Guest

Cisco IOS Software Releases 12.4 T

X.25 Call Record

Hierarchical Navigation

Downloads

 Feedback

Table Of Contents

X.25 Call Record

Contents

Information about X.25 Call Record

The Call Record

How to Configure X.25 Call Record

Generating the Call Record

Configuring the Router's Syslog Facility

Prerequisites

Configuring the Remote Server

Prerequisites

Configuration and Content Examples for X.25 Call Record

Creating an X.25 Call Record Log: Configuration Example

Content of the Call Record: Examples

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Command Reference

x25 call-record

Feature Information for X.25 Call Record


X.25 Call Record

First Published: June 28, 2007

This feature generates a record of each X.25 call on the source, intermediate, and destination routers which process that call, and automatically sends the record to a Syslog server for storage and subsequent retrieval. This makes it possible to audit and track call activity on all X.25 ports in the network.

Finding Feature Information in This Module

See the "Feature Information for X.25 Call Record" section.

Finding Support Information for Platforms and Cisco IOS and Catalyst OS Software Images

Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

Contents

•Information about X.25 Call Record

•How to Configure X.25 Call Record

•Configuration and Content Examples for X.25 Call Record

•Additional References

•Command Reference

•Feature Information for X.25 Call Record

Information about X.25 Call Record

The structure and content of an X.25 call record are presented in the following section.

The Call Record

The call record is composed of the following fields:

•Start date and time; End date and time

•Host name; X.25 client

•Line type and number; Line address

•Line rotary number; Line rotary address; X.25 hunt group name

•Call direction; Calling address; Called address

•Interface name; Logical channel number

•Facilities:

–Input window size; Output window size

–Input packet size; Output packet size

–Input throughput; Output throughput

–Fast-select

–Reverse-charging

•Bytes sent; Bytes received

•Packets sent; Packets received

•Clear Cause and diagnostic code; or Clear Reason string.

For examples of such call records, see the "Content of the Call Record: Examples" section.

The call record is generated not only for completed calls, but also for calls which fail to set up successfully, and for calls which did set up successfully but were terminated before an exchange of X.25 clear packets could occur. In this last case, no Clear Cause or diagnostic codes are available to include in the call record, so instead a Clear Reason string is generated to indicate why the call was terminated.

How to Configure X.25 Call Record

Three procedures are required to implement this feature:

1. Turning on the record-generation process at each router: Generating the Call Record

2. Activating the router's Syslog Facility to send each call record automatically to a remote server: Configuring the Router's Syslog Facility

3. Configuring the remote server to store the call records in a log file, within a particular facility and at a particular severity level: Configuring the Remote Server.

Generating the Call Record

Normally, the router does not make a record of calls or call attempts. Therefore, to activate a process by which a record will be made of every call, whether successful or unsuccessful, perform the following task.

SUMMARY STEPS

1. enable

2. configure terminal

3. x25 call-record

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2 

configure terminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3 

x25 call-record

Example:

Router(config)# x25 call-record

Turns on the process for generating a record about each X.25 call originated at this router, received by this router, or switched through this router.

Configuring the Router's Syslog Facility

Once a record has been made, it must be stored in a remote server where it can be easily retrieved from any part of the network. You begin that arrangement by configuring the router's Syslog Facility.

Prerequisites

Because this task, like the previous one, takes place within Global Configuration Mode, you can continue directly from the previous task with the following command sequence. If you are not already in Global Configuration Mode, you must get there by performing Steps 1 and 2 of the section above.

SUMMARY STEPS

1. logging on

2. logging host {ip-address | host}

3. logging trap level

4. logging facility facility-type

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

logging on

Example:

Router(config)# logging on

Enables the sending of messages about system events (which will be, in this case, the call records).

Step 2 

logging host {ip-address | hostname}

Example:

Router(config)# logging host 10.3.18.24

Specifies the host device at which the call records will be stored.

•Several optional arguments are available to customize this command, including ports, transports, VPNs, ipv6, record filtering, XML, cipher suites, and trustpointing. Details are given in the documentation of this command within the Cisco IOS Network Management Command Reference, Release 12.4T.

Step 3 

logging trap level

Example:

Router(config)# logging trap 7

Assigns a severity level to the call records.

Step 4 

logging facility facility-type

Example:

Router(config)# logging facility local4

Determines which syslog facility will contain the call record log file; for example: local, system, user, etc.

Configuring the Remote Server

The syslog server that will be receiving the call records from the router needs to be told into which syslog facility and file it should put those records, and at what severity level. To input and then activate that information, perform this task.

Prerequisites

You must have root permissions to perform this configuration.

SUMMARY STEPS

1. Edit the etc/syslog.conf file.

2. Save the file and exit the editor.

3. Restart the server's syslog process.

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

Edit the /etc/syslog.conf file.

Example:

local4.debug       /var/log/Cisco.log

Inserts the pathname of the log file that will hold the call records, along with its facility-type and severity level.

