[cisco-voip] Re: Tracing call through CCM Logs

[Kevin Thorngren]

Hi Anthony,

First of all you will want to make sure the CCM traces are set to  
"Detailed" and that you don't have have Device Name Based tracing  
enabled.  Also, you may need to look at traces from more than one  
CallManager, depending on which one is processing the call and if one  
of the devices is registered to another CCM then the signaling will be  
from that CCM.

The call reference value will toggle the high order bit depending on  
the direction of the signal.  For example the high order bit set to 0,  
ie, 0x0097 for the signaling from the GW.  The signaling from CCM then  
will have the high order bit set to 1, ie, 0x8097.  You can grep on 097  
to find both sides of the signaling.

Here is the process I use to track an outgoing call from an IP Phone.   
First I need to know the call time, the calling number and the called  
number.  My first goal is to find the TCP Handle of the phone making  
the call.  One way to find this is to know the mac address of the phone  
then search the CCM traces for KeepAlive messages for this phone.  This  
example is from a 4.0 server but 3.3 and less will be the same with a  
slightly different format.

Here is the KeepAlive:
01/14/2005 14:38:51.135 CCM|InboundStim - KeepAliveMessage - Send  
KeepAlive to Device Controller. DeviceName=SEP000ED74CF0D0, TCPPid =  
[2.100.131.64498], IPAddr=10.2.8.57, Port=0, Device  
Controller=[2,117,2465]  <<<< The last number listed, 2465, is the TCP  
Handle.

The TCP Handle in 4.0 is a seven digit number and in the trace this  
device will be 0002465.  Now, grep on the TCP Handle and look for the  
call.

Once we have the TCP handle now we can search for the call.  Searching  
for the dialed number, ie 95551212, should put us close to where the  
call will be extended to the GW.  I search for the following:     
dd="95551212"

01/14/2005 14:38:30.340 CCM|StationInit: (0002465) KeypadButton  
kpButton=2.|<CLID::CCM-PUB-Cluster><NID::10.2.22.11><CT:: 
2,100,118,1.28468820><IP::10.2.8.57><DEV::SEP000ED74CF0D0>
01/14/2005 14:38:30.340 CCM|StationD(2465): StationCtiD -  
StationKeypadButton|<CLID::CCM-PUB-Cluster><NID::10.2.22.11><CT:: 
2,100,118,1.28468820><IP::10.2.8.57><DEV::SEP000ED74CF0D0>
01/14/2005 14:38:30.340 CCM|Digit Analysis: getDaRes -  
voiceMailCallingSearchSpace=[{5798AC5E-4BB4-4088-A091 
-8E50E322341D}]|<CLID::CCM-PUB-Cluster><NID::10.2.22.11><CT:: 
2,100,118,1.28468820><IP::10.2.8.57><DEV::SEP000ED74CF0D0>

=== This line will be found with the search dd="95551212".  You can  
look a few line above and see the phone signaling CCM with the dialed  
digits to verify this is the call, ie, StationInit: (0002465)  
KeypadButton kpButton=2
01/14/2005 14:38:30.340 CCM|Digit analysis: match(pi="1", fqcn="",  
cn="8833",plv="5", pss="Local-PT:Global Long Distance,  
dd="95551212",dac="0")|<CLID::CCM-PUB-Cluster><NID::10.2.22.11><CT:: 
2,100,118,1.28468820><IP::10.2.8.57><DEV::SEP000ED74CF0D0>

=== You will then see a section with the digit analysis results
01/14/2005 14:38:30.340 CCM|Digit analysis: analysis  
results|<CLID::CCM-PUB-Cluster><NID::10.2.22.11><CT:: 
2,100,118,1.28468820><IP::10.2.8.57><DEV::SEP000ED74CF0D0>
01/14/2005 14:38:30.340 CCM||PretransformCallingPartyNumber=8833
|CallingPartyNumber=8833
|DialingPartition=Local-PT
|DialingPattern=9.[2-9]XXXXXX
|DialingRoutePatternRegularExpression=(9)([2-9]XXXXXX)

=== After this section you will then see CCM choosing the Route List,  
etc
01/14/2005 14:38:30.340 CCM|RouteList -  
RouteListName=''Tahlequah-Local-RL''|<CLID::CCM-PUB-Cluster><NID:: 
10.2.22.11>

=== After CCM chooses the GW you should see an outbound setup message,  
the Call Reference number will be in the ISDN Data
01/14/2005 14:38:30.372 CCM|IsdnMsgData2= 08 02 10 5F <snip>

In this case the Call Reference is 10 5F.  If you grep on "0 5F" you  
should be able to find the signaling in both directions.  You can also  
use the Q931 Translator to have the ISDN data decoded.  It can be found  
on the CallManager under C:\Program Files\Cisco\Bin.

Hope this helps.

Kevin

On Jan 18, 2005, at 5:37 AM, Anthony Mendoza wrote:

> What's the best identifier / string to use when trying to trace a call
> through CCM Trace logs?  I'm trying to find out what GW was used on a
> specific outgoing call, but am having trouble seeing where this happens
> as I'm going through the log line by line.  I've tried searching the
> "callReference" variable, but wasn't sure if this was the best way.
> Ideally, I wanted to grep through the file and eliminate all the lines
> of what I'm not looking for so it will be easier for me to see the
> setup/teardown of a specific call.
>
> Any help would be great.
> --
> Anthony Mendoza
>
>
> CONFIDENTIALITY NOTICE: The information contained in this message and
> or attachments is intended only for the person or entity to which it is
> addressed and may contain confidential and/or privileged material. Any
> review, retransmission, dissemination, copying, or other use of this
> information by persons or entities other than the intended recipient is
> prohibited. If you received this e-mail or its attachments in error,
> please contact the sender and delete the material from any system and
> destroy any copies.
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip