Cisco TelePresence Administrator's Manual page 33

Grey Headline (continued)
Status
Message details field
For all messages logged from the tvcs process, the message _
details field, which contains the body of the message,
consists of a number of human-readable name=value pairs,
separated by a space.
Name Description
Event
The event which caused the log message to be generated. See
list of all events that are logged by the VCS, and the level at which they are logged.
User
The username that was entered when a login attempt was made.
ipaddr
The source IP address of the user who has logged in.
Protocol
Specifies which protocol was used for the communication. Valid values are:
•
TCP
•
UDP
•
TLS
Reason
Textual string containing any reason information associated with the event.
Service
Specifies which protocol was used for the communication. Will be one of:
•
H323
•
SIP
•
H.225
Message Type
Specifies the type of the message.
Response-
SIP response code or, for H.323 and interworked calls, a SIP equivalent response
code
code.
Src-ip
Source IP address (the IP address of the device attempting to establish
communications). This can be an IPv4 address or an IPv6 address.
Dst-ip
Destination IP address (the IP address of the destination for a communication
attempt). The destination IP is recorded in the same format as Src-ip.
Src-port
Source port: the IP port of the device attempting to establish communications.
Dst-port
Destination port: the IP port of the destination for a communication attempt.
Src-alias
If present, the first H.323 alias associated with the originator of the message.
If present, the first E.164 alias associated with the originator of the message.
Dst-alias
If present, the first H.323 alias associated with the recipient of the message.
If present, the first E.164 alias associated with the recipient of the message.
Detail
Descriptive detail of the Event.
Overview and System
Introduction
status configuration
D14049.08
November 2010
The first name element within the message _ details field is
always Event and the last name element is always Level.
The table below shows all the possible name elements within the
message _ details field, in the order that they would normally
appear, along with a description of each.
Events and levels
• •
H.245 NeighbourGatekeeper
• •
LDAP Clustering
• •
Q.931 ConferenceFactory
Cisco VCS Zones and
configuration neighbors
Event Log
Name Description
Auth
for a Whether the call attempt has been authenticated successfully.
Method
SIP method (INVITE, BYE, UPDATE, REGISTER, SUBSCRIBE, etc).
Contact
Contact: header from REGISTER.
AOR
Address of record.
Call-id
The Call-ID header field uniquely identifies a particular invitation or all registrations of a
particular client.
Call-serial-
The VCS-local Call Serial Number that is common to all protocol messages for a
number
particular call.
Tag
The Tag is common to all searches and protocol messages across a VCS network for
all forks of a call.
Call-routed
Indicates if the VCS took the signaling for the call.
To •
for REGISTER requests: the AOR for the REGISTER request
•
for INVITEs: the original alias that was dialed
•
for all other SIP messages: the AOR of the destination.
Request-URI
The SIP or SIPS URI indicating the user or service to which this request is being
addressed.
Num-bytes
The number of bytes sent/received in the message.
Protocol-
Shows the data contained in the buffer when a message could not be decoded.
buffer
Duration
Request/granted registration expiry duration.
Time
A full UTC timestamp in YYYY/MM/DD-HH:MM:SS format. Using this format permits
simple ASCII text sorting/ordering to naturally sort by time. This is included due to the
limitations of standard syslog timestamps.
Level
The level of the event as defined in the
UTCTime
Time the event occurred, shown in UTC format.
Clustering and Call Bandwidth
peers processing control
33
CISCO TELEPRESENCE VIDEO COMMUNICATION SERVER
In addition to the events described below, a
syslog.info event containing the string MARK is logged
after each hour of inactivity to provide confirmation that
logging is still active.
About Event Log levels section.
Firewall
Applications Maintenance
traversal
ADMINISTRATOR GUIDE
Appendices