Syslog capture on an endpoint

[danny fabre]

I have an issue with a few SX80 have been installed and they drop calls only when it's an audio call and only sometimes. In the past I would have scheduled a few calls after hours and simply capture them all using a syslog over an SSH session to the endpoint but with TC7.x you can't do that anymore, the detailed logs on the website will only capture for 10 minutes at a time. How would you recommend I trouble shoot such an issue.

so you have the actual details this is the disconnections I've seen. 

2015-08-10T14:28:22.569-04:00 SalleQuebec9Drouin-905 appl[1234]: 3545314.26 CuilApp   User root(0) about to execute command '/Call/DisconnectAll' from .

2015-08-10T14:28:22.570-04:00 SalleQuebec9Drouin-905 appl[1234]: 3545314.27 MainEvents I: CallDisconnectRequested(p=167) remoteURI='sip:95819824881@10.10.120.12' cause=[normal('') 'LocalDisconnect']

and 

2015-08-10T14:28:22.952-04:00 SalleQuebec9Drouin-905 appl[1234]: 3545314.65 CuilApp   User root(0) about to execute command '/CallHistory/Recents Limit: 4' from .

2015-08-10T14:28:22.986-04:00 SalleQuebec9Drouin-905 appl[1234]: 3545314.68 SipPacket I: SIP Msg: Outgoing => BYE, CSeq: 101 BYE, Remote: 10.1.7.10:5061, CallId: 43c067a470462d729aecc0fa4b2e94e7

any help will be appreciated

cheers

Danny

[Wayne DeNardi]

As you've found, Cisco has decided to disable the root account completely for security reasons.  A new restricted user "remotesupport" can be created on the endpoint.

This user has read access to the system and a limited set of commands that can aid troubleshooting.

The user can be created from the System Recovery section > Remote Support User in the web interface.

Once the user is created a token will be presented.  To decode the token and acquire the password a Technical Assistance Center (TAC) case must be opened.

Have a look at this thread: tc71-now-released-and-available-ciscocom for some ways of executing a full tcpdump and some other troubleshooting commands.

Wayne
--
Please remember to rate responses and to mark your question as answered if appropriate.