[cisco-voip] CER question

[Pawlowski, Adam]

Hi James,

As you may have already found out CER is not really a robust piece of software . In my experience with it, it is best left alone when it is operating such that it doesn't decide to have the phone tracking engine simply stop operating. 

A lot of what you'll see in any output from CER are snippets from various log files. Sometimes it seems they bleed together like they're not actually files persay until the messages from the application are written there from various buffers. It would make sense if you've seen it but hopefully you don't have to.

The email information and syslog output are the same thing for the most part. Syslog lines look like this (numbers scrubbed as X they are not patterns):


2017-10-30T14:23:26-04:00 EDT cer01prod CER_ONSITEALERT-4:Emergency call DetailsCaller Extension:191XXXXXXZone/ERL :DefaultLOCATION :Call Time :October 30, 2017 2:23:26 PM EDT
2017-10-30T14:46:08-04:00 EDT cer01prod CER_ONSITEALERT-4:Emergency call DetailsCaller Extension:484XXXX3Zone/ERL :DefaultLOCATION :Call Time :October 30, 2017 2:46:08 PM EDT
2017-10-30T15:02:23-04:00 EDT cer01prod CER_ONSITEALERT-4:Emergency call DetailsCaller Extension:64XXXXX4Zone/ERL :Bissell HallLOCATION :124 Bissell Hall Call Time :October 30, 2017 3:02:23 PM EDT

The email actually contains that same line just with the text massaged a bit, and a link to the user interface. If it comes from the backup CER server because someone dialed your backup trigger then it says that too. Syslog doesn't though, it just shows up in the other machine's log.

I actually went to look to see if the API for CER became useful recently (it has not) but note the following from that devnet page:

*Note: Alerts via SNMP, 911 call monitor/barge-in (post-Bravo CallManager feature) will be included in the future.

I don't know what "Bravo" is or why this is listed on the website, but these features don't exist as it stands today. The API won't be of much help to you to try and figure out which device/MAC originated the call, it just dumps all the information in a given category from ER. You can look up the line in the UCM with the AXL API if you want to do that, but, if it is a shared line then who knows. The point with the application is more to know where someone is moreso than the device specifically - that information is available from reporting and the ceruser interface.

You could take in the email or watch the syslog, then parse those out and express whatever you'd want to from them. If you wanted to operate CER unattended for some reason (I can't think of too many good reasons to do this but you ....could) you could target the on-site voice alert or even the ERL's target to an extension on an IOS router that triggers some sort of email or message if you wanted to have a silent alarm type thing. 

Best,

Adam