The memory available for Call Trace Log messages are limited to 1800 bytes per log entry. If a log entry occupies memory more than the 1800 bytes allocated for it, the entry is divided into two entries. The next 1800 bytes are allocated for the new log entry with the same time-stamp and sequence number. This ensures that a human or a program can parse the entries, and if necessary, can reassemble the entries with the same time-stamp and sequence number into one single chunk.

A sample log entry with memory footprint of more than 1800 bytes is illustrated below (observe the comments within /* */):

A sample log entry with memory footprint of more than 1800 bytes

242 12162016 083615.736943:1.02.00.38938.Info .SIPSG:CALL:FILTER=Cisco_Test_Call GCID=0x00000DDB: 14443. TraceCallLogger invoked - From pstProperties: PeerIP/port: 10.100.100.10/5000 LocalIP/port:10.139.160.141/5000 ulMsgType-0x40000004

/* This is a comment for illustration and not part of the actual log entry produced by the SBC. */
/* The line just below this comment indicates the start of an entry in the log file. */

1787 12162016 083615.737177:1.01.00.38939.MAJOR .SIPSG:FILTER=Cisco_Test_Call GCID=0x00000DDB: EXTRA INFO: Ingress: received msg for CallId:804ee913ccfe61c2aa581a72a000 gcid:0xDDB from IP/port:10.100.100.10/5000, Local IP/port:10.139.160.141/5000
RAW PDU:
INVITE sip:+8005555555@abc.company.com:5000 SIP/2.0
From: "AU-User-A" <sip:+8005555556@fgh.company.com>;tag=2ea08b0a-13c4-5853a77f-e2852bca-687922
To: <sip:+8005555555@ijk.company.com>
Call-ID: 804ee913ccfe61c2aa581a72a000
CSeq: 1 INVITE
Via: SIP/2.0/TCP 10.100.100.10:5000;branch=z9hG4bK-1fe0f0-5853a77f-e2852bca-53b01fb3
P-AV-Message-Id: 1_1
History-Info: <sip:+8005555555@lmn.company.com>;index=1, "8005555555" <sip:+8005555555@lmn.company.com>;index=1.1
P-Asserted-Identity: "AU-User-A" <sip:+8005555556@fgh.company.com>
Max-Breadth: 60
P-Charging-Vector: icid-value="AAS:409-910e4e801e6cf3c1a58aac0a072"
Alert-Info: <cid:internal@opq.company.com>;avaya-cm-alert-type=internal
Accept-Language: en
Supported: 100rel,histinfo,join,replaces,sdp-anat,timer
User-Agent: Avaya CM/R016x.03.0.124.0 AVAYA-SM-6.3.18.0.631804
Max-Forwards: 66
Av-Global-Session-ID: 804e0e91-3ccf-4601-b7aa-581a72a00000
P-Location: SM;origlocname="ACM4 R3 AU";origsiglocname="ACM4 R3 AU";origmedialocname="ACM4 R3 AU";termlocname="T2A R3 AU";termsiglocname="T2A R3 AU";smaccounting="true"
Session-Expires: 1800;refresher=uac
Min-SE: 1800
Allow: INVITE,ACK,OPTIONS,BYE,CANCEL,SUBSCRIBE,NOTIFY,REFER,INFO,PRACK,PUBLISH,UPDATE
Contact: <sip:+8005555556@10.100.100.10:5000;transport=tcp>
Content-Type: application/sdp
Content-Length: 253
 
v=0
o=- 8420266 0 IN IP4 10.240.42.55
s=-
c=IN IP4 10.240.42.111
b=AS:64
t=0 0
a=avf:avc=n prio=n
a=csup:avf-v0
m=audio 49080 RTP/AVP 18 127
a=rtpmap:18 G729/8000
a=rtpmap

/* This is a comment for illustration and not part of the actual log entry produced by the SBC. */
/* The line just after this comment indicates the start of a new entry in the log file, but with the same sequence number and time-stamp. */
/* It indicates that the new entry is an extension of the previous entry, after the quota of 1800 bytes of memory was utilized by the previous entry. */

148 12162016 083615.737177:1.01.00.38939.MAJOR .SIPSG:FILTER=Cisco_Test_Call :127 telephone-event/8000
a=fmtp:18 annexb=no
a=ptime:20
a=sendrecv
 

 

Messages like INVITE, in combination with SIP Headers like P-Asserted-Identity, P-Location, etc. often tends to produce log entries with memory footprint of more than 1800 bytes per entry.

Additional information about a call is indicated by the EXTRA INFO delimiter (see the example above). Currently, it comprises of the following:

  • Ingress/Egress indication in text
  • Indication if the message is received or sent
  • CallId
  • Global Call ID (gcid)
  • from IP/Port, to indicate the source IP and port of the message
  • LOCAL IP/Port, to indicate the recipient IP and port of the message
  • RAW PDU, which is the raw PDU in ascii text but not encrypted. The RAW PDU section is the largest in a log entry, and often wraps between log entries. Sometimes, it even spans over multiple files.
  • No labels