One of the things that have helped me throughout my struggles with Mitel/Shoretel is the NCC logs inside the shoreline data folder. These logs can be hard to read, and very aggravating. Let’s look at a log example.

Below is a table that explains each of the call letters at the beginning of the log.

Call LettersEvent NameWhat it does
C-CECall Creation EventCall Initiation
L-CELeg Create EventFollows a C-CE for every call setup. internal transfers (Blind Transfers)
L-IELeg Info EventFollows a C-CE, L-CE. Leg info provides information on other parties in the call.
C-SECall State EventState of call in progress, all parties. This includes RingBack, Offering, established, etc
LSELeg State EventFollows a C-SE to inform the leg state changes.
L-DELeg Destroy EventCall Teardown. The Leg is destroyed.
C-DECall Destroy EventThe call is destroyed by the user or system hung up.
G-MSTMedia State EventMedia stats for the terminated call leg. Every RTP stream also has a media state event.

Here are examples of what each part will look like.

Trunk call Leg to PSTN40000001
Internal call Leg200001B3
Call GUID00020000-1aae-4f05-9cce-0010491e1b95
PBX Responding to Partyncc_media_ctl
Sip Info“sip:3067@10.10.60.2:5441”
Some Info(s:8757, r:8763, l:0)
Call Quality Info(j:0,u:0,o:1)
Audio Type2(ULaw)

Now let’s look at this example below and take it apart from a little. I’m no expert but I have gone through a few hundred of these logs.

  • 00:21:06.511 ( 5268: 7496) C-CE: 200001B3 ” guid=000a0000-48d7-5dea-a92f-005056a6c1e2” (“4003″,”Raleigh Distribution 3″,0xC) 00000000,SDP:N,ipCDS:0x0000000A, flgs:0x00000000, cd:0x00000000,”” “sip:4003@10.10.29.162:5441
  • 00:21:06.511 ( 5268: 7496) L-CE: 200001B3 ” guid=000a0000-48d7-5dea-a92f-005056a6c1e2” 010710EE(00000000) ,Req:00000000, 1, Flgs:00000000(Null) “sip:4003@10.10.29.162:5441
  • 00:21:09.421 ( 5268: 7496) L-IE: 200001B3 ” guid=000a0000-48d7-5dea-a92f-005056a6c1e2” 010710EE,rsn:2(Originate),1, (“9+19105772816″,””,0x8(Number)), C(“4003″,”Raleigh Distribution 3”, 0xC(NameNumber)) contact=sip:TGrp_5,p77@10.10.35.10:5441, “sip:4003@10.10.29.162:5441
  • 00:21:09.421 ( 5268: 7496) C-SE: 200001B3 ” guid=000a0000-48d7-5dea-a92f-005056a6c1e2” 5(Established), sd:0,04:21:09.435 (UTC) “sip:4003@10.10.29.162:5441” “”
  • 00:21:09.421 ( 5268: 7496) L-SE: 200001B3 ” guid=000a0000-48d7-5dea-a92f-005056a6c1e2” 010710EE, 5(Established), 536870912, 04:21:09.435 (UTC) “sip:4003@10.10.29.162:5441
  • 00:21:29.294 ( 5268: 7496) C-SE: 200001B3 ” guid=000a0000-48d7-5dea-a92f-005056a6c1e2” 17(FarEndAnswered), sd:0,04:21:09.435 (UTC) “sip:4003@10.10.29.162:5441” “”
  • 00:22:06.746 ( 5268: 7496) L-DE: 200001B3 ” guid=000a0000-48d7-5dea-a92f-005056a6c1e2” 010710EE, rsn:1(Normal), C(“4003″,”Raleigh Distribution 3”,0xC) TrGp=5 “sip:4003@10.10.29.162:5441
  • 00:22:06.746 ( 5268: 7496) C-DE: 200001B3 ” guid=000a0000-48d7-5dea-a92f-005056a6c1e2” 1, (Normal) “sip:4003@10.10.29.162:5441
  • 00:22:06.975 ( 5268: 7496) G-MST: 200001B3 ” guid=000a0000-48d7-5dea-a92f-005056a6c1e2” (“10.10.41.93″,”10.10.35.10”), (0, 0), 2(ULaw), rsn:1,04:21:11.710 (UTC), pl:20,(s:2761, r:2764, l:0), (j:0,u:0,o:0) flgs:0x00000000 “sip:4003@10.10.29.162:5441“,vpn:0

I hope this is helpful. I’m no expert, but I do follow the logs to see where they lead me.