Sip And H.323 Call Flow Logging; Capturing Sip And H.323 Signaling Messages; Packet Capture - Cisco TelePresence C20 Troubleshooting Manual

Capturing system logs
To capture the system logs you can do this from the web interface, see "Accessing the system using
the web interface" on page 5:
login as admin.
•
• First click Diagnostics on the upper navigation bar and then
You will now see a list of Current Log Files and Historical Log Files. All Current logs can be
•
downloaded as a single compressed file. Scroll to the end of the Current logs section for this
button. The same is applicable to the Historical Logs. Scroll to the end to see the Download
all log files button.
D15029.01 Troubleshooting Guide TC6.0, April 2013.

SIP and H.323 call flow logging

You can capture log information on calls in two different methods on the video system. The first is to
enable either Sip or H.323 logging commands to capture the signaling messages you are interested
in. The advantage of this method is that, it works with encrypted calls and is easy to setup. The other
method is to collect a packet capture from the system so that all call signaling, media and all other
interactions with any external system (TMS/CUCM), HTTp etc. is captured. This method is takes a little
more effort but will capture more information in non-encrypted call scenarios. This can be useful when
diagnosing media issues.

Capturing SIP and H.323 signaling messages

Log Files.

Packet capture

You can capture the traffic from using port spanning on your switch (or use a hub), or directly from the
video system. The latter is in many cases easier, although there are some limitations.
To capture directly from the system requires root access (see "Appendix B – Gaining root access to your
system" on page 33) and will use tcpdump to capture all information entering and leaving the system.
The advantage of this method is that, if you capture a complete call it can be opened in Wireshark and
analyzed graphically. There are however a few limitations to watch for when using this method.
if you are using Sip, set the default transport to TCP. Otherwise the call signaling might be encrypted
and you will not be able to see the call signaling. if you are having media issues, place calls without
encryption so that the media can later be analyzed.
logging can be captured for around a maximum of 10 minutes before the internal memory is filled
and the logging stops, so if you are interested in capturing long calls use port spanning on your switch
instead and Wireshark on a pC to capture.
in order to later analyze the call in Wireshark, it is recommended to capture the complete call. Start the
capture before the call is made and stop it after the call has been disconnected.
29
• restart your codec. This will ensure that the log files are empty when you start logging.
• login using SSH to your system as admin.
• For Sip enter the command: log ctx sippacket debug 9.
For H.323 enter the command: log ctx h323packet debug 9.
•
• All log message output will now be sent into the application.log file under current logs.
• Now place the call and re-create the problem.
• Hang up the call.
• Turn off the logging you enabled, by either log ctx sippacket debug off or log ctx
.
h323packet debug off Tip You can press up arrow to repeat last command and delete
the 9 and add off.
• From the web interface navigate to
eventlog/application.log to see the logging messages.
Troubleshooting Guide TC6.0
Diagnostics -> Log Files. Under Current logs select
Copyright © 2013 Cisco Systems, Inc. All rights reserved.