View Source

The following Admin Guide explains how to collect syslog trace from Wildix devices without installation of syslog server.

<div id="fb-root"></div>
<script>(function(d, s, id) {
  var js, fjs = d.getElementsByTagName(s)[0];
  if (d.getElementById(id)) return;
  js = d.createElement(s); js.id = id;
  js.src = 'https://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v2.11';
  fjs.parentNode.insertBefore(js, fjs);
}(document, 'script', 'facebook-jssdk'));</script>

<span class="page-title-pdf">Collecting Syslog from Wildix Devices - Admin Guide - English</span>

<div class="fb-like" data-href="https://confluence.wildix.com/x/EIC3" data-layout="button_count" data-action="recommend" data-size="large" data-show-faces="true" data-share="true"></div>

 <div class="lang-box-pdf">
	<div>
		<div class="google-lang">
			<div id="google_translate_element">
			</div>
			<script type="text/javascript">
					function googleTranslateElementInit() {
						new google.translate.TranslateElement({pageLanguage: 'en', includedLanguages: 'de,es,fr,it,nl', autoDisplay: false}, 'google_translate_element');
						}
			</script>
			<script type="text/javascript" src="//translate.google.com/translate_a/element.js?cb=googleTranslateElementInit"></script>
		</div>
		
		<div class="pdf-button">
			<a href="https://confluence.wildix.com/spaces/flyingpdf/pdfpageexport.action?pageId=20711257" alt="Convert to .pdf" title="Convert to .pdf"><img src="https://confluence.wildix.com/download/attachments/14549012/pdf-button-download-wildix-documentation.png"></a>
		</div>
	</div>
</div>

Collecting syslog from your Wildix devices can be useful in order to debug various issues. The best solution is to install Syslog Server reachable from outside your network. But in case Syslog Server can't be installed, there is still a possibility to capture data from your Wildix devices.

Step 1. Enable Syslog server on your devices via provisioning

Go to WMS -> Devices
Select a device/ devices from the list and click Edit
Enable "Syslog Server" option and enter the PBX IP address or domain name into the field
Click Save
After changes are saved, click Configure/Sync device

Step 2. Capture syslog trace from PBX

Method 1 (a single trace)

To capture a single trace:

Go to WMS Settings -> Tools and utilities -> Generate trace
Enable "Custom tcpdump" option and enter the following string:

-v -s0 -i any host <DEVICE_IP> and port 514

Where:

<DEVICE_IP> is the IP address of your device.

Click Start to generate a file
When the file is generated, click Stop

Note: a pcap file “trace_YYYY-MM-DD_HH-MM.pcap” is saved to /mnt/backups/traces/ folder.

Important: The max size of 1 file is 50MB. In case its size reaches more than 50MB, a new file will be gererated automatically.

Method 2 (a long-time trace)

To capture a long-time trace:

Open Terminal in the top menu of WMS and run the following command via SSH:
Note: the access to Terminal is enabled only for admin users.

# sudo tcpdump -s0 -i any -w /mnt/backups/traces/<FILE_NAME>.pcap host <DEVICE_IP> and port 514

Where:

<FILE_NAME> is the name of a file. You can put any name here.

<DEVICE_IP> is the IP address of your device.

Example:

# sudo tcpdump -s0 -i any -w /mnt/backups/traces/test_trace.pcap host 10.100.5.127 and port 514

Note: in case you need to collect syslog trace from various devices, run the following command via SSH:

sudo tcpdump -s0 -i any -w /mnt/backups/traces/<FILE_NAME>.pcap "(host <DEVICE_1> or host DEVICE_2> or host DEVICE_3>)" and port 514

Where:

<FILE_NAME> is the name of a file.

<DEVICE_1>, DEVICE_2>, DEVICE_3> are the IP addresses of your devices.

Once you finished to collect syslog trace, use CTRL+C to terminate the SSH sesion

Activate a long-time trace in background

Run the following command via SSH:

# sudo tcpdump -s0 -i any -w /mnt/backups/traces/<FILE_NAME>.pcap host <DEVICE_IP> and port 514 -C 50 -W 10&

Where:

<FILE_NAME> is the name of a file.

<DEVICE_IP> is the IP address of your device.

-C XX is the max size in MB for each pcap file.

-W XX is the max number of pcap files.

& means that pcap trace will be activated in background (it will be still active even if you terminate the SSH session).

Stop a long-time trace in background

Run the following command via SSH to check the process ID that is needed for terminating a trace:

ps aux |grep tcpdump

To stop a trace, run the following command. Put the process ID instead of <PID>:

kill -9 <PID>

Step 3. Generate the syslog file

Run the following command via SSH:

# sudo tcpdump -A -r /mnt/backups/traces/<FILE_NAME>.pcap | sed '/^\s*$/d' | grep -v "SYSLOG" > /mnt/backups/traces/syslog_device_YYYY-MM-DD.log

Where:

<FILE_NAME> is the name used to generate a long-time trace (See Method 2).

Step 4. Download the syslog

To download the file, run the command via SSH:

/home/admin/syslog_device_YYYY-MM-DD.log

Step 5. Disable Syslog server on your devices

Select a device/ devices in WMS -> Devices and click Edit
Disable "Syslog Server" option and delete the PBX IP address or domain name
Click Save
To complete the action, click Configure/Sync device

<div class="fb-like" data-href="https://confluence.wildix.com/x/WQc8AQ" data-layout="button_count" data-action="recommend" data-size="large" data-show-faces="true" data-share="true"></div>

<div class="ask-question">
		<div class="text-before-buttons">
			<span style="font-size: 24px; text-align: center;">Not finding the help you need?</span><br>
Join the Facebook group to ask a question!
		</div>
<div class="fb-buttons">
<span style="align: center;"><a href="https://www.facebook.com/groups/wildixtechwizards" target="_blank"><img src="https://manuals.wildix.com/wp-content/uploads/2017/03/facebook_tech-wizards.png" alt="facebook_tech-wizards" width="282" height="80" align="center"/></a></span></div>
	</div>
</div>