EIR Logging

Logs are written in each STP MP's and DAMP’s file management area located at /var/TKLC/db/ filemgmt/Eir_logs/. The file name is comprised of "File creation date and time"-"File close date and time"_"MP host name". A sample EIR log file name would be EIR_28052018.070425-28052018.120427_so1mp1__logs.

The log file consists of CSV entries for each MAP_CHECK_IMEI/ECR received that resulted in a match with an IMEI entry that is considered either gray or black-listed or unknown. Each new line contains the information about the caller and handset; and a Timestamp, Reason, and Status. If IMSI is not present or EIR is not able to decode the IMSI in the message, then the IMSI is left blank in the EIR log. The last 2 million entries received from DSR are included and this log feature is the same fro both SS7/Sigtran and Diameter. Each entry follows these rules:

• EIR logs an entry when:
  • Equipment status is found to be blacklisted or graylisted
  • Equipment status is blacklisted, but allowed due to IMSI overide
  • In error scenario, like the UDR connection is not available and the configured default response in error (EIR options table) is black or gray.
• A configurable flag is provided in EirOptions table in case logging is needed for the whitelisted devices. Default value of the flag will be off.

Diameter Log File

The Diameter log file contains this information:

• Date and time of the message
• The IMEI digits from the ECR message
• MEI SV, if available
• The IMSI digits from the ECR message (if present)
• Origin-host of ECR message
• Device Status - Whether the IMEI was Whitelisted, Graylisted, or Blacklisted
• Reason - Blacklisted, but allowed due to IMSI override or IMEI Range Match

The MP copies the log file to the SOAM every hour to /var/TKLC/db/filemgmt/export/Eir_Log/Deir.

SS7/Sigtran Log File

The SS7/Sigtran log file contains this information:

• SS7/Sigtran
• The IMEI digits from the CHECK_IMEI message
• IMEI SV, if available
• The IMSI digits from the CHECK_IMEI message (if present)
• SCCP CgPA Digits from the source of query
• Device Status - Whether the IMEI was Whitelisted, Graylisted, or Blacklisted
• Reason - Blacklisted, but allowed due to IMSI override or IMEI Range Match

The MP copies the log file to the SOAM every hour to /var/TKLC/db/filemgmt/ export/Eir_Log/Vstp.

For example, if an MP server receives entry ID 1234 on July 15, 2003, at exactly 4:36 PM from a Service Module card provisioned at address 192.168.120.1 indicating that Blacklisted subscriber 9195551212 using handset 12345678901234 was detected, this entry is created:

20030715163600,192.168.61.1,1234,9195551212,12345678901234,0

Figure 3-1 Sample Log File