Logging Fields

This document attempts to capture a common field dictionary for use in structured logs.

By adhering to this dictionary, logs generated by district parties are able to interoperate cleanly.

Updates

Please send Pull Requests with your own updates! This is a community resource!

Origin

The initial list was taken from the Lumberjack project. It represents a common and already in use list of fields.

Types

• String: A freeform string, no formatting assumed
• Object: A separate set of key/value pairs
• Integer: An integer value. These maybe represented as JSON numbers or JSON strings.
• IPv4: An IPv4 address formatted as a string in typical dotted quad syntax.
• IPv6: An IPv6 address formatted as a string in typical colon syntax.
• DateTime: A date and time formatted as a string in ISO 8601 syntax.

Fields

Object	Name	Type	Description
	action	STRING	Primary event action or operation
	app	OBJECT	Application
	appname	STRING	Name of the application that generated the event
	auid	STRING	Source User login authentication ID (login id)
	cmd	STRING	Command
	domain	STRING	Source user domain (NT Domain)
	dst	OBJECT	Network destination
	egid	STRING	Source user group effective ID (egid)
	eid	STRING	Source user effective ID (euid)
	file	OBJECT	File information
	host	STRING	Hostname of the event source
	ipv4	IPV4	IPv4 address of the event source
	ipv6	IPV6	IPv6 address of the event source
	message	STRING	The event message
	msgid	STRING	The event message identifier
	pid	STRING	Process ID that generated the event
	pname	STRING	Process name that generated the event
	pri	STRING	Event priority ("ERROR"
	proc	OBJECT	Process
	profile	STRING	CEE Profile URI that describes the custom event
	profilever	STRING	CEE Profile version
	sev	NUMBER	Event severity
	src	OBJECT	Network source
	status	STRING	Event status ("SUCCESS"
	subsys	STRING	Application subsystem responsible for generating the event
	syslog	OBJECT	Syslog compatibility
	tid	NUMBER	Numeric thread ID associated with the process generating the event
	time	DATETIME	Event Start Time
	uid	STRING	Source user account ID (uid)
	user	OBJECT	User account
	username	STRING	Source user name
	vend	STRING	Vendor of the event source application
	ver	STRING	Application version of the event source application
app	name	STRING	Application name
app	vend	STRING	Application vendor
app	ver	STRING	Application version
dst	host	STRING	Network destination hostname
dst	ipv4	IPV4	Network destination IPv4 address
dst	ipv6	IPV6	Network destination IPv6 address
dst	port	NUMBER	Network destination port
file	hashmd5	STRING	File MD5 Hashsum
file	line	NUMBER	File line number
file	mode	STRING	File mode flags
file	name	STRING	File name
file	path	STRING	File system path
file	perm	STRING	File permissions
file	size	NUMBER	File size in octets
proc	id	STRING	Process ID (pid)
proc	name	STRING	Process name
proc	tid	NUMBER	Thread identifier of the process
src	host	STRING	Network source hostname
src	ipv4	IPV4	Network source IPv4 address
src	ipv6	IPV6	Network source IPv6 address
src	port	NUMBER	Network source port
syslog	fac	NUMBER	Syslog facility value
syslog	pri	NUMBER	Syslog priority value
syslog	tag	STRING	Syslog Tag value
syslog	ver	NUMBER	Syslog Protocol version (0=legacy/RFC3164; 1=RFC5424)
user	domain	STRING	User account domain (NT Domain)
user	gid	STRING	Group ID (gid)
user	group	STRING	Group name
user	id	STRING	User account ID (uid)
user	name	STRING	User account name