Cisco Cisco Expressway Maintenance Manual
Configuring logging
The Expressway provides an event logging facility for troubleshooting and auditing purposes. The Event Log
records information about such things as calls and messages sent and received.
records information about such things as calls and messages sent and received.
The Expressway's logging options are configured on the
Logging
page (
Maintenance > Logging
) from
where you can:
n
specify the Log level to set the amount of information to record
n
copy the Event Log to a remote syslog server
Event Log levels
You can control which events are logged by the Expressway by setting the Log level.
All events have an associated level in the range 1-4, with Level 1 Events considered the most important. The
table below gives an overview of the levels assigned to different events.
table below gives an overview of the levels assigned to different events.
Level Assigned events
1
High-level events such as registration requests and call attempts. Easily human readable. For example:
n
call attempt/connected/disconnected
n
registration attempt/rejected
2
All Level 1 events, plus:
n
logs of protocol messages sent and received (SIP, H.323, LDAP and so on) excluding noisy messages
such as H.460.18 keepalives and H.245 video fast-updates
such as H.460.18 keepalives and H.245 video fast-updates
3
All Level 1 and Level 2 events, plus:
n
protocol keepalives
n
call-related SIP signaling messages
4
The most verbose level: all Level 1, Level 2 and Level 3 events, plus:
n
network level SIP messages
level at which they are logged.
Note that:
n
Logging at level 3 or level 4 is not usually recommended as the Event Log holds a maximum of 2GB of data
and logging at these levels on a busy system may cause the Event Log to be recycled too quickly.
and logging at these levels on a busy system may cause the Event Log to be recycled too quickly.
n
Changes to the log level affect both the Event Log that you can view via the web interface, and the
information that is copied to any remote log server.
information that is copied to any remote log server.
n
Changes to the log level are not retrospective — they only affect what is logged from that point onwards.
Remote logging of events
The Event Log is always stored locally on the Expressway. However, it is often convenient to collect copies
of all event logs from various systems in a single location. This is referred to as remote logging. This is
particularly recommended for peers in a cluster.
of all event logs from various systems in a single location. This is referred to as remote logging. This is
particularly recommended for peers in a cluster.
Cisco Expressway Administrator Guide (X8.1)
Page 175 of 344
Maintenance
Configuring logging