ryanbreed/cef — Issue #1: wrong order of fields in syslog header
Author: klasen
Created: 2012-02-09 08:27:40+00:00
State: open

According to RFC 3164 and the referenced Arcsight document, TIMESTAMP must precede the HOSTNAME field:

--- /home/norbert/src/cef/lib/cef/event.rb 2012-01-13 12:13:22.000000000 +0100
+++ /usr/lib64/ruby/gems/1.8/gems/cef-0.8.0/lib/cef/event.rb 2012-02-08 17:03:21.000000000 +0100
@@ -35,8 +35,8 @@

cef_message=CEF::PREFIX_FORMAT % [
syslog_pri.to_s,
- my_hostname,
log_time,
+ my_hostname,
format_prefix,
format_extension
]

(Note: According to both documents, TIMESTAMP does not include the year either)