SIEM Log Ingest - Log File Field Definitions

ColdFusion makes use of the following configuration files to define and format its log files:

C:\ColdFusion2021\cfusion\lib\log4j.properties (As you can tell, ColdFusion uses Log4j)

C:\ColdFusion2021\cfusion\lib\logger.xml

C:\ColdFusion2021\cfusion\lib\logging.properties

C:\ColdFusion2021\cfusion\lib\neo-logging.xml

You're embarking on an interesting trek, Greg. Let me share some "thoughts from the trail". 

First, to be clear, there are no "field headers" for CF logs (which is its own challenge for any log ingestion). No cf logs have them as their first line to identify cols, nor are they available separately. 

But maybe you meant simply, "fields", and as such you'd be OK with a mere discussion somewhere of what cols are in each log file. I'm not aware of that, either.

Even then, the next challenge is that cf's logs are not all csv formatted, etc. with one line per event. Some cf logs have multiple lines per event--without any identifier to connect the multiple lines together. That will be especially challenging. But of course some log ingestion tools will try to handle that. (But being a multi-threaded app server, log lines for multiple events could be written at once, interleaving with one another. Grr. ) 

As for the coldfusion-out.log in particular, it can be valuable as the console log, but it also aggregates most of the other cf logs, which adds to the burden of that last challenge, with still more things "interleaved".

Last, as for the "S" in seim, there's precious little about security specifically that's logged by cf. There's no specific security log, nor even security-specific entries in most of the cf logs.  To be sure, cf does logs

quite a bit--in its several different logs--just little that would seem really to serve an seim solution well.

But perhaps someone else, including yourself, may have a different perspective. 

In conclusion it bears noting that like many older apps, cf has been doing some things "its way" for decades. And while SOME facets of cf have indeed kept up with the times, this (modern logging practices) is one of those areas that has NOT gotten the attention it deserves. Perhaps you could help spark that. You could file feature requests at tracker.adobe.com, as you may trip over things. 

I will say finally, Greg, that if you want more direct help, I work with the cf logs daily in assisting people in troubleshooting as an independent consultant, so I know them very well. Just as I work with them in as little as 15 mins, I could help you as well if you may prefer more direct assistance.