Configuring Syslog; Syslog Message Format - AudioCodes Mediant 800B User Manual

Wireshark-like filtering expressions for your IP trace. The following Wireshark-like
expressions are supported:
Table 60-2: Supported Wireshark-like Expressions for 'Value' Parameter
Expression
ip.src, ip.dst
ip.addr
ip.proto
udp, tcp, icmp, sip, ldap, http, https
udp.port, tcp.port
udp.srcport, tcp.srcport
udp.dstport, tcp.dstport
and, &&, ==, <, >
Below are examples of configured expressions for the 'Value' parameter:

udp && ip.addr==10.8.6.55

ip.src==10.8.6.55 && udp.port>=5000 and udp.port<6000

ip.dst==10.8.0.1/16

ip.addr==10.8.6.40
For conditions requiring the "or" / "||" expression, add multiple table rows. For example, the
Wireshark condition "(ip.src == 1.1.1.1 or ip.src == 2.2.2.2) and ip.dst == 3.3.3.3" can be
configured using the following two table row entries:
1. ip.src == 1.1.1.1 and ip.dst == 3.3.3.3
2. ip.src == 2.2.2.2 and ip.dst == 3.3.3.3
Note:
•
If the 'Value' parameter is undefined, the device records all IP traffic types.
•
You cannot use ip.addr or udp/tcp.port together with ip.src/dst or
udp/tcp.srcport/dstport. For example, "ip.addr==1.1.1.1 and ip.src==2.2.2.2" is an
invalid configuration value.
60.2

Configuring Syslog

This section describes how to configure Syslog. To filter Syslog messages, see
'Configuring Log Filter Rules' on page 925.

60.2.1 Syslog Message Format

The Syslog message is sent from the device to a Syslog server as an ASCII (American
Standard Code for Information Interchange) message. Syslog uses UDP as its underlying
transport layer mechanism. By default, UDP port 514 is assigned to Syslog, but this can be
changed (see 'Enabling Syslog' on page 936).
Syslog includes two types of log messages:

SIP call session logs: Logs relating to call sessions (e.g., call established). These logs
User's Manual
Source and destination IP address
IP address - up to two IP addresses can be entered
IP protocol type (PDU) entered as an enumeration value
(e.g., 1 is ICMP, 6 is TCP, 17 is UDP)
Single expressions for protocol type
Transport layer
Transport layer for source port
Transport layer for destination port
Between expressions
930
Mediant 800B Gateway & E-SBC
Description
Document #: LTRT-10298