Remote Logging - Cisco TelePresence Administrator's Manual

Level Assigned Events
Level High-level events such as registration requests and call attempts. Easily human readable. For example:
call attempt/connected/disconnected
1
n
registration attempt/accepted/rejected
n
Level All Level 1 Events, plus:
logs of protocol messages sent and received (SIP, H.323, LDAP and so on) excluding noisy messages
2
n
such as H.460.18 keepalives and H.245 video fast-updates
Level All Level 1 and Level 2 Events, plus:
protocol keepalives
3
n
call-related SIP signaling messages
n
Level The most verbose level: all Level 1, Level 2 and Level 3 Events, plus:
network level SIP messages
4
n
See the Events and levels
which they are logged.
You can control which events are logged by the VCS by setting the Log level. All events with a level
numerically equal to and lower than the specified logging level are recorded in the Event Log. So, at level 1,
only level 1 events are logged; at level 2, both level 1 and level 2 events are logged, and so on. The default log
level is 1.
Note that:
Logging at level 3 or level 4 is not usually recommended as the Event Log holds a maximum of 2GB of data
n
and logging at these levels on a busy system may cause the Event Log to be recycled too quickly.
Changes to the event log level affect both the Event Log that you can view via the web interface, and the
n
information that is copied to the remote log server (if any) that you have configured.
Changes to the event log level are not retrospective — changes to the event log level only effect what is
n
logged from that point onwards.

Remote logging

The Event Log is always stored locally on the VCS. However, it is often convenient to collect copies of all
event logs from various systems in a single location. A computer running a BSD-style syslog server, as
defined in RFC 3164, may be used as the central log server. Note that:
A VCS will not act as a central logging server for other systems.
n
Events are always logged locally (to the Event Log) regardless of whether or not remote logging is enabled.
n
The VCS may use any of the 23 available syslog facilities for different messages. Specifically,
n
LOCAL0..LOCAL7 (facilities 16..23) are used by different software components of the VCS.
To enable remote logging, you must configure the VCS with the IP addresses or Fully Qualified Domain
Names (FQDNs) of the Remote syslog servers to where the Event Log is written. Up to 4 servers can be
specified. Note that these servers cannot be another VCS.
Cisco VCS Administrator Guide (X7.1)
section for a complete list of all events that are logged by the VCS, and the level at
Network and system settings
Page 75 of 479