Page History

Type

The type of the event log. Each type has separate configuration parameters and logs to a separate file.

State

Specifies the requested state of the given event log type.

• Disabled – Logging is not activated.
• Enabled – (default) Logging is activated.
• Rollfile

 Accounting logs cannot be disabled.

File Count

The number of event log files that will be maintained for this event type. All event types will overwrite the oldest file when the file count is exceeded. A warning will be issued when the count approaches the maximum. Enter a value between the range 1 and 2048.

File Size

The maximum size (in KB) that a single event log file will ever grow to. Enter a value between in the range (256-65535) KB. File size should be set to 65535 for trace and account logs when trying to trace all the calls on the system for use with Ribbon Protect.

Message Queue Size

The number of event log message entries to buffer before writing them to disk. The size may be a value between 2 and 100. The default is 10. If capturing all of the SIP PDU messages in the trace log for use with Ribbon Protect, set this value to 100 for the trace log.

Save To

Save events. The values are:

• None - Events are not saved
• Disk - Events are saved to disk

Filter Level

The filter severity level of events. Events that are at least as severe as the designated level will be logged. Noevents suppresses all events of this type from being logged.

Rollover Start Time

Specifies the start time for event log rollover. The format is CCYY-MM-DDTHH:MM:SS. For example: 2010-01-01T01:01:01.

Rollover Interval

Enter the number of seconds for the event log rollover interval.

Rollover Type

Event log rollover type. Options are:

• Nonrepetitive (default) – The rollover will occur once at the specified single instance.
• Repetitive – The rollover will occur repeatedly at the specified intervals.

Rollover Action

Event log rollover actions. The values are:

• Start - Start event log rollover at the specified starting time.
• Stop - Stop event log rollover.

File Write Mode

Identifies event log NFS write mode. The values are:

• Default - Log data is written to NFS as a 1344 byte packet.
• Optimize - Log data is written to NFS as an 8000 byte packet.
  Optimize write mode results in IP fragmentation, but yields better throughput.

Syslog State

Enable this option to log events of specified type to syslog.

• Disabled (default)
• Enabled

Rename Open Files

Enable this option to append an ".OPEN" extension to accounting and files which are open for writing.

• Disabled (default)
• Enabled

NOTE: You must enable the Signaling Packet Capture State parameter to capture SIP and H.323 packets (refer to Call Trace and Packet Capture - Signaling Packet Capture for configuration details).

Once Signaling Packet Capture State is enabled, any subsequent changes tothe SBC device configurations or filter information will not be available to signaling packet captures until the state is reset (state is disabled, and then re-enabled).

Specifies whether the logs at rest for this log type should be cryptographically hashed. The values are:

• Disabled (default)
• Enabled

Hashing is only recommended for the security and audit logs. These are the main logs required to triage security issues and do not roll very frequently. 

IMPORTANT: You must disable this control for any logs which are rolling at a very high rate, for example, if capturing trace logs of all SIP PDUs for use with Ribbon Protect.

If logs are being exported using Rsyslog then there is no need to enable Event Log Validation as the logs are copied off the SBC before they could be modified. Refer to OAM - Event Log - Platform Rsyslog.