Syslog Reporting of Rejected Calls

Users can choose to send a syslog message in response to the rejection of a SIP call. In the default state, rejected calls are not reported to syslog.

Use the following ACLI command sequence to enable syslog reporting of rejected SIP calls.

ORACLE# configure terminal 
ORACLE(configure)# media-manager 
ORACLE(media-manager)# media-manager 
ORACLE(media-manager-config)# syslog-on-call-reject enable

The syslog-on-call-reject attribute, which is disabled by default, enables the generation of a syslog message in response to the rejection of a SIP call.

Use done, exit, and verify-config to complete this configuration.

Syslog messages issued in response to call rejection contain the following call-related information.

SIP status code indicating rejection cause
SIP method name (INVITE or REGISTER)
Reason for denial
Realm of calling endpoint
Applicable local response map
Content of Reason header (if present)
From URI of calling endpoint
Target URI of called endpoint
Source and Destination IP address and port
Transport type

The following are sample syslog messages issued in response to call rejections.

Dec 8 06:05:42 172.30.70.119 deimos sipd[205bfee4] ERROR [IDS_LOG]INVITE from source 172.16.18.100:5060 to dest 172.16.101.13:5060[UDP] realm=net172; From=sipp <sip:sipp@172.16.18.100:5060>;tag=13890SIPpTag001; target=sip:service@172.16.101.13:5060 rejected!; status=483 (Too Many Hops)

Dec 10 15:09:28 172.30.70.119 deimos sipd[2065ace8] ERROR [IDS_LOG]INVITE from source 172.16.18.5:5060 to dest 172.16.101.13:5060[UDP] realm=net172; From=sipp <sip:sipp@172.16.18.5:5060>;tag=10015SIPpTag001; target=sip:service@172.16.101.13:5060 rejected!; status=488 (sdp-address-mismatch); error=sdp address mismatch

IDS syslog messages that report rejected calls and those that report endpoint demotions now contain a string IDS_LOG, to facilitate their identification as IDS-related messages. With IDS Phase 2, IDS messages reporting either endpoint demotions or call rejections can be sent to specific, previously-configured syslog servers.

In topologies that include multiple syslog servers, use the following procedure to enable delivery of IDS-related messages to one or more specific syslog servers.

Use the following command sequence to move to syslog-config Configuration Mode.

ORACLE# configure terminal 
ORACLE(configure)# system 
ORACLE(system)# system-config 
ORACLE(system-config)# syslog-servers 
ORACLE(syslog-config)#

From the existing pool of syslog servers select the server or servers that will receive syslog messages.
Ensure that all selected servers are configured with the same value for the facility attribute.

Allowable values are integers within the range 0 through 23.

Use the following command sequence to move to system-config Configuration Mode.

ORACLE(syslog-config)# done 
ORACLE(syslog-config)# exit 
ORACLE(system-config)#

Use the ids-syslog-facility attribute to enable message transfer to specific syslog servers.
The default value, -1, disables selective message transfer. To enable transfer to a designated syslog server or servers, enter the facility value (an integer within the range 0 through 23) that you confirmed or set in Step 3.

The following example enables the transfer of IDS syslog messages to all servers with a facility value of 16.
```
ORACLE(system-config)# ids-syslog-facility 16 
ORACLE(system-config)# 
```
Use done, exit, and verify-config to complete this configuration.