Example: SONUS Logs

SONUS Logs

This example recipe parse, reassemble and convert Sonus SBC logs back into IP/SIP/HEP types, shipped to a HEP Capture Server such as HOMER, for use cases where encrypted communication is unavailable off-the-wire for monitoring and troubleshooting.

Dependencies

paStash needs the following additional modules installed before execution:

# git clone https://github.com/sipcapture/paStash
# cd paStash/
# npm install
# npm install moment

Recipe

input {
  file {
    path => "/var/log/sonus-webui.log"
    #    start_index => 0
  }
}

filter {
  app_sonus {}
}

output {
  if [rcinfo] != 'undefined' {
        hep {
          host => '127.0.0.1'
          port => 9060
          hep_id => 2222
          hep_type => 1
        }
  }
}

Usage

./bin/pastash --config_file=/path/to/pastash_sonus.conf

Raw Logs

[2017-07-27 10:46:40,281] 5993 0001 com.sonus.sbc.sip DEBUG (TransportLayer.cpp:733) - 0x41828600 sending from [10.3.2.1]:38058 to [10.5.4.3]:5060 GCID=2115, size=1038 over 00TCP25063-38058 attempt(1) (If:14031) ln(828):
...
OUTBOUND SIP
...
[2017-07-27 10:46:40,947] 6004 0001 com.sonus.sbc.sip DEBUG (TransportLayer.cpp:979) - DataReadCB: Incoming message on [10.3.2.1]:38058 from [10.5.4.3]:5060 size=728, data: 0x4181cb58, current chunk: 0
...
INBOUND SIP
...