1.1161|SYSTEM_EVENT|sev=3\0x09deviceGUID =e57f0651-b197-42d4-a643-271c1277b5ff\0x09devTime=Apr 13 2015 06:52:00 GMT+00:00\0x09msg=Logout: 'admin' logged off\0x09dv cmac=B0:83:FE:DD:21:98\0x09devTimeFormat=MMM dd yyyy HH:mm:ss z\0x09dvchost=internalbeta.tapping.ddei\0x09dvc=10.204.253.1 63\0x09operationId=30000