AudioCodes Mediant 500 E-SBC, User Manual

Page: 667 / 920

User's Manual 49. Syslog and Debug Recordings
Version 6.8 667 Mediant 500 E-SBC
Expression Description
ip.proto IP protocol type (PDU) entered as an enumeration value
(e.g., 1 is ICMP, 6 is TCP, 17 is UDP)
udp, tcp, icmp, sip, ldap, http, https Single expressions for protocol type
udp.port, tcp.port Transport layer
udp.srcport, tcp.srcport Transport layer for source port
udp.dstport, tcp.dstport Transport layer for destination port
and, &&, ==, <, > Between expressions
Below are examples of configured expressions for the 'Value' parameter:

udp && ip.addr==10.8.6.55

ip.src==10.8.6.55 && udp.port>=5000 and udp.port<6000

ip.dst==10.8.0.1/16

ip.addr==10.8.6.40
For conditions requiring the "or" / "||" expression, add multiple table rows. For example, the
Wireshark condition "(ip.src == 1.1.1.1 or ip.src == 2.2.2.2) and ip.dst == 3.3.3.3" can be
configured using the following two table row entries:
1. ip.src == 1.1.1.1 and ip.dst == 3.3.3.3
2. ip.src == 2.2.2.2 and ip.dst == 3.3.3.3
Note: If the 'Value' field is not defined, the device records all IP traffic types.
49.6 Viewing Syslog Messages
You can use the following tools to view the Syslog messages sent by the device:

Web interface's Message Log page (see below).

CLI -The device sends the error messages (e.g. Syslog messages) to the CLI console
as well as to the original configured destination. Use the following commands:
debug log ; Starts the debug
no debug log ; Stops the debug
no debug log all ; Stops all debug process

Any third-party Syslog server (e.g., Wireshark).
The following procedure describes how to view Syslog messages in the Web interface.
Notes:
•
It's not recommended to keep a Message Log session open for a prolonged
period. This may cause the device to overload. For prolonged (and detailed)
debugging, use an external Syslog server.
•
You can select the Syslog messages in this page, and copy and paste them into a
text editor such as Notepad. This text file (
txt ) can then be sent to AudioCodes
Technical Support for diagnosis and troubleshooting.