Use the LX Settings screen to filter and control the format of the syslog entries shown in the Analyzer by SIP Message type and/or IP address of the SBC Edge (1000/2000), SBC Core (5000/7000/SWe) or VX Peer devices.
Excluded SIP Method
Excluded SIP Method specifies which SIP messages to exclude from the analysis. Entries in the syslog having the specified SIP Message(s) in the Method field are excluded from the analysis and do not appear in the Message pane and the Calls tab.
To exclude SIP messages from peer devices:
Excluded IP Addresses
Excluded IP Addresses specifies which messages, based on the PEER IP, to exclude from the analysis. Entries in the syslog having the specified IP address(es) in the Peer IP field are excluded from the analysis and do not appear in the Message pane and the Calls tab.
To exclude messages from peer devices:
- Enter a comma-separated list of the IP addresses of the devices in the Excluded IP Addresses text box.
Syslog Mode automatically opens the syslog server in listening mode.
The 1k/2k Media (Debug) provides additional media information for SBC Edge (1000/2000) debug logs.
Metrics allows the Call Duration and the Error/Warn/File Statistics tabs to appear in the lower display pane. For more information, see LX Overview.
The Error/Warn/File Statistics tab is only supported on the SBC Edge (1000/2000).
Call Ladders by IP Only limits call ladders to SIP IP addresses.
Enable AoR Call Flows allows information for the Address of Record (AoR) to appear on the lower display pane. For more information, see LX Overview.
Global Call ID (GCID) groups each leg (ingress, egress, and transfers) for a call automatically.
External Syslog Formatting
External Syslog Formatting is used to format syslog files so that they can be parsed by LX correctly. External syslog servers usually append four words to each line of the syslog file, such as the host name and a timestamp. The Line Prefix Split Count setting must be set prior to opening the external syslog file with LX. This feature is explained in more details in section Working with Syslogs from External Servers.
Some syslog servers, such as syslogd, use hexadecimal line breaks. Since the SIP messages are received in a single line, the syslog server adds either
<013><010> as line breaks for each line of the SIP message. This prevents proper parsing of the SIP messages. The RegexPattern - Line Breaks setting allows you to specify a Regex pattern to be replaced as a line break.
Syslog Server Settings
LX can write logs to a disk instead of the screen and is more efficient when capturing logs for an extended period of time.
Log Rotate Interval
Log Rotate Interval specifies the interval between log rotations. If no interval is specified, log rotation defaults to 100 MB.
Log Destination defines the destination for logs written to disk. This field is active only when Save to Disk is selected on the Syslog Server Window (see Working with Syslogs).
Delete Logs Older Than __ Days
Delete Logs Older Than_Days helps to conserve disk space by deleting logs after the specified number of days.
Limit Syslog Files to __ Files
Limit Syslog Files to_Files only allows the specified number of files to be saved. If the maximum number is reached, older files will automatically be deleted from the Log Destination directory to make room for the new saved syslog files.
SFTP specifies the remote directory path where the files are stored. It is only use for SBC Core (5000/7000/SWe).