Syslog Message Format - AudioCodes Mediant 4000 SBC User Manual

CHAPTER 52 Syslog and Debug Recording

Syslog Message Format

The Syslog message is sent from the device to a Syslog server as an ASCII (American Standard
Code for Information Interchange) message. Syslog uses UDP as its underlying transport layer
mechanism. By default, UDP port 514 is assigned to Syslog, but this can be changed (see
Enabling Syslog).
Syslog includes two types of log messages:
■ SIP call session logs: Logs relating to call sessions (e.g., call established). These logs are
identified by a session ID ("SID"), described in detail in the table below. The following is an
example of a SIP-session related Syslog message:
13:10:57.811 : 10.13.4.12 : NOTICE : [S=235][SID:2ed1c8:96:5] (lgr_flow)(63)
UdpTransportObject#0- Adding socket event for address 10.33.2.42:5060 [Time: 04-19-
2012@18:29:39]
■ Board logs: Logs relating to the operation of the device (infrastructure) that are non-call session
related (e.g., device reset or Web login). These logs are identified by a board ID ("BID"),
described in detail in the table below. The following is an example of a board Syslog message:
10:21:28.037 : 10.15.7.95 : NOTICE : [S=872] [BID=3aad56:32] Activity Log: WEB:
Successful login at 10.15.7.95:80. User: Admin. Session: HTTP (10.13.22.54)
The format of the Syslog message is described in the following table below:
Message Item
Message
Severity Types
Message
Sequence
Number
[S=<number>]
Table 52-3: Syslog Message Format Description
Syslog generates the following types of messages based on severity
level:
■ ERROR: Indicates that a problem has been identified that requires
immediate handling.
■ WARNING: Indicates an error that might occur if measures are not
taken to prevent it.
■ NOTICE: Indicates that an unusual event has occurred.
■ INFO: Indicates an operational message.
■ DEBUG: Messages used for debugging.
Note:
■ The INFO and DEBUG messages are required only for advanced
debugging and by default, they are not sent by the device.
■ When viewing Syslog messages in the Web interface, these message
types are color coded.
By default, Syslog messages are sequentially numbered in the format
[S=<number>], for example, "[S=643]". A skip in the number sequence of
messages indicates a loss of message packets. For example, in the
below Syslog, messages 238 through 300 were not received. In other
words, 63 Syslog messages were lost (the sequential numbers are
indicated below in bold font):
Description
- 818 -
Mediant 4000 SBC | User's Manual