Configuring Syslog; Syslog Message Format - AudioCodes Mediant 500L User Manual

User's Manual
60.2

Configuring Syslog

This section describes how to configure Syslog. To filter Syslog messages, see
''Configuring Log Filter Rules'' on page 953.

60.2.1 Syslog Message Format

The Syslog message is sent from the device to a Syslog server as an ASCII (American
Standard Code for Information Interchange) message. Syslog uses UDP as its underlying
transport layer mechanism. By default, UDP port 514 is assigned to Syslog, but this can be
changed (see ''Enabling Syslog'' on page 964).
Syslog includes two types of log messages:

SIP call session logs: Logs relating to call sessions (e.g., call established). These logs
are identified by a session ID ("SID"), described in detail in the table below. The
following is an example of a SIP-session related Syslog message:
13:10:57.811 : 10.13.4.12 : NOTICE
(lgr_flow)(63)
address 10.33.2.42:5060 [Time: 04-19-2012@18:29:39]

Board logs: Logs relating to the operation of the device (infrastructure) that are non-
call session related (e.g., device reset or Web login). These logs are identified by a
board ID ("BID"), described in detail in the table below. The following is an example of
a board Syslog message:
10:21:28.037 : 10.15.7.95 : NOTICE
Activity Log: WEB: Successful login at 10.15.7.95:80. User:
Admin. Session: HTTP (10.13.22.54)
The format of the Syslog message is described in the following table below:
Message Item
Message Types
Message Sequence Number
[S=<number>]
Version 7.2
UdpTransportObject#0- Adding socket event for
Table 60-3: Syslog Message Format Description
Syslog generates the following types of messages:

ERROR: Indicates that a problem has been identified that
requires immediate handling.

WARNING: Indicates an error that might occur if measures are
not taken to prevent it.

NOTICE: Indicates that an unusual event has occurred.

INFO: Indicates an operational message.

DEBUG: Messages used for debugging.
Note:

The INFO and DEBUG messages are required only for advanced
debugging and by default, they are not sent by the device.

When viewing Syslog messages in the Web interface, these
message types are color coded.
By default, Syslog messages are sequentially numbered in the
format [S=<number>], for example, "[S=643]". A skip in the number
sequence of messages indicates a loss of message packets. For
example, in the below Syslog, messages 238 through 300 were not
received. In other words, 63 Syslog messages were lost (the
sequential numbers are indicated below in bold font):
18:38:14. 52 : 10.33.45.72 : NOTICE:
[S=235][SID:2ed1c8:96:5] (lgr_psbrdex)(619) recv
60. Syslog and Debug Recording
: [S=235][SID:2ed1c8:96:5]
: [S=872] [BID=3aad56:32]
Description
959 Mediant 500L Gateway & E-SBC