Syslog And Debug Recording; Configuring Log Filter Rules - AudioCodes Mediant 1000 User Manual

User's Manual
55

Syslog and Debug Recording

For debugging and troubleshooting, you can use the device's Syslog and/or Debug
Recording capabilities:

Syslog: Syslog is an event notification protocol that enables a device to send event
notification messages across IP networks to event message collectors, also known as
Syslog servers. The device contains an embedded Syslog client, which sends error
reports / events that it generates to a remote Syslog server using the IP / UDP
protocol. This information is a collection of error, warning, and system messages that
records every internal operation of the device.

Debug Recording: The device can send debug recording packets to a debug
capturing server. When the debug recording is activated, the device duplicates all
messages that are sent and/or received by it and then sends them to an external
server defined by IP address. The debug recording can be done for different types of
traffic such as RTP/RTCP, T.38, ISDN, CAS, and SIP. Debug recording is used for
advanced debugging when you need to analyze internal messages and signals.
Debug recording is also useful for recording network traffic in environments where hub
or port mirroring is unavailable and for recording internal traffic between two endpoints
on the same device.
Note:
Filter Rules'' on page 881).
55.1

Configuring Log Filter Rules

The Logging Filters table lets you configure up to 60 rules for filtering debug recording
packets, Syslog messages, and Call Detail Records (CDR). The log filter determines the
calls for which you want to generate debug recording packets, Syslog messages or CDRs.
For example, you can add a rule to generate Syslog messages only for calls belonging to
IP Groups 2 and 4, or for calls belonging to all IP Groups except IP Group 3. You can also
configure log filters for generating CDRs only and saving them on the device (local
storage). Debug recording log filters can include signaling information (such as SIP
messages), Syslog messages, PSTN traces (ISDN and CAS), CDRs, media (RTP, RTCP,
and T.38), and pulse-code modulation (PCM) of voice signals from and to the TDM.
If you don't configure any rules in the Logging Filters table and you have globally enabled
debug recording (by configuring the Debug Recording server's address - see Note below),
Syslog (global parameter - see Note below), and/or CDR generation (global parameter for
enabling Syslog - see Note below), logs are generated for all calls. Thus, the benefit of log
filtering is that it allows you to create logs per specific calls, eliminating the need for
additional device resources (CPU consumption) otherwise required when logs are
generated for all calls.
You can enable and disable configured Log Filter rules. Enabling a rule activates the rule,
whereby the device starts generating the debug recording packets, Syslog messages, or
CDRs. Disabling a rule is useful, for example, if you no longer require the rule, but may
need it in the future. Thus, instead of deleting the rule entirely, you can simply disable it.
Version 7.2
You can include Syslog messages in debug recording (see ''Configuring Log
55. Syslog and Debug Recording
881 Mediant 1000B Gateway & E-SBC