•In this example, the log file's pathname is /var/log/Cisco.log, its facility-type is local4, and its severity level is 7 (debug).

•Note that the pathname must be separated from the rest of the statement by a tab, not a space.

Step 2 

Save the file and exit the editor.

 

Step 3 

Restart the server's syslog process.

Example:

/etc/init.d/syslog start

Loads the information you entered in Step 1 into the server's current RAM.

Configuration and Content Examples for X.25 Call Record

This section provides one configuration example and four record-content examples:.

Creating an X.25 Call Record Log: Configuration Example

In the following example, a router is configured to create call records and to send those records to a particular remote Syslog Server. Then that remote server is configured to place the received records into a particular log file within one of its "local" facilities.

Configuration at the router 

enable

configure terminal

x25 call-record

logging on

logging host 10.3.18.24

logging trap 7

logging facility local4

Configuration at the remote server

Edit /etc/syslog.conf 

local4.debug     /var/log/Cisco.log

Save the file.

Exit the Editor. 

/etc/init.d/syslog start

Content of the Call Record: Examples

The following record reports on a PAD-over-XOT call, which was terminated by a TCP connection teardown. 

Jun  7 09:13:11.547: %X25-5-CALL_RECORD:  

Start=09:12:33.635 UTC Wed Jun 7 2006, End=09:13:11.547 UTC Wed Jun 7 2006,  
Host=R3845-86-33, Client=PAD,  

Line=0(console 0),  

Call-direction=outgoing,  Calling-addr=3300,  Called-addr=3400, 

Interface=XOT (local: 9.2.86.33:31034 remote: 9.2.86.34:1998), Logical-channel=1024,  

Facilities=win-in 2, win-out 2, pkt-in 128, pkt-out 128, tput-in 0, tput-out 0, 
	fast-select no, reverse-charging no,  

Bytes sent/rcvd=4/95, Packets sent/rcvd=2/4, 

Clear reason=lower layer unavailable

The following record reports on an attempted PAD-over-XOT call, which failed when its destination was not found. 

Jun  7 09:10:12.019: %X25-5-CALL_RECORD:  

Start=09:10:12.011 UTC Wed Jun 7 2006, End=09:10:12.019 UTC Wed Jun 7 2006,  
Host=R3845-86-33, Client=PAD,  

Line=0(console 0),  

Call-direction=outgoing,  Calling-addr=3300,  Called-addr=3400, 

Interface=XOT (local: 9.2.86.33:48544 remote: 9.2.86.34:1998),  Logical-channel=1024,  

Facilities=win-in 2, win-out 2, pkt-in 128, pkt-out 128 tput-in 0, tput-out 0, 
	fast-select no, reverse-charging no,  

Bytes sent/rcvd=0/0, Packets sent/rcvd=0/0, 

Clear cause=13, Diag code=64

The following record reports on a PAD-over-serial call, cleared by a user-initiated X.25 restart. 

Jun  6 23:57:42.738: %X25-5-CALL_RECORD:  

Start=23:57:13.322 UTC Tue Jun 6 2006, End=23:57:42.738 UTC Tue Jun 6 2006,  
Host=3845-86-33, Client=PAD,  

Line=0(console 0),  

Call-direction=outgoing,  Calling-addr=33030,  Called-addr=34031, 

Interface=Serial0/3/0,  Logical-channel=1024,  

Facilities=win-in 2, win-out 2, pkt-in 128, pkt-out 128 tput-in 0, tput-out 0,  
	fast-select no, reverse-charging no,  

Bytes sent/rcvd=4/52, Packets sent/rcvd=2/3, 

Clear reason=X25 Restart

The following two records report on a call that transited an intermediate router, arriving on its serial interface and departing through XOT, routed over a hunt group:

Record of the Incoming Virtual Circuit 

Jun  7 10:42:00.131: %X25-5-CALL_RECORD:  

Start=10:41:54.187 UTC Wed Jun 7 2006, End=10:42:00.131 UTC Wed Jun 7 2006,  
Host=R3845-86-34, Client=Switch,  

Call-direction=incoming,  Calling-addr=33030,  Called-addr=3500, 

Interface=Serial0/3/1,  Logical-channel=1024,  

Facilities=win-in 2, win-out 2, pkt-in 128, pkt-out 128 tput-in 0, tput-out 0, fast-select

	no, reverse-charging no,  

Bytes sent/rcvd=52/55, Packets sent/rcvd=3/3, 

Clear cause=0, Diag code=0

Record of the Outgoing Virtual Circuit 

Jun  7 10:42:00.131: %X25-5-CALL_RECORD:

Start=10:41:54.187 UTC Wed Jun 7 2006, End=10:42:00.131 UTC Wed Jun 7 2006,  
Host=R3845-86-34, Client=Switch, Huntgroup=HG4,  

Call-direction=outgoing,  Calling-addr=33030,  Called-addr=3500, 

Interface=XOT (local: 10.2.86.34:23686 remote: 10.2.86.35:1998),  Logical-channel=1,  
Facilities=win-in 2, win-out 2, pkt-in 128, pkt-out 128 tput-in 0, tput-out 0, fast-select

	no, reverse-charging no,  

Bytes sent/rcvd=55/52, Packets sent/rcvd=3/3, 

Clear cause=0, Diag code=0

Additional References

The following sections provide references related to the X.25 Call Record feature.

