Advanced Logging
Advanced Logging allows targeted logging by overriding log levels, so that only a specific SIP request and its related messages get logged. The system matches criteria that you configure to determine which requests to log. The system also logs all messages related to the request, such as any responses, in-dialog messages, media, timers, and so on. Advanced Logging supports multiple matching criteria for incoming requests and rate limiting. Advanced log files are smaller than debug files because the system logs only the specified number of matches in the specified period of time. Since the files are smaller, Advanced Logging uses fewer system resources than debug logging. To make searching easier, the system labels each log.
You can deploy advanced logging by way of configuration. You configure the sip-advanced-logging element and adv-log-conditions subelement on the session router according to the logging targets.
You can control when logging occurs by enabling or disabling individual advanced logging objects using the state parameter. This allows you to retain advanced logging configurations on the system and simply start and stop logging against those objects when needed.
Protocol specific support includes:
- TCP—Protocol fully supported
- TLS—Protocol not supported
- UDP—Protocol not fully supported. The UDP protocol does not require port specification throughout transmission. Advanced logging uses port number to correlate traffic. As a result, advanced logging can capture UDP traffic but cannot correlate traffic when port numbers are not set and consistent.
By executing the notify sipd conditional-log-disable command, you can disable the ability to trigger all of the configured sip-advanced-logging objects.
ORACLE# notify sipd conditional-log-disable
Any active sip-advance-logging instances continue to log because the command only disables the ability to trigger new instances. You can restore the ability to trigger new instances for all sip-advance-logging objects with the notify sipd conditional-log-enable command .
- Request-only. Logs only the matched message.
- Transaction. Logs only the request and the response.
- Session. Logs the matched message and anything else related to the session.
- Session and Media. Logs the matched message, anything related to the session, and media.
The system provides rate limiting by adjusting the matches-per-window and window-size attributes to specify the number of matched requests over a specified period of time.
- Request Types, such as INVITE or SUBSCRIBE.
- Received Session-Agent, by IP address or hostname.
- Received Realm Name.
- Request URI. User and host. Limited to 2 condition entries, when using both types.
- To header. User and host. Limited to 2 condition entries, when using both types.
- From header. User and host. Limited to 2 condition entries, when using both types.
- Call-id. Matches the Call-id header.
The system allows you to configure a regex pattern or a literal string as the match-value. In either case, the match-procedure attribute tells the system how to parse the match-value.
userBob
, you can set match-procedure to
exact-match
and set match-value to
userBob
. Or to match a Request-URI that starts with a lower case
letter one or more times followed by an upper case letter one or more times, you can set
match-procedure to match-regex
and set
match-value to ^[a-z]+[A-Z]+
. This would
match:
- userBob@10.0.0.1
- userAlice@10.0.0.1
- userEVE@10.0.0.1
- user@10.0.0.1
- USER@10.0.0.1
When you enable a sip-adv-logging object, applicable events trigger this logging by the Sipd (SIP signaling) process, resulting in log messages from it. The Sipd process also propagates advanced logging to the Atcpd (TCP connections), Ebmd (bandwidth managment), Lrtd (local routing table), Radd (accounting), and Middle Box Control Daemon (MBCD) processes, resulting in additional log messages from them. In addition, Mbcd events, including asynchronous 2833, flowguard timer and latching events, can propagate conditional logging to Sipd, resulting in log messages from Sipd.
Behavior During High Availability Synchronization
When the system is synchronizing a thread at the same time that thread is performing advanced logging, this logging continues on the standby while the replication takes place. This logging on the standby, however, stops after replication is complete, with the exception of sip-sessions and media flows.
Threads associated with sip-sessions and flows continue to store their logging state after replication. The logging state is stored in either the session or flow. When a switchover happens while a thread is processing one of these sessions or flows, the system finds the stored logging state and continues logging even though the event was triggered on the other node of the HA pair.
Configure Advanced Logging - Command Line
- an AND relationship means that all conditions must match before the system generates the log.
- an OR relationship means that only one set of conditions must match before the system generates the log.
Note:
The system does not require you to save and activate after performing this procedure.Procedure
Configuring Advanced Logging
- The system evaluates each configuration individually in an OR relationship.
- The system evaluates all conditions and they must all match in an AND relationship.
Disable Advanced Logging - Command Line
sip-advanced-logging
that is enabled by way of the Configure Mode.
- From the AdvancedLogging.lua SPL-plugin, run the
spl stop advanced-logging
command.
Disable Advanced Logging - Configure Mode
sip-advanced-logging
and
advanced-log-condition
. Disabling Advanced Logging in Configure Mode does not affect Advanced Logging that is enabled from the command line.
Clear Advanced Logging Criteria - Command Line
- From the AdvancedLogging.lua SPL-plugin, run the
spl set sip advanced-logging clear-matching
command.