Syslog And Debug Recording; Configuring Log Filter Rules - AudioCodes Mediant 800 User Manual

CHAPTER 62 Syslog and Debug Recording
62

Syslog and Debug Recording

For debugging and troubleshooting, you can use the device's Syslog and/or Debug Recording
capabilities:
■ Syslog: Syslog is an event notification protocol that enables a device to send event
notification messages across IP networks to event message collectors, also known as Syslog
servers. The device contains an embedded Syslog client, which sends error reports / events
that it generates to a remote Syslog server using the IP / UDP protocol. This information is a
collection of error, warning, and system messages that records every internal operation of the
device.
■ Debug Recording: The device can send debug recording packets to a debug capturing
server. When the debug recording is activated, the device duplicates all messages that are
sent and/or received by it and then sends them to an external server defined by IP address.
The debug recording can be done for different types of traffic such as RTP/RTCP, T.38, ISDN,
CAS, and SIP. Debug recording is used for advanced debugging when you need to analyze
internal messages and signals. Debug recording is also useful for recording network traffic in
environments where hub or port mirroring is unavailable and for recording internal traffic
between two endpoints on the same device.
You can include Syslog messages in debug recording (see
Rules).

Configuring Log Filter Rules

The Logging Filters table lets you configure up to 60 rules for filtering debug recording packets,
Syslog messages, and Call Detail Records (CDR). The log filter determines the calls for which you
want to generate debug recording packets, Syslog messages or CDRs. For example, you can add
a rule to generate Syslog messages only for calls belonging to IP Groups 2 and 4, or for calls
belonging to all IP Groups except IP Group 3.
You can also configure log filters for generating CDRs only and saving them on the device (local
storage). Debug recording log filters can include signaling information (such as SIP messages),
Syslog messages, PSTN traces (ISDN and CAS), CDRs, media (RTP, RTCP, and T.38), and
pulse-code modulation (PCM) of voice signals from and to the TDM.
If you don't configure any rules in the Logging Filters table and you have globally enabled debug
recording (by configuring the Debug Recording server's address - see Note below), Syslog (global
parameter - see Note below), and/or CDR generation (global parameter for enabling Syslog - see
Note below), logs are generated for all calls. Thus, the benefit of log filtering is that it allows you to
create logs per specific calls, eliminating the need for additional device resources (CPU
consumption) otherwise required when logs are generated for all calls.
You can enable and disable configured Log Filter rules. Enabling a rule activates the rule, whereby
the device starts generating the debug recording packets, Syslog messages, or CDRs. Disabling a
rule is useful, for example, if you no longer require the rule, but may need it in the future. Thus,
instead of deleting the rule entirely, you can simply disable it.
Mediant 800 Gateway & E-SBC | User's Manual
- 1096 -
Configuring Log Filter