Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Create a new article
14987
Views
20
Helpful
7
Comments

CMS - syslog message examples

Yusuke Yoshinaga
Cisco Employee
Cisco Employee

‎03-30-2017 02:46 AM - edited ‎03-12-2019 10:26 AM

 

 

Overview

This document introduces Cisco Meeting Server (CMS) syslog message example. In the future, the syslog output can be changed.

 

Examples of syslog messages

 

Devices used for this example;

  • CMA(Cisco Meeting App): tyamada@cms20.video.uc.lab
  • SIP Endpoint(Registered to VCS): dx80@vcs89.video.uc.lab

 

Sign-in from CMA

Jan 16 04:25:44 user.info cms20 authp:  Using authentication server cb_video.cms20.video.uc.lab to authenticate user tyamada@cms20.video.uc.lab (index: 1/1, reason: first match)

Jan 16 04:25:44 user.info cms20 host:server:  INFO : successful login request from tyamada@cms20.video.uc.lab

Jan 16 04:25:44 user.info cms20 xmppd[7]:  D-MLink-Auth SID-1258 New client connection from 192.168.99.1

 

Sign-out by CMA

Jan 16 04:26:10 user.info cms20 xmppd[7]:  D-MLink-Auth SID-1258 Closed C2S connection from tyamada@cms20.video.uc.lab/cb718fa12b7b311d

 

Authentication failure for sign-in

Jan 16 04:28:43 user.info cms20 authp:  Using authentication server cb_video.cms20.video.uc.lab to authenticate user tyamada@cms20.video.uc.lab (index: 1/1, reason: first match)

Jan 16 04:28:43 user.info cms20 host:server:  INFO : LDAP authorisation failed for user 'tyamada@cms20.video.uc.lab'

Jan 16 04:28:43 user.info cms20 host:server:  INFO : LDAP failure 49 (invalidCredentials) server diagnostics message: 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1

Jan 16 04:28:43 user.info cms20 host:server:  INFO : unsuccessful login request from tyamada@cms20.video.uc.lab

 

Connection timed out for sign-in

Jan 17 01:44:59 user.err cms20 xmppd[7]:  E-MLink-Error SID-1263 Unexpected network close for tyamada@cms20.video.uc.lab/34ebd23a0bb6abe4 192.168.97.205 [Connection timed out]

Jan 17 01:44:59 user.info cms20 xmppd[7]:  D-MLink-Auth SID-1263 Closed C2S connection from tyamada@cms20.video.uc.lab/34ebd23a0bb6abe4

 

CMA joins to space

Jan 16 04:31:26 user.info cms20 host:server:  INFO : new session created for user "tyamada@cms20.video.uc.lab"

Jan 16 04:31:27 user.info cms20 host:server:  INFO : call 218: allocated for tyamada@cms20.video.uc.lab "Windows PC client" conference participation

Jan 16 04:31:27 local0.info cms20 host:server:  INFO : participant "tyamada@cms20.video.uc.lab" joined space ab25d417-fe3b-4751-a267-9d312201ac0a (tyamada.cospace)

 

CMA disconnects call for leaving from space

Jan 16 04:33:26 user.info cms20 host:server:  INFO : call 218: tearing down ("tyamada@cms20.video.uc.lab" conference media)

Jan 16 04:33:26 local0.info cms20 host:server:  INFO : participant "tyamada@cms20.video.uc.lab" left space ab25d417-fe3b-4751-a267-9d312201ac0a (tyamada.cospace)

 

CMA left space due to connection timeout

Jan 17 02:54:46 user.info cms20 host:server:  INFO : call 228: inactivity notification; tearing down...

Jan 17 02:54:46 user.info cms20 host:server:  INFO : resource 0:0 for "tyamada@cms20.video.uc.lab"; deactivating due to call drop

Jan 17 02:54:46 user.info cms20 host:server:  INFO : resource 0:0 for "tyamada@cms20.video.uc.lab"; sending stream failure indication, size 98

Jan 17 02:54:47 user.info cms20 host:server:  INFO : user "tyamada@cms20.video.uc.lab", ephemeral invitation no longer valid due to call drop

Jan 17 02:54:47 local0.info cms20 host:server:  INFO : participant "tyamada@cms20.video.uc.lab" left space ab25d417-fe3b-4751-a267-9d312201ac0a (tyamada.cospace)

 

SIP Endpoint joins to space

Jan 17 03:12:42 user.info cms20 host:server:  INFO : call 230: incoming encrypted SIP call from "sip:dx80@vcs89.video.uc.lab" to local URI "sip:tyamada.cospace@cms20.video.uc.lab"

