EEM applet event from SIP syslog message

[Alfred Johnson]

I want to use an EEM applet on a Cisco IOS 2431 voice gateway running 15.1(2)T to take action upon expiration of a SIP registration (with its sip registrar).  I thought that it might be possible to use existing error messages generated by the ios sip application to trigger an EEM applet.

Is there a reference that lists all SYSLOG messages that SIP can generates, and their error levels?  Can you show me how to turn on syslog messages, so that I can cause a SIP registration expiration on my GW and then see what SYSLOG messages are produced?

I think I understand how to write an applet and its event trigger from a SYSLOG message pattern, but I am having trouble seeing any SIP error messages at all, except if I turn on Debug, which usually produces way too many messages and may impact performance.

I found information on turning on SYSLOG in the Cisco IOS Network Management Config Guide for 15.1, and I did not find it in the SIP Config Guide referenced  by yidabear.  I believe you use the command: logging trap [info|notif|warn|error...] and/or logging buffered [buffersize] [info|notif|warn|error...] I cannot afford to turn on debug ccsip messages in the field during normal operations, because it greatly increases cpu time usage and causes dropped calls under moderate call load. Message was edited by: Alfred Johnson

[yjdabear]

I recall many of the SYSLOG messages are listed at the end of the Release Notes of the particular IOS, but it's never exhaustive.

As far as turning on syslogging, refer to

http://www.cisco.com/en/US/docs/ios/voice/sip/configuration/guide/15_1/sip_15_1_book.pdf

On pgs 87-88, there're a couple of sample outputs of SIP syslogs, from a combination of either "debug ccsip event" or "debug ccsip info" AND "logging buffered 1000000 debugging". There's more sample output on pg 317. If those don't produce the SIP registration message you're looking for as the applet trigger, try "debug ccsip error", "debug ccsip message", or even "debug ccsip all" (sample output on pg 453) to see if any would produce more verbose output. Those commands are all you need if you intend to look at the syslogs with "show logging" on the 2431.

If you want to send the logs also to an external syslog server, configure the following as well:

logging source-interface FastEthernet0/0

logging host ip.addr.of.server