A very simple CEF-syslog module.
The Common Event Format, or CEF, is a standard proposed by ArcSight for logging event data. This module provides a CEF formatter and logger that by default emits messages to the syslog over udp. The syslogger is pluggable, so if the default does not fit your needs, you can change it.
node-cef is intended to be used alongside other logging facilities.
Note that it doesn't actually print anything to the console or any
files by default; its sole purpose is to emit CEF strings to a syslog
npm install cef
var cef = require'cef';// Create a configuration for your application and your syslog interfacevar config =vendor: 'Steinway'product: 'Piano'version: 'B'syslog_tag: 'my-piano'syslog_facility: 'local4';var logger = config;logger.infosignature: "Bflat" name: "Out of tune";
This will emit a message like the following to the system log:
<166> Jul 18 02:16:12 my-piano CEF:0|Steinway|Piano|B|Bflat|Out of tune|4
(I don't actually own a Steinway B, but I wish I did.)
CEF requires log messages to have the following parameters:
- Vendor: A string identifying your organization
- Product: A string identifying your product
- Version: A string identifying the version of your product
- Signature: An arbitrary key identifying the type of event logged.
Typically a four-digit number.
- Name: A human-readable phrase describing the event.
- Severity: An integer between 0 (lowest) and 10 (highest severity)
Out of these six parameters, and also the CEF version number (0 at the time of this writing), A cef string of the following form will be constructed:
Additionally, any number of key-value pairs specifying extra data can be attached. Such key value pairs are referred to as extensions.
node-cef logger can be instantiated with any number of default
parameters, with the various logging methods specifying the remaining
required parameters. For example:
// Application configvar logger =vendor: "Initech"product: "Stapler"version: 2;logger.warnsignature: 42name: "Attempted theft detected"extensions:suser: "Milton"solution: "Burn it down!";
Will log the following:
CEF:0|Initech|Stapler|2|42|Attempted theft detected|6|suser=Milton solution=Burn it down!
CEF defines 11 levels (0 to 10, lowest to highest); syslog defines
eight levels (7 to 0, debug to emerg). To align these two, we declare
CEF 11 to be equivalent to syslog
emerg (0), CEF 10 = syslog
and so on to CEF 3 = syslog
debug (7). We do not use CEF levels 2, 1,
node-cef logger has methods named after the syslog severities:
notice()(the default level for calling
We suggest you decide with your team on a set of meanings and stick with them. For example, for logging BrowserID events at Mozilla, we use four levels as follows:
emerg(10) Completely out of whack. Someone needs to look at this. Harm to the application, user account, or system security could have taken place.
alert(8) Suspicious activity or application has non-validated user input. Impact is not known.
warn(6) Normal security application stuff, login failures, password changes.
info(4) Normal app activity. Logins and various kinds of transactions.
node-cef uses a udp syslog transport. You can configure
the transport with the following options to the
syslog_tag: The name of your app to appear in the syslog. Default is
__filename, which you probably want to change.
syslog_facility: One of the facility names or numbers as defined in RFC 3164. Default is
syslog_address: IP address of the syslog service. Default is
syslog_port: Port for the syslog service. Default is
syslog_transport: A function taking two arguments:
callback. By default, this is a udp4 transport using the address and port described above.
Within the transport function, address and port are available as
this.port. You could specify a transport using
some custom service like so:
syslog_address: '192.168.1.42'syslog_port: 9876myCustomServicesendmessagethisportthisaddresscallback;
Tests are written using vows.
npm test to run the test suite. You may have to run
npm install first.