logging error events to database - sr-users

Alex Balashov

29 Jan 29 Jan

9:32 p.m.

Not directly from Kamailio, unless you want to "log" manually using sql_query(). Commonplace approaches for this: 1) Forward Kamailio syslog data to a syslog-ng server - i.e. in your local /etc/rsyslog.conf or whatever: local0.error @remote.server:514 syslog-ng supports PostgreSQL and other storage destinations: https://wiki.archlinux.org/index.php/syslog-ng#PostgreSQL_Destination And it can filter and parse entries based on regular expressions to make what you store more selective. However, beware of the uncertain performance characteristics of this setup under heavy loads, and also the poor suitability of RDBMs to short-lived data sets that constantly turn over. Lessons learned the hard way. 2) The Elasticsearch way -- which originally required Elasticsearch + Logstash, but now apparently can work through syslog-ng directly: https://www.syslog-ng.com/community/b/blog/posts/logging-to-elasticsearch-m… Of course, you can still go the traditional Logstash route. I haven't personally used Elasticsearch, but it sounds like the better way to go than a traditional RDBM if you're dealing with large volumes of syslog data that are rotated out frequently. On the other hand, if you're only looking to log occasional critical errors, not "everything", then just about any approach will work fine. -- Alex On 1/29/21 1:16 PM, Sergiu Pojoga wrote:

...

Hi there, I was wondering if there's a way to log various core error events in some DB. For example, below error occurred Jan 29 11:43:56 kamailio[11076]: {1 11440 INVITE 28b653bd-8f62-4085-a5ef-f2a4ac0f393d } ERROR: <core> [core/parser/sdp/sdp_helpr_funcs.c:499]: extract_mediaip(): no `IP[4|6]' address in `c=' field Jan 29 11:43:56 kamailio[11076]: {1 11440 INVITE 28b653bd-8f62-4085-a5ef-f2a4ac0f393d } ERROR: <core> [core/parser/sdp/sdp.c:430]: parse_sdp_session(): can't extract common media IP from the message Thanks in advance. Regards, --Sergiu _______________________________________________ Kamailio (SER) - Users Mailing List sr-users(a)lists.kamailio.org https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

-- Alex Balashov | Principal | Evariste Systems LLC Tel: +1-706-510-6800 / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/

Reply

Sergiu Pojoga

10:29 p.m.

Thanks Alex & Daniel for suggesting these ingenious potential solutions. On Fri, Jan 29, 2021 at 2:09 PM Daniel-Constantin Mierla <miconda(a)gmail.com> wrote:

...

To add a little bit, look at log_custom, the log message can be forwarded over udp to another application, which can be developed for specific purposes, like writing to database, probably easy to do using golang or python. Cheers, Daniel On 29.01.21 19:32, Alex Balashov wrote:

Not directly from Kamailio, unless you want to "log" manually using sql_query(). Commonplace approaches for this: 1) Forward Kamailio syslog data to a syslog-ng server - i.e. in your local /etc/rsyslog.conf or whatever: local0.error @remote.server:514 syslog-ng supports PostgreSQL and other storage destinations: https://wiki.archlinux.org/index.php/syslog-ng#PostgreSQL_Destination And it can filter and parse entries based on regular expressions to make what you store more selective. However, beware of the uncertain performance characteristics of this setup under heavy loads, and also the poor suitability of RDBMs to short-lived data sets that constantly turn over. Lessons learned the hard way. 2) The Elasticsearch way -- which originally required Elasticsearch + Logstash, but now apparently can work through syslog-ng directly:

https://www.syslog-ng.com/community/b/blog/posts/logging-to-elasticsearch-m…

Of course, you can still go the traditional Logstash route. I haven't personally used Elasticsearch, but it sounds like the better way to go than a traditional RDBM if you're dealing with large volumes of syslog data that are rotated out frequently. On the other hand, if you're only looking to log occasional critical errors, not "everything", then just about any approach will work fine. -- Alex On 1/29/21 1:16 PM, Sergiu Pojoga wrote:

Hi there, I was wondering if there's a way to log various core error events in some DB. For example, below error occurred Jan 29 11:43:56 kamailio[11076]: {1 11440 INVITE 28b653bd-8f62-4085-a5ef-f2a4ac0f393d } ERROR: <core> [core/parser/sdp/sdp_helpr_funcs.c:499]: extract_mediaip(): no `IP[4|6]' address in `c=' field Jan 29 11:43:56 kamailio[11076]: {1 11440 INVITE 28b653bd-8f62-4085-a5ef-f2a4ac0f393d } ERROR: <core> [core/parser/sdp/sdp.c:430]: parse_sdp_session(): can't extract common media IP from the message Thanks in advance. Regards, --Sergiu _______________________________________________ Kamailio (SER) - Users Mailing List sr-users(a)lists.kamailio.org https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

