Troubleshooting Guide
Chapter 2 - Audit Troubleshooting
Downloads: This chapterpdf (PDF - 397.0KB) The complete bookPDF (PDF - 7.16MB) | Feedback

Audit Troubleshooting

Table Of Contents

Audit Troubleshooting

Introduction

Audit Events and Alarms

AUDIT (1)

AUDIT (2)

AUDIT (3)

AUDIT (4)

AUDIT (5)

AUDIT (6)

AUDIT (7)

AUDIT (8)

Monitoring Audit Events

Test Report - Audit (1)

Start or Stop of Signaling System 7 - Circuit Identification Code Audit - Audit (2)

Signaling System 7 Circuit Identification Code Audit Terminated Before Successful Completion - Audit (3)

Call Exceeds a Long-Duration Threshold - Audit (4)

Critical Internal Audit Failure - Audit (5)

Major Internal Audit Failure - Audit (6)

Minor Internal Audit Failure - Audit (7)

Warning From Internal Audit - Audit (8)

Troubleshooting Audit Alarms

Critical Internal Audit Failure - Audit (5)

Major Internal Audit Failure - Audit (6)

Minor Internal Audit Failure - Audit (7)


Audit Troubleshooting


Revised: October 23, 2008, OL-11335-06

Introduction

This chapter provides the information needed to monitor and troubleshoot Audit events and alarms. This chapter is divided into the following sections:

Audit Events and Alarms - Provides a brief overview of each Audit event and alarm.

Monitoring Audit Events - Provides the information needed to monitor and correct Audit events.

Troubleshooting Audit Alarms - Provides the information needed to troubleshoot and correct Audit alarms.

Audit Events and Alarms

This section provides a brief overview of the Audit events and alarms for the Cisco BTS 10200 Softswitch in numerical order. Table 2-1 lists all of the audit events and alarms by severity.


Note Click the Audit message number in Table 2-1 to display information about the event or alarm.


Table 2-1 Audit Events and Alarms by Severity 

CRITICAL
MAJOR
MINOR
WARNING
INFO

AUDIT (5)

AUDIT (6)

AUDIT (7)

AUDIT (3)

AUDIT (1)

     

AUDIT (4)

AUDIT (2)

     

AUDIT (8)

 

AUDIT (1)

For additional information, refer to the "Test Report - Audit (1)" section.

DESCRIPTION

Test Report

SEVERITY

Information (INFO)

THRESHOLD

100

THROTTLE

0

PRIMARY
CAUSE

This event is used for testing the new "Audit" category.

PRIMARY
ACTION

No action is necessary.


AUDIT (2)

For additional information, refer to the "Start or Stop of Signaling System 7 - Circuit Identification Code Audit - Audit (2)" section.

DESCRIPTION

Start or Stop of Signaling System 7-Circuit Identification Code Audit (Start or Stop of SS7-CIC Audit)

SEVERITY

INFO

THRESHOLD

100

THROTTLE

0

DATAWORDS

Type of Audit - STRING [64]

PRIMARY
CAUSE

Signaling System 7 (SS7) circuit identification code (CIC) audit has started or stopped.

PRIMARY
ACTION

No action required - normal operation.


AUDIT (3)

To monitor and correct the cause of the event, refer to the "Signaling System 7 Circuit Identification Code Audit Terminated Before Successful Completion - Audit (3)" section.

DESCRIPTION

Signaling System 7 Circuit Identification Code Audit Terminated Before Successful Completion (SS7 CIC Audit Terminated Before Successful Completion)

SEVERITY

WARNING

THRESHOLD

100

THROTTLE

0

DATAWORDS

Type of Audit - STRING [64]

PRIMARY
CAUSE

A higher priority SS7 CIC audit interrupted and terminated a lower priority SS7 CIC audit.

PRIMARY
ACTION

Do not schedule an SS7 remote termination audit to occur while a periodic SS7 local termination audit is executing.


AUDIT (4)

To monitor and correct the cause of the event, refer to the "Call Exceeds a Long-Duration Threshold - Audit (4)" section

DESCRIPTION

Call Exceeds a Long-Duration Threshold

SEVERITY

WARNING

THRESHOLD

100

THROTTLE

0

DATAWORDS

Trunk group number - TWO_BYTES
Trunk member number - TWO_BYTES
Current long-duration threshold - TWO_BYTES

PRIMARY
CAUSE

Call exceeds current system long-duration threshold.

PRIMARY
ACTION

If there is reason to believe the call is no longer valid, release the associated trunk facility.


AUDIT (5)

To troubleshoot and correct the cause of the alarm, refer to the "Critical Internal Audit Failure - Audit (5)" section.

DESCRIPTION

Critical Internal Audit Failure

SEVERITY

CRITICAL

THRESHOLD

100

THROTTLE

0

DATAWORDS

Failure Details - STRING [220]
Probable Causes - STRING [80]
Corrective Actions - STRING [80]

PRIMARY
CAUSE

See data field.

PRIMARY
ACTION

See data field.


AUDIT (6)

To troubleshoot and correct the cause of the alarm, refer to the "Major Internal Audit Failure - Audit (6)" section.

DESCRIPTION

Major Internal Audit Failure

SEVERITY

MAJOR

THRESHOLD

100

THROTTLE

0

DATAWORDS

Failure Details - STRING [220]
Probable Causes - STRING [80]
Corrective Actions - STRING [80]

PRIMARY
CAUSE

See data field.