Jan 17 03:12:42 local0.info cms20 host:server:  INFO : participant "dx80@vcs89.video.uc.lab" joined space ab25d417-fe3b-4751-a267-9d312201ac0a (tyamada.cospace)

 

SIP Endpoint disconnects call for leaving from space

Jan 17 03:14:44 user.info cms20 host:server:  INFO : call 230: ending; remote SIP teardown - connected for 2:02

Jan 17 03:14:44 local0.info cms20 host:server:  INFO : participant "dx80@vcs89.video.uc.lab" left space ab25d417-fe3b-4751-a267-9d312201ac0a (tyamada.cospace)

 

Call hold

Jan 17 05:42:30 user.info cms20 host:server:  INFO : call 235: on hold

 

Call resume

Jan 17 05:42:51 user.info cms20 host:server:  INFO : call 235: resumed

 

SIP Endpoint left space due to connection timeout

Jan 17 03:46:25 user.info cms20 host:server:  INFO : call 231: ending; local SIP teardown with reason 24 (timeout - no refresh response) - connected for 30:00

Jan 17 03:46:25 local0.info cms20 host:server:  INFO : participant "dx80@vcs89.video.uc.lab" left space ab25d417-fe3b-4751-a267-9d312201ac0a (tyamada.cospace)

 

Call refured due to license limit

Jan 25 01:08:02 user.info cms20a host:server:  INFO : call 2: incoming encrypted SIP call from "sip:dx80@vcs89.video.uc.lab" to local URI "sip:tyamada.cospace@cms20.video.uc.lab"

Jan 25 01:08:02 user.warning cms20a host:server:  WARNING : failed to create new call leg: limit of 0 reached

Jan 25 01:08:02 user.info cms20a host:server:  INFO : call 2: ending; local teardown, system participant limit reached - not connected after 0:00     

 

Log-in to WebAdmin

Jan 17 03:25:47 local0.info cms20 host:server:  INFO : 192.168.0.1: web user "admin" logged in

Jan 17 03:25:47 user.info cms20 host:server:  INFO : web session 1 now in use for user "admin"

  

Log-out from WebAdmin

Jan 17 03:27:42 local0.info cms20 host:server:  INFO : 192.168.0.1: web user "admin" logged out

Jan 17 03:27:42 user.info cms20 host:server:  INFO : web session 1 deactivated for user "admin"

  

Failing log-in to WebAdmin

Jan 17 05:38:42 local0.info cms20 host:server:  INFO : 192.168.0.1: unsuccessful web log in attempt

 

SSH log-in

Jan 17 05:34:18 auth.info cms20 sshd[18322]:  Accepted password for admin from 192.168.0.1 port 3674 ssh2

 

Failing SSH log-in

Jan 17 05:36:56 auth.info cms20 sshd[19121]:  Failed password for admin from 192.168.0.1 port 3677 ssh2

Jan 17 05:36:59 auth.info cms20 sshd[19121]:  Connection closed by 192.168.0.1 [preauth]

 

Collecting syslog

CMS syslog is stored in the server as the file named "log". The file "log" can be downloaded with the following ways;

  • Log-in to CMS from SFTP client(ex.WinSCP) and download the file.
  • Download the file with using CMS Log Collector.
  • Run "syslog" command on MMP.

Note: Log file which can get from WebAdmin(Log > Event log) is filtered and overwritten every 100 KByte. So please get the "log" file to detail investigation.

 

Reference

Labels:
Comments
Fedor Solovev
Level 1
Level 1
‎04-05-2017 08:49 AM

Hello-Hello, Yusuke.

This is the first thoughtful document related to CMS (not Acano))). Thank you. I guess you have some experience in deployment CMS, therefore I hope you don't mild if I ask you to give a hint related to this product.

I am installing the latest at this moment Exp 8.9.2 and CMS 2.1.5 with the purpose to connect Web users from the Internet to a meeting.

Web login through Expressway works fine, however, when I sent a link to a remote user to join a meeting, a remote user was kicked after some time, and cms log showed one of this errors - ephemeral invitation no longer valid due to inactivity call drop.

At that moment I saw that the guest was trying to connect into my meeting room. What do you think, maybe I forget to configure some ports in Firewall or kinda turn on Expressway or DNS SRV on Internal DNS ?

