Configuring Reporting Of Management User Activities - AudioCodes E-SBC User Manual

CHAPTER 58 Syslog and Debug Recording
2. From the 'VoIP Debug Level' [GwDebugLevel] drop-down list, select the debug level of Syslog
messages:
● No Debug: Disables Syslog and no Syslog messages are sent.
● Basic: Sends debug logs of incoming and outgoing SIP messages.
● Detailed: Sends debug logs of incoming and outgoing SIP message as well as many other
logged processes.
3. From the 'Syslog Optimization' [SyslogOptimization] drop-down list, select whether you want
the device to accumulate and bundle multiple debug messages into a single UDP packet
before sending it to a Syslog server. The benefit of the feature is that it reduces the number of
UDP Syslog packets, thereby improving (optimizing) CPU utilization. The size of the bundled
message is configured by the [MaxBundleSyslogLength] parameter.
4. From the 'Syslog CPU Protection' [SyslogCpuProtection] drop-down list, select whether you
want to enable the protection feature for the device's CPU resources during debug reporting,
ensuring voice traffic is unaffected. If CPU resources drop (i.e., high CPU usage) to a critical
level (user-defined threshold), the device automatically lowers the debug level to free up CPU
resources that were required for the previous debug-level functionality. When CPU resources
become available again, the device increases the debug level to its' previous setting. For
example, if you set the 'Debug Level' to Detailed and CPU resources decrease to the defined
threshold, the device automatically changes the level to Basic, and if that is not enough, it
changes the level to No Debug. Once CPU resources are returned to normal, the device
automatically changes the debug level back to its' original setting (i.e., Detailed). The
threshold is configured by the [DebugLevelHighThreshold] parameter.
5. Click Apply.

Configuring Reporting of Management User Activities

The device can report operations (activities) performed in the device's management interfaces
(e.g., Web and CLI) by management users, in Syslog messages. The Syslog message indicates
these logs with the string "Activity Log". Each logged user activity includes the following
information:
■ Username (e.g., "Admin") of the user that performed the action
■ IP address of the client PC from where the Web user accessed the management interface
■ Protocol used for the session (e.g., SSH or HTTP)
The following example shows a Web-user activity log (indicating a login action) with the above-
mentioned information:
14:07:46.300 : 10.15.7.95 : Local 0 :NOTICE : [S=3149] [BID=3aad56:32] Activity Log:
WEB: Successful login at 10.15.7.95:80. User: Admin. Session: HTTP (10.13.22.54)
The device can report the following user activities:
■ Modifications of individual parameters, for example:
14:33:00.162 : 10.15.7.95 : Local 0 :NOTICE : [S=3403] [BID=3aad56:32] Activity
Log: Max Login Attempts was changed from '3' to '2'. User: Admin. Session: HTTP
(10.13.22.54)
■ Modifications of table fields, and addition and deletion of table rows, for example:
Mediant 1000 Gateway & E-SBC | User's Manual
- 1048 -