The following will get you basic set up that will allow you to generate cadf messages within ceilometer from keystone. This should be considered a work in progress guide and therefore open to expansion.  

1. Grab devstack:

    git clone https://git.openstack.org/openstack-dev/devstack

2. Set up a local.conf

    [[local|localrc]]
    HOST_IP=192.168.0.48
    FLOATING_RANGE=192.168.0.224/27
    FIXED_RANGE=10.11.12.0/24
    FIXED_NETWORK_SIZE=256
    FLAT_INTERFACE=eth0
    enable_plugin ceilometer https://git.openstack.org/openstack/ceilometer.git
    SERVICE_TOKEN=cadftest
    SERVICE_TOKEN=p6ssw0rd
    ADMIN_PASSWORD=p6ssw0rd
    MYSQL_PASSWORD=p6ssw0rd
    RABBIT_PASSWORD=p6ssw0rd
    SERVICE_PASSWORD=p6ssw0rd
    LOGFILE=/opt/stack/logs/stack.sh.log
    LIBS_FROM_GIT=python-keystoneclient,python-openstackclient

3 . After devstack completes, edit keystone.conf and make (or amend!) the following

    notification_format = cadf
    notification_driver = messaging
    notification_driver = log 

Note: For Liberty the formatting has changed, and now exists as follows

    driver = messaging
    driver = log

The above enables logging to both ceilometer and keystones log file (apache log)

Generate an event

4. Source admin credentials
    . openrc admin admin

5. Create a user in keystone (so we create a CADF audit event)

    openstack user create cadf_test --os-identity-api-version 3 --os-auth-url http://<your_ip>:5000/v3 --os-default-domain default

6. Last of all, let's view the event

    ceilometer event-list --query event_type=identity.user.created

===== Useful Links =====

[[http://docs.openstack.org/admin-guide-cloud/telemetry-measurements.html|Telemetry Events]]

To call each event:

    ceilometer event-list --query event_type=<event>

e.g.

    ceilometer event-list --query event_type=identity.project.created