One of the things that have helped me throughout my struggles with Mitel/Shoretel is the NCC logs inside the shoreline data folder. These logs can be hard to read, and very aggravating. Let’s look at a log example.
Below is a table that explains each of the call letters at the beginning of the log.
| Call Letters | Event Name | What it does |
|---|---|---|
| C-CE | Call Creation Event | Call Initiation |
| L-CE | Leg Create Event | Follows a C-CE for every call setup. internal transfers (Blind Transfers) |
| L-IE | Leg Info Event | Follows a C-CE, L-CE. Leg info provides information on other parties in the call. |
| C-SE | Call State Event | State of call in progress, all parties. This includes RingBack, Offering, established, etc |
| LSE | Leg State Event | Follows a C-SE to inform the leg state changes. |
| L-DE | Leg Destroy Event | Call Teardown. The Leg is destroyed. |
| C-DE | Call Destroy Event | The call is destroyed by the user or system hung up. |
| G-MST | Media State Event | Media stats for the terminated call leg. Every RTP stream also has a media state event. |
Here are examples of what each part will look like.
| Trunk call Leg to PSTN | 40000001 |
| Internal call Leg | 200001B3 |
| Call GUID | 00020000-1aae-4f05-9cce-0010491e1b95 |
| PBX Responding to Party | ncc_media_ctl |
| Sip Info | “sip:3067@10.10.60.2:5441” |
| Some Info | (s:8757, r:8763, l:0) |
| Call Quality Info | (j:0,u:0,o:1) |
| Audio Type | 2(ULaw) |
Now let’s look at this example below and take it apart from a little. I’m no expert but I have gone through a few hundred of these logs.
- 00:21:06.511 ( 5268: 7496) C-CE: 200001B3 ” guid=000a0000-48d7-5dea-a92f-005056a6c1e2” (“4003″,”Raleigh Distribution 3″,0xC) 00000000,SDP:N,ipCDS:0x0000000A, flgs:0x00000000, cd:0x00000000,”” “sip:4003@10.10.29.162:5441“
- 00:21:06.511 ( 5268: 7496) L-CE: 200001B3 ” guid=000a0000-48d7-5dea-a92f-005056a6c1e2” 010710EE(00000000) ,Req:00000000, 1, Flgs:00000000(Null) “sip:4003@10.10.29.162:5441“
- 00:21:09.421 ( 5268: 7496) L-IE: 200001B3 ” guid=000a0000-48d7-5dea-a92f-005056a6c1e2” 010710EE,rsn:2(Originate),1, (“9+19105772816″,””,0x8(Number)), C(“4003″,”Raleigh Distribution 3”, 0xC(NameNumber)) contact=sip:TGrp_5,p77@10.10.35.10:5441, “sip:4003@10.10.29.162:5441“
- 00:21:09.421 ( 5268: 7496) C-SE: 200001B3 ” guid=000a0000-48d7-5dea-a92f-005056a6c1e2” 5(Established), sd:0,04:21:09.435 (UTC) “sip:4003@10.10.29.162:5441” “”
- 00:21:09.421 ( 5268: 7496) L-SE: 200001B3 ” guid=000a0000-48d7-5dea-a92f-005056a6c1e2” 010710EE, 5(Established), 536870912, 04:21:09.435 (UTC) “sip:4003@10.10.29.162:5441“
- 00:21:29.294 ( 5268: 7496) C-SE: 200001B3 ” guid=000a0000-48d7-5dea-a92f-005056a6c1e2” 17(FarEndAnswered), sd:0,04:21:09.435 (UTC) “sip:4003@10.10.29.162:5441” “”
- 00:22:06.746 ( 5268: 7496) L-DE: 200001B3 ” guid=000a0000-48d7-5dea-a92f-005056a6c1e2” 010710EE, rsn:1(Normal), C(“4003″,”Raleigh Distribution 3”,0xC) TrGp=5 “sip:4003@10.10.29.162:5441“
- 00:22:06.746 ( 5268: 7496) C-DE: 200001B3 ” guid=000a0000-48d7-5dea-a92f-005056a6c1e2” 1, (Normal) “sip:4003@10.10.29.162:5441“
- 00:22:06.975 ( 5268: 7496) G-MST: 200001B3 ” guid=000a0000-48d7-5dea-a92f-005056a6c1e2” (“10.10.41.93″,”10.10.35.10”), (0, 0), 2(ULaw), rsn:1,04:21:11.710 (UTC), pl:20,(s:2761, r:2764, l:0), (j:0,u:0,o:0) flgs:0x00000000 “sip:4003@10.10.29.162:5441“,vpn:0
I hope this is helpful. I’m no expert, but I do follow the logs to see where they lead me.
Thanks for your blog, nice to read. Do not stop.