### Author:  [@guiguiabloc](https://community.graylog.org/u/guiguiabloc)
#### Post date: [December 3, 2019, 3:56pm UTC](https://community.graylog.org/t/graylog-3-1-cef-udp-checkpoint/13052/1 "2019-12-03T15:56:51Z")
Since migrate to Graylog 3.1, the CEF UDP input was unbale to decode message (works fine in 2.4).
Error message
```auto
2019-12-03T16:52:09.226+01:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=dcf8ef90-15e4-11ea-b6a8-0050568a1266, journalOffset=-9223372036854775808, codec=CEF, payloadSize=19, timestamp=2019-12-03T15:52:09.225Z, remoteAddress=/10.145.24.247:38344}
java.lang.NullPointerException: null
at org.graylog.plugins.cef.parser.MappedMessage.(MappedMessage.java:37) ~[graylog.jar:?]
at org.graylog.plugins.cef.codec.CEFCodec.decodeCEF(CEFCodec.java:128) ~[graylog.jar:?]
at org.graylog.plugins.cef.codec.CEFCodec.decode(CEFCodec.java:117) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:150) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:91) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:86) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:45) [graylog.jar:?]
at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_222]
```
The message come from Checkpoint Firewall
CEF:0|Check Point|VPN-1 & FireWall-1|Check Point|Log|sqlnet1|Unknown|act=Drop deviceDirection=0 rt=1575387805000 spt=51690 dpt=1521 cs2Label=Rule Name layer\_name=Prod\_fw Security layer\_uuid=927f269b-52dd-4cab-8550-7aeffda6ca02 match\_id=4019 parent\_rule=0 rule\_action=Drop rule\_uid=3e517596-1229-c34a-86e4-ab3a7f3ff752 ifname=bond1.45 logid=0 loguid={0x0,0x0,0x0,0x0} origin=10.254.4.203 originsicname=CN=fw,O=fw.net.m9ug26 sequencenum=292 version=5 dst=10.140.27.121 inzone=Internal outzone=Internal product=VPN-1 & FireWall-1 proto=6 service\_id=sqlnet1 src=10.241.45.1
The CEF message seem correct š
Any idea ?
Thx
---
### Author:  [@jan](https://community.graylog.org/u/jan)
#### Post date: [December 6, 2019, 4:21pm UTC](https://community.graylog.org/t/graylog-3-1-cef-udp-checkpoint/13052/2 "2019-12-06T16:21:50Z")
he @guiguiabloc
at least the key=value part you provide is nearly not parsable by any automation. The values hold spaces, what is also the delimiter for key and the previous value ā¦ If that is really your CEF message, ingest that into a RAW input and use the processing pipeline to work on this kind of messages.
---
### Author:  [@guiguiabloc](https://community.graylog.org/u/guiguiabloc)
#### Post date: [December 6, 2019, 9:37pm UTC](https://community.graylog.org/t/graylog-3-1-cef-udp-checkpoint/13052/3 "2019-12-06T21:37:19Z")
Hi @jan
iām surprised by your answer.
This message was parsable in graylog 2.4 on a CEF input.
The CEF format allow space in value (see ArcSight commont Event Format Implementation Standard [https://community.microfocus.com/t5/ArcSight-Connectors/ArcSight-Common-Event-Format-CEF-Implementation-Standard/ta-p/1645557](https://community.microfocus.com/t5/ArcSight-Connectors/ArcSight-Common-Event-Format-CEF-Implementation-Standard/ta-p/1645557))
The original message is coming from a Chekpoint firewall. I think that checkpoint correctly implement the CEF Format.
---
### Author:  [@jan](https://community.graylog.org/u/jan)
#### Post date: [December 8, 2019, 11:52am UTC](https://community.graylog.org/t/graylog-3-1-cef-udp-checkpoint/13052/4 "2019-12-08T11:52:39Z")
he @guiguiabloc
I do not have that device available - my guessing was based on a first manual scan of the message you have provided.
Should the same message be parsed on a different Graylog Version without any problems and now has a problem, please open a bug report over at GitHub that makes this visible.
> **[Graylog2/graylog2-server](https://github.com/Graylog2/graylog2-server/issues)**
>
> Free and open source log management. Contribute to Graylog2/graylog2-server development by creating an account on GitHub.
---
### Author:  [@guiguiabloc](https://community.graylog.org/u/guiguiabloc)
#### Post date: [December 8, 2019, 12:42pm UTC](https://community.graylog.org/t/graylog-3-1-cef-udp-checkpoint/13052/5 "2019-12-08T12:42:01Z")
hi @jan
thanks for your answer.
I already opened a bug report on github some days ago.
---
### Author:  [@jan](https://community.graylog.org/u/jan)
#### Post date: [December 8, 2019, 2:07pm UTC](https://community.graylog.org/t/graylog-3-1-cef-udp-checkpoint/13052/6 "2019-12-08T14:07:48Z")
for reference:
>
>
> Since migrate to Graylog 3.1, the CEF UDP input was unable to decode message (works fine in 2.4).
> Expected Behavior
> Decode CEF Message...
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [December 22, 2019, 2:07pm UTC](https://community.graylog.org/t/graylog-3-1-cef-udp-checkpoint/13052/7 "2019-12-22T14:07:54Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.