User`s manual

SIP User's Manual 13. Diagnostics
Version 5.0 303 December 2006
13.3 Syslog Support
Syslog protocol is an event notification protocol that enables a machine to send event
notification messages across IP networks to event message collectors - also known as
Syslog servers. Syslog protocol is defined in the IETF RFC 3164 standard.
Since each process, application and operating system was written independently, there is
little uniformity to Syslog messages. For this reason, no assumption is made on the
contents of the messages other than the minimum requirements of its priority.
Syslog uses UDP as its underlying transport layer mechanism. The UDP port can be
defined using SyslogServerPort parameter (default port is 514).
The Syslog message is transmitted as an ASCII (American Standard Code for Information
Interchange) message. The message starts with a leading ‘<’ ('less-than' character),
followed by a number, which is followed by a ‘>’ ('greater-than' character). This is optionally
followed by a single ASCII space.
The number described above is known as the Priority and represents both the Facility and
Severity as described below. The Priority number consists of one, two, or three decimal
integers.
For example:
<37> Oct 11 16:00:15 mymachine su: 'su root' failed for lonvick on
/dev/pts/8
13.3.1 Syslog Servers
Users can use the provided AudioCodes Syslog server (ACSyslog) or any other third-party
Syslog servers.
Examples of Syslog servers available as shareware on the Internet:
 Kiwi Enterprises: www.kiwisyslog.com/
 The US CMS Server: uscms.fnal.gov/hanlon/uscms_server/
 TriAction Software: www.triaction.nl/Products/SyslogDaemon.asp
 Netal SL4NT 2.1 Syslog Daemon: www.netal.com
A typical Syslog server application enables filtering of the messages according to priority,
IP sender address, time, date, etc.