Syslog And Debug Recording; Configuring Log Filter Rules - AudioCodes Mediant 1000B User Manual

User's Manual
52

Syslog and Debug Recording

For debugging and troubleshooting, you can use the device's Syslog and/or Debug
Recording capabilities:

Syslog: Syslog is an event notification protocol that enables a device to send event
notification messages across IP networks to event message collectors, also known as
Syslog servers. The device contains an embedded Syslog client, which sends error
reports / events that it generates to a remote Syslog server using the IP / UDP
protocol. This information is a collection of error, warning, and system messages that
records every internal operation of the device.

Debug Recording: The device can send debug recording packets to a debug
capturing server. When the debug recording is activated, the device duplicates all
messages that are sent and/or received by it and then sends them to an external
server defined by IP address. The debug recording can be done for different types of
traffic such as RTP/RTCP, T.38, ISDN, CAS, and SIP. Debug recording is used for
advanced debugging when you need to analyze internal messages and signals.
Debug recording is also useful for recording network traffic in environments where hub
or port mirroring is unavailable and for recording internal traffic between two endpoints
on the same device.
Note:
Filter Rules' on page 839).
52.1

Configuring Log Filter Rules

The Logging Filters table lets you configure up to 60 rules for filtering debug recording (DR)
packets, Syslog messages, and Call Detail Records (CDR). The log filter determines the
calls for which you want to generate DR packets, Syslog messages or CDRs. For example,
you can add a rule to generate Syslog messages only for calls belonging to IP Groups 2
and 4, or for calls belonging to all IP Groups except for IP Group 3. You can also configure
log filters for generating CDRs only and saving them on the device (local storage). DR log
filters can include signaling information such as SIP messages, Syslog messages, PSTN
traces (ISDN and CAS), CDRs, media (RTP, RTCP, and T.38), and pulse-code modulation
(PCM) of voice signals from and to the TDM.
If you don't configure any rules in the Logging Filters table and you have enabled DR,
Syslog, and/or CDR generation (done by simply configuring an IP address for the relevant
servers - see Note below), logs are generated for all calls. Thus, the benefit of log filtering
is that it allows you to create logs per specific calls, eliminating the need for additional
device resources (CPU consumption), otherwise required when logs are generated for all
calls.
You can enable and disable configured Logging Filter rules. Enabling a rule activates the
rule, whereby the device starts generating the DR packets, Syslog messages, or CDRs.
Disabling a rule is useful, for example, if you no longer require the rule, but may need it in
the future. Thus, instead of deleting the rule entirely, you can simply disable it.
Notes:
•
If you want to configure a Logging Filter rule that logs Syslog messages to a
Syslog server (i.e., not to a Debug Recording server), you must enable Syslog
functionality, using the 'Enable Syslog' (EnableSyslog) parameter (see ''Enabling
Syslog'' on page 848). Enabling Syslog functionality is not required for rules that
Version 7.0
You can include Syslog messages in debug recording (see 'Configuring Log
52. Syslog and Debug Recording
835 Mediant 1000B Gateway and E- SBC