Event Log - CLI

filterAdmin

Event Log Class Filter configuration table.

<node name>

SBC node name.

<event type>

The type of event log to configure:

• audit – System audit data. These files contain a record of all management interactions that modify the state of the system, and includes all the changes made via the CLI and the Netconf interface. These files use .AUD extensions.
• debug – System debugging data. These files have .DBG extensions.
• memusage – Process heap memory usage data. These files have .MEM extensions.
• security – Security level events. These files have .SEC extensions.
• system – System level events. These files have .SYS extensions.
• trace – System trace data. These files have .TRC extensions.

<event class>

For each event type, configure one of the following event:

• audit – Audit subsystem.
• callproc – Call Processing subsystem.
• directory – Directory Services subsystem.
• netmgmt – Network Management subsystem.
• policy – Policy subsystem.
• resmgmt – Resource Management subsystem.
• routing – Network Routing subsystem.
• security – Security subsystem.
• signaling – Signaling subsystem.
• sysmgmt – System Management subsystem.
• trace – Call Trace subsystem.

level

Minimum severity level threshold for event logging:

• critical – log only critical events.
• info – log all events.
• major – log major and critical events.
• minor – log all events other than info.
• noevents – do not log any events.

Note:  Info level logs which are traps or faults are always reported in the system logs.

state

Administrative state of event logging for this event type. Set to “on” if filter entry should take precedence over per-node settings.

• off (default) – Logging is not activated.
• on – Logging is activated.

filterStatus

Event log class filter status table.

<system name>

SBC system name.

<event type>

The type of event log:

• audit – System audit data. These files contain a record of all management interactions that modify the state of the system, and includes all the changes made via the CLI and the Netconf interface. These files use .AUD extensions.
• debug – System debugging data. These files have .DBG extensions.
• memusage – Process heap memory usage data. These files have .MEM extensions.
• security – Security level events. These files have .SEC extensions.
• system – System level events. These files have .SYS extensions.
• trace – System trace data. These files have .TRC extensions.

<event class>

Event class for each event type:

• audit – Audit subsystem.
• callproc – Call Processing subsystem.
• directory – Directory Services subsystem.
• netmgmt – Network Management subsystem.
• policy – Policy subsystem.
• resmgmt – Resource Management subsystem.
• routing – Network Routing subsystem.
• security – Security subsystem.
• signaling – Signaling subsystem.
• sysmgmt – System Management subsystem.
• trace – Call Trace subsystem.

resetStats

Use this control to reset the value of Events Filtered column of the filterStatus display.

clearInfoLevelLoggingDisabled

Use this command to re-enable info level logging after it becomes disabled due to system congestion. If this command is executed while the system is still congested, this may cause the system to become further congested.

Note: Only issue this command once system congestion dissipates. The system may become further congested if this command is executed while the system is still congested

state

Enable this flag to measure the memory usage of each active process.

• disable (default)

• enable

Specifies the level of details to be displayed.

• summary (default)
• detailed

The time interval, in minutes, to elapse between the recording of each memory usage file to the hard drive. (Default = 5)

Note: An interval of 1440 minutes (24 hours) equates to one log entry per day for a process.

Use this object to configure a remote server IP address, port, and protocol type to push the platform audit logs to a remote server.

state

Enable this flag to allow platform audit logging of administrative, privileged, and security actions.

• disabled (default)
• enabled

subsystemAdmin

Subsystem event logging configuration.

<system_name>

Name of system.

<subsys_ID>

The subsystem/task ID. See Subsystem IDs table below for a list of subsystem IDs. 

infoLogState

Use this flag to enable/disable event logging of INFO level messages to DBG and SYS logs for   the specified subsystem. By default, infoLogSate is enabled for all subsystems.

• disabled
• enabled (default)

Note:

• If infoLogState is disabled for CHM, nothing is written to AUD logs.
• If infoLogState is disabled for CPX, request commands are not recorded to AUD logs.

typeAdmin

N/A

Event Log configuration table for configuration items related to each Event Log type.

<event_type>

N/A

Specifies the type of event log being configured:

• acct – System account data. These files have .ACT extensions.
• audit – System audit data. These files contain a record of all management interactions that modify the state of the system. These files have .AUD extensions. It  includes all the changes made via the CLI and the Netconf interface. (This attribute is only available to an Administrator)
• debug – System debugging data. These files have .DBG extensions.
• memusage – Process heap memory usage data. These files have .MEM extensions.
• packet – Packet information details. These files have .PKT extensions. If enabled, stores the packet details to .PKT files.
• security – Security level events. These files have .SEC extensions. (This attribute is only available to an Administrator)
• system – System   level events. These files have .SYS extensions.
• trace – System trace data. These files have .TRC extensions.

NOTE: packet (.PKT) and memusage (.MEM) logs are not supported for syslog service. Refer to Supported Log Types for more information on supported log types.

Write CDRs as compressed, or uncompressed.

• compressed
• uncompressed (default)

Type of compression.

• both – The SBC generates both compressed and uncompressed CDR files
• none (default) – For backward compatibility, uncompressed CDR files
• only – The SBC generates compressed CDR files

0-4294976295

Specifies the limit on INFO level messages logged to the disk in one second. A value of 0 disables the limit. The default value is 10000.

Note: For the trace log, if tracing is being performed to capture all of the SIP PDU for all of the calls on the system for use in conjunction with Ribbon Analytics, then this value needs to be tuned to accommodate the maximum call load anticipated for the SBC instance. For example, for a call rate of 1350 cps and assuming 14 messages in a basic SIP call (ingress and egress legs), it would require a total of 18,900 messages. Adding this to the default 10000, the recommendation in this case would be to set the limit at 30,000.