Related Documents

Related Topic
Document Title

Configuring the router's syslog facility

Cisco IOS Network Management Command Reference, Release 12.4T

"Troubleshooting and Fault Management," in the Cisco IOS Configuration Fundamentals Configuration Guide, Release 12.2


Standards

Standard
Title

No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.

—


MIBs

MIB
MIBs Link

No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use the Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs


RFCs

RFC
Title

No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.

—


Technical Assistance

Description
Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a user ID or password, you can register on Cisco.com.

http://www.cisco.com/techsupport


Command Reference

This section documents one new command:

•x25 call-record

Details on all other commands mentioned in this document can be obtained by using Cisco's Command Lookup Tool, located at http://www.cisco.com/cgi-bin/Support/Cmdlookup/home.pl .

x25 call-record

To enable a record to be made of outgoing, incoming, and switched calls on the router, use the x25 call-record command in global configuration mode. To disable such record-making, use the no form of this command.

x25 call-record

no x25 call-record

Syntax Description

This command has no arguments or keywords.

Command Default

No call record is generated.

Command Modes

Global configuration (config)

Command History

Release
Modification

12.4(15)T

This command was introduced.


Usage Guidelines

Cisco recommends that you configure the router to use Syslog Facility to send the generated call records automatically to a remote syslog server, for immediate storage and subsequent retrieval. You'll find instructions on how to do that in the X.25 Call Record document.

Examples 

The following example enables generation of records about calls arriving, leaving, or being switched 
at the router:


x25 call-record

Following are two records generated by one such call, which arrived on an intermediate router's serial interface and departed through XOT, being routed over a hunt group:

Record of the Incoming VC 

Jun  7 10:42:00.131: %X25-5-CALL_RECORD:  

Start=10:41:54.187 UTC Wed Jun 7 2006, End=10:42:00.131 UTC Wed Jun 7 2006,  
Host=R3845-86-34, Client=Switch,  

Call-direction=incoming,  Calling-addr=33030,  Called-addr=3500, 

Interface=Serial0/3/1,  Logical-channel=1024,  

Facilities=win-in 2, win-out 2, pkt-in 128, pkt-out 128 tput-in 0, tput-out 0, fast-select 
	no, reverse-charging no,  

Bytes sent/rcvd=52/55, Packets sent/rcvd=3/3, 

Clear cause=0, Diag code=0

Record of the Outgoing VC 

Jun  7 10:42:00.131: %X25-5-CALL_RECORD:

Start=10:41:54.187 UTC Wed Jun 7 2006, End=10:42:00.131 UTC Wed Jun 7 2006,  
Host=R3845-86-34, Client=Switch, Huntgroup=HG4,  

Call-direction=outgoing,  Calling-addr=33030,  Called-addr=3500, 

Interface=XOT (local: 10.2.86.34:23686 remote: 10.2.86.35:1998),  Logical-channel=1,  
Facilities=win-in 2, win-out 2, pkt-in 128, pkt-out 128 tput-in 0, tput-out 0, fast-select 
	no, reverse-charging no,  

Bytes sent/rcvd=55/52, Packets sent/rcvd=3/3, 

Clear cause=0, Diag code=0

Related Commands

Command
Description

logging host

Enables logging to a remote syslog server.


Feature Information for X.25 Call Record

Table 1 lists the release history of this feature.

Not all commands may be available in your Cisco IOS software release. For release information about a specific command, see the command reference documentation.

Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which Cisco IOS and Catalyst OS software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

Note Table 1 lists only the Cisco IOS software release that introduced support for a given feature in a given Cisco IOS software release train. Unless noted otherwise, subsequent releases of that Cisco IOS software release train also support that feature.

Table 1 Feature Information for X.25 Call Record 

Feature Name
Releases
Feature Information

X.25 Call Record

12.4(15)T

This feature generates a record of X.25 calls that occur on the source, destination, and intermediate routers, and automatically sends that record to a remote syslog server for storage and subsequent retrieval.

In 12.4(15)T, this feature was introduced on the following platform series:

•800

•1400, 1600, 1700, 1800

•2500, 2600, 2800

•3600, 3700, 3800

•4000

•AS5300, AS5400

•7100, 7200, UBR7200, 7500

•MGX8800


CCVP, the Cisco logo, and the Cisco Square Bridge logo are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is a service mark of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick Study, LightStream, Linksys, MeetingPlace, MGX, Networking Academy, Network Registrar, Packet, PIX, ProConnect, ScriptShare, SMARTnet, StackWise, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0705R)

Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

© 2007 Cisco Systems, Inc. All rights reserved.