First Version: 2006/11/27
Cisco devices generate a number of syslog event types. Common ones include interface
up/down events. From a voice perspective, a number of h.323 call logging events can also be
generated. By default, with PRI lines, a Cisco Voice Gateway will generate an
%ISDN-6-CONNECT event when a call connects and an %ISDN-6-DISCONNECT when the call
disconnects. This information can be used to get an idea of call volume and average call
duration. These events contain number information for the voip side of the peer only.
To fill a table with call detail records and to generate billing records, which have
numbers for both peers, full h.323 connection
call accounting needs to be turned on. The records from this process generate a
%VOIPAAA-5-VOIP_CALL_HISTORY syslog
entry. More details can be found at Cisco's Web Site. In short, add these lines to the gateway to enable
detail records:
!
aaa authentication login default local
aaa accounting connection h323 start-stop group radius
aaa session-id common
!
gw-accounting syslog
!
logging x.x.x.x
!
Here is a ciscowatcher.pl Perl
script. It provides an idea of how to process the syslog entries in real time through a
pipe. This script
will form the primary source of updates to the monitoring server status screens for
calls, interfaces, wireless, and related information in the monitoring server I'm currently
putting together.
The script populates tables in a PostgreSQL database. Here is the ciscowatcher.sql to create the
PostgreSQL tables in a database called oneunified.