Specifies whether the packet files are encrypted.

• disabled (default) - The .PKT files contain unencrypted data.
• enabled - The .PKT files contain encrypted data. When enabled, the encryptionPublicKey parameter is mandatory.

Note: You can configure this parameter only when typeAdmin is set to packet.

For more detailed information, refer to Encrypting Auto-traced Media.

This is the RSA public key without ssh-rsa at the beginning of the key contents and without the user email at the end of the key contents. This key uses a minimum of 2048 bits and accommodates public keys of up to 4096 bits in length.

Note: This parameter is mandatory when encryptFile is set to enabled.

Note: You can configure this parameter only when typeAdmin is set to packet.

For more detailed information, refer to Encrypting Auto-traced Media.

Specifies whether the logs at rest for this log type should be cryptographically hashed.

Hashing is only recommended for the security and audit logs. These are the main logs required to triage security issues and do not roll very frequently. Hashing must be disabled for logs that are rolling over frequently as would occur for the trace log if the call rate is 1350 cps and it is being used to capture all SIP PDU's for use with Ribbon Analytics.

If logs are being exported using Rsyslog then there is no need to enable Event Log Validation as the logs are copied off the SBC before they could be modified. Refer to OAM - Event Log - Platform Rsyslog.

• disabled (default)
• enabled

IMPORTANT: You must disable this control for any logs which are rolling at a very high rate (e.g. capturing trace logs of all SIP PDUs for use with Ribbon Analytics).

Hash Notes:

• Hashes are stored in /.../evlog/eventLogValidation/
• The hash file name format is <evLogfilename>.hash.<keyName>
• Hashes must be retrieved using SFTP 

fileCount

1-2048

Specifies the number of event log files that will be maintained for this event type. (default = 32).

fileSize

256-65535

Maximum size (in KB) that a single event log file will ever grow to. (default = 2048).

Note: Set the file size to 65535 for trace and account logs when attempting to trace all calls on the system for use with Ribbon Analytics.

fileWriteMode

N/A

Event log NFS write mode. 

• default – Log data is written as a 1344-byte packet.
• optimize – Log data is written as a 8000-byte packet. Optimize write mode results in IP fragmentation but yields better throughput.

filterLevel

N/A

Logs every possible event.

messageQueueSize

2-100

The number of event log message entries to buffer before writing to disk. (default = 10).  If capturing all of the SIP PDU messages in the trace log for use with Ribbon Analytics, set this value to 100 for the trace log.

renameOpenFiles

N/A

Enable this flag to append an ".OPEN" extension to accounting and files which are open for writing.

• disabled (default)
• enabled

Note: You must enable the global callTrace signalingPacketCapture parameter (set state to "enable") to capture SIP and H.323 packets (Refer to Call Trace - CLI for configuration details).

Once signalingPacketCapture is enabled, any subsequent changes to SBC device configurations or filter information will not be available to signaling packet captures until signalingPacketCapture is reset (state is disabled, and then re-enabled).

rolloverAction

N/A

Event log rollover actions.

• start – Start rollover action
• stop – Stop rollover action

rolloverInterval

0-31536000

Event log rollover interval, in seconds.

Note: When using this service, you must set a value of 15 seconds or more.

rolloverStartTime

N/A

Specifies the start time for event log rollover. The format is CCYY-MM-DDTHH:MM:SS. For example: 2010-01-01T01:01:01

rolloverType

N/A

Event log rollover type. 

• nonrepetitive (default) – The rollover will occur once at the specified single instance.
• repetitive – The rollover will occur repeatedly at the specified intervals.

saveTo

N/A

Use flag to specify that the events are saved to disk or not saved.

• disk (default)
• none

state

N/A

Specifies the requested state of the given Event Log type.

• disabled – Logging is not activated.
• enabled – (default) Logging is activated.
• rollfile – Use this option to close the active log file and open a new one with an incremented (name) suffix. This facilitates real-time analysis of system events by performing the analysis on closed, rather than opened and growing, files.

Do not disable accounting and audit logs.

Configure a remote Rsyslog Server for a single log type:

• syslogRemoteHost – (0-255) The remote host where the messages are written to the syslog.
• syslogRemotePort – (1-65,535) Specifies the port to use to send messages to the remote syslog. Default value is 514.
• syslogRemoteProtocol – The protocol to use to send messages to the remote syslog.
  • relp
  • tcp (default)
  • udp 

Note: packet (.PKT) and memusage (.MEM) logs are not supported for syslog service. Refer to Supported Log Types for more information on supported log types.

• disabled (default)
• enabled

typeAdmin

Event Log configuration table for configuration items related to each Event Log type.

<event_type>

Specifies the type of event log to roll over:

• acct – System account data. These files have .ACT extensions.
• audit – System audit data. These files contain a record of all management interactions that modify the state of the system. These files have .AUD extensions. It  includes   all the changes made via the CLI and the Netconf interface. (This attribute is only available to an Administrator)
• debug – System debugging data. These files have .DBG extensions.
• memusage – Process heap memory usage data. These files have .MEM extensions.
• packet – Packet information details. These files have .PKT extensions. If enabled, stores the packet details to .PKT files.
• security – Security level events. These files have .SEC extensions. (This attribute is only available to an Administrator)
• system – System   level events. These files have .SYS extensions.
• trace – System trace data. These files have .TRC extensions.

rolloverLogNow

This control is used with request command to perform a roll-over of the specified log immediately.