-- Alex Balashov | Principal | Evariste Systems LLC Tel: +1-706-510-6800 / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/ _______________________________________________ Kamailio (SER) - Users Mailing List sr-users(a)lists.kamailio.org https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

-- Daniel-Constantin Mierla -- www.asipto.com www.twitter.com/miconda -- www.linkedin.com/in/miconda Funding: https://www.paypal.me/dcmierla _______________________________________________ Kamailio (SER) - Users Mailing List sr-users(a)lists.kamailio.org https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

Reply

Sergiu Pojoga

9:09 p.m.

Hi Joel, No. That particular case occurred with a client's Yeastar S100 PBX, where during a Re-INVITE it would send an empty SDP c= field. Buggy appliance. On Sat, Jan 30, 2021 at 11:23 AM Joel Serrano <joel(a)textplus.com> wrote:

...

Hey Sergiu, I’m curious, have you seen that happen by any chance on the kams your have taking with MSTeams? Joel. On Fri, Jan 29, 2021 at 11:31 Sergiu Pojoga <pojogas(a)gmail.com> wrote:

Thanks Alex & Daniel for suggesting these ingenious potential solutions. On Fri, Jan 29, 2021 at 2:09 PM Daniel-Constantin Mierla < miconda(a)gmail.com> wrote:

To add a little bit, look at log_custom, the log message can be forwarded over udp to another application, which can be developed for specific purposes, like writing to database, probably easy to do using golang or python. Cheers, Daniel On 29.01.21 19:32, Alex Balashov wrote:

Not directly from Kamailio, unless you want to "log" manually using sql_query(). Commonplace approaches for this: 1) Forward Kamailio syslog data to a syslog-ng server - i.e. in your local /etc/rsyslog.conf or whatever: local0.error @remote.server:514 syslog-ng supports PostgreSQL and other storage destinations: https://wiki.archlinux.org/index.php/syslog-ng#PostgreSQL_Destination And it can filter and parse entries based on regular expressions to make what you store more selective. However, beware of the uncertain performance characteristics of this setup under heavy loads, and also the poor suitability of RDBMs to short-lived data sets that constantly turn over. Lessons learned the hard way. 2) The Elasticsearch way -- which originally required Elasticsearch + Logstash, but now apparently can work through syslog-ng directly:

https://www.syslog-ng.com/community/b/blog/posts/logging-to-elasticsearch-m…

Of course, you can still go the traditional Logstash route. I haven't personally used Elasticsearch, but it sounds like the better way to go than a traditional RDBM if you're dealing with large volumes of syslog data that are rotated out frequently. On the other hand, if you're only looking to log occasional critical errors, not "everything", then just about any approach will work fine. -- Alex On 1/29/21 1:16 PM, Sergiu Pojoga wrote: > Hi there, > > I was wondering if there's a way to log various core error events in > some DB. > > For example, below error occurred > > Jan 29 11:43:56 kamailio[11076]: {1 11440 INVITE > 28b653bd-8f62-4085-a5ef-f2a4ac0f393d } ERROR: <core> > [core/parser/sdp/sdp_helpr_funcs.c:499]: extract_mediaip(): no > `IP[4|6]' address in `c=' field > > Jan 29 11:43:56 kamailio[11076]: {1 11440 INVITE > 28b653bd-8f62-4085-a5ef-f2a4ac0f393d } ERROR: <core> > [core/parser/sdp/sdp.c:430]: parse_sdp_session(): can't extract > common media IP from the message > > Thanks in advance. Regards, > --Sergiu > > _______________________________________________ > Kamailio (SER) - Users Mailing List > sr-users(a)lists.kamailio.org > https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users > -- Alex Balashov | Principal | Evariste Systems LLC Tel: +1-706-510-6800 / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/ _______________________________________________ Kamailio (SER) - Users Mailing List sr-users(a)lists.kamailio.org https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

-- Daniel-Constantin Mierla -- www.asipto.com www.twitter.com/miconda -- www.linkedin.com/in/miconda Funding: https://www.paypal.me/dcmierla _______________________________________________ Kamailio (SER) - Users Mailing List sr-users(a)lists.kamailio.org https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

_______________________________________________ Kamailio (SER) - Users Mailing List sr-users(a)lists.kamailio.org https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

Reply