Yusuke Yoshinaga
Cisco Employee
Cisco Employee
‎04-05-2017 07:41 PM

Hi Fedor,

Did you see this document? DNS entries listed on Appendix 1.

http://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/config_guide/X8-9/CMS-Expressway-Deployment-Guide_X8-9-1.pdf

For checking port usage, the document will help you. We can see the Expressway/CMS deployment from the page 38.

http://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/config_guide/X8-9/Cisco-Expressway-IP-Port-Usage-for-Firewall-Traversal-Deployment-Guide-X8-9-2.pdf

Fedor Solovev
Level 1
Level 1
‎04-07-2017 05:57 AM

Yes, it is right. Thank you. I missed some part of it - it of TURN in CMS WebAdmin.

Moreover, Laptop with Public IP and it connects successfully.

However, it seems there are some troubles, because I cannot setup a connection from a Web client which is behind another NAT.

Something wrong with media from Inet thats why CMS drops a call with timeout cause.

Can you suggest smth ?

Prasad Paradkar
Level 1
Level 1
‎07-24-2017 10:39 PM

Hi Yusuke,

No doubt this is a good document.

I have worked on Acano....in early release the user login was allowed through WebRTC.

my query is ....is the WebRTC login is still enable in CMS ? and if it is then what is the difference in the logs when login through the WebRTC.. you have given the logs of CMA but what about WebRTC, can you please provide WebRTC login also.

Yusuke Yoshinaga
Cisco Employee
Cisco Employee
‎07-24-2017 11:00 PM

Hi Prasad,

I checked I can do WebRTC sign-in to CMS(2.2.4) in my lab.

CMS log message is below. No different from previous versions.

Jul 25 14:52:43 user.info cms22a webbridge: INFO : login request received - session:0 user:1 password:1
Jul 25 14:52:43 user.info cms22a webbridge: INFO : Session 7FF72CDB5020 activated - 1 currently active
Jul 25 14:52:43 user.info cms22a webbridge: INFO : Attempting XMPP connection to 192.168.97.143:5222
Jul 25 14:52:43 user.info cms22a xmppd[7]: D-MLink-Auth SID-6 New client connection from 192.168.97.143
Jul 25 14:52:43 user.info cms22a webbridge: INFO : XMPP connected to 192.168.97.143:5222
Jul 25 14:52:43 user.info cms22a xmppd[7]: I-MLink-Info TLS conn IP=192.168.97.143 version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 secret-bits=256 processed-bits=256 compression="(None)" no certificate provided
Jul 25 14:52:43 user.info cms22a authp: Using authentication server cb_cms22a.cms22.video.uc.lab to authenticate user yyoshina@cms22.video.uc.lab (index: 1/1, reason: first match)
Jul 25 14:52:43 user.info cms22a host:server: INFO : successful login request from yyoshina@cms22.video.uc.lab
Jul 25 14:52:43 user.notice cms22a xmppd[7]: N-SASL-Notice plain authentication [over TLS] successful for yyoshina@cms22.video.uc.lab [192.168.97.143]
Jul 25 14:52:43 user.info cms22a webbridge: INFO : Session 7FF72CDB5020 moving from state idle to connected
Jul 25 14:52:43 user.info cms22a authp: Using authentication server cb_cms22a.cms22.video.uc.lab to validate user yyoshina@cms22.video.uc.lab (index: 1/1, reason: first match)
Jul 25 14:52:43 user.info cms22a authp: Using authentication server cb_cms22a.cms22.video.uc.lab to validate user yyoshina@cms22.video.uc.lab (index: 1/1, reason: first match)
Jul 25 14:52:44 user.info cms22a host:server: INFO : instantiating user "yyoshina@cms22.video.uc.lab"

If you have trouble with sign-in from WebRTC, please open a support case or create a discussion in this forum.

Regards,

Yusuke

julien.laffitte
Level 1
Level 1
‎04-26-2021 07:09 AM

Hello Yusuke,

 

I am trying to analyse the syslog files collected on our CMS CallBridges but the "Usage" lines remain cryptic, I cannot fathom how to decode them.

 

For example, the 2 lines below:

 

Feb 23 03:14:24.989 user.info cms-server host:server: [USAGE] : {"1" : [[0,0.000,0],[0],[[0,0,0,0,0],[0,0,0,0,0],[0,0,0,0,0],[0,0,0,0,0],[0,0,0,0,0]]]}
Feb 23 03:14:24.989 user.info cms-server host:server: [USAGE] : {"2" : [0,0.000,0.000,0,0]}

 

I suppose that the "usage" keyword is related to the server resources usage but I may be wrong...

 

Do you have any idea on how to decode these?

 

Thanks for your help,

 

Julien

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Customers Also Viewed These Support Documents