PRIMARY
ACTION

See data field.


AUDIT (7)

To troubleshoot and correct the cause of the alarm, refer to the "Minor Internal Audit Failure - Audit (7)" section.

DESCRIPTION

Minor Internal Audit Failure

SEVERITY

MINOR

THRESHOLD

100

THROTTLE

0

DATAWORDS

Failure Details - STRING [220]
Probable Causes - STRING [80]
Corrective Actions - STRING [80]

PRIMARY
CAUSE

See data field.

PRIMARY
ACTION

See data field.


AUDIT (8)

To monitor and correct the cause of the event, refer to the "Warning From Internal Audit - Audit (8)" section.

DESCRIPTION

Warning From Internal Audit

SEVERITY

WARNING

THRESHOLD

100

THROTTLE

0

DATAWORDS

Failure Details - STRING [220]
Probable Causes - STRING [80]
Corrective Actions - STRING [80]

PRIMARY
CAUSE

See data field.

PRIMARY
ACTION

See data field.


Monitoring Audit Events

This section provides the information needed to monitor and correct Audit events. Table 2-2 lists all Audit events in numerical order and provides cross reference to each subsection in this section.


Test Report - Audit (1)

The Test Report event is used for testing the audit event category. The event is informational and no further action is required.

Start or Stop of Signaling System 7 - Circuit Identification Code Audit - Audit (2)

The Start or Stop of Signaling System 7 - Circuit Identification Code Audit event occurs as part of normal Cisco BTS 10200 Softswitch operation. The event is informational and no further action is required.

Signaling System 7 Circuit Identification Code Audit Terminated Before Successful Completion - Audit (3)

The Signaling System 7 Circuit Identification Code Audit Terminated Before Successful Completion event serves as a warning that a higher priority SS7 CIC audit has interrupted and terminated a lower priority SS7 CIC audit. To control the occurrence of this event an SS7 remote termination audit should not be scheduled to occur while a periodic SS7 local termination audit is executing.

Call Exceeds a Long-Duration Threshold - Audit (4)

The Call Exceeds a Long-Duration Threshold event serves as a warning that a call has exceeded the current the Cisco BTS 10200 Softswitch system long-duration threshold. If there is reason to believe the call is no longer valid, the associated trunk facility should be released.

To check the current threshold setting for Long Duration calls, proceed as follows:


Step 1 As root user from the Call Agent (CA), execute the following command:

# grep LongDuration /opt/OptiCall/`ls /opt/OptiCall | grep CA`/bin/platform.cfg

Step 2 Review the command results.

Example results:

Args=-ems_pri_dn blg-asys07EMS.mssol.cisco.com -ems_sec_dn blg-asys07EMS.mssol.cisco.com 
-port 15260
-QCheckInterval1 1000 -QCheckInterval2 4500 -RecordGenTime 00:00:00 -LongDurationAllowance 
1440
-QCheckInterval3 60 -MyCaBillingDn blg-asys07CA.mssol.cisco.com


Note Following a platform start, the billing system will wait until the present time (current time on the call agent) is equal to RecordGenTime before auditing for Long Duration Calls. After the initial audit, the billing system will perform a Long Duration Call audit every LongDurationAllowance minutes. During an audit, the billing system will generate a Long Duration CDR for calls that have been active for LongDurationAllowance minutes.


Critical Internal Audit Failure - Audit (5)

The Critical Internal Audit Failure alarm (critical) indicates that a critical internal audit failure has occurred. To troubleshoot and correct the cause of the Critical Internal Audit Failure alarm, refer to the "Critical Internal Audit Failure - Audit (5)" section.

Major Internal Audit Failure - Audit (6)

The Major Internal Audit Failure alarm (major) indicates that a major internal audit failure has occurred. To troubleshoot and correct the cause of the Major Internal Audit Failure alarm, refer to the "Major Internal Audit Failure - Audit (6)" section.

Minor Internal Audit Failure - Audit (7)

The Minor Internal Audit Failure alarm (minor) indicates that a minor internal audit failure has occurred. To troubleshoot and correct the cause of the Minor Internal Audit Failure alarm, refer to the "Minor Internal Audit Failure - Audit (7)" section.

Warning From Internal Audit - Audit (8)

The Warning From Internal Audit event serves as a warning that a problem with an internal audit has occurred. To correct the internal audit problem refer to the failure details (220), probable cause (80), and corrective actions (80) listed in the data field. Additionally, refer to the previous critical, major, and minor internal audit failure sections.

Troubleshooting Audit Alarms

This section provides the information needed to troubleshoot and correct Audit alarms. Table 2-3 lists all Audit alarms in numerical order and provides cross reference to each subsection in this section.

Table 2-3 Cisco BTS 10200 Softswitch Audit Alarms 

Alarm Type
Alarm Name
Alarm Severity

AUDIT(5)

Critical Internal Audit Failure - Audit (5)

CRITICAL

AUDIT(6)

Major Internal Audit Failure - Audit (6)

MAJOR

AUDIT(7)

Minor Internal Audit Failure - Audit (7)

MINOR


Critical Internal Audit Failure - Audit (5)

The Critical Internal Audit Failure alarm (critical) indicates that a critical internal audit failure has occurred. To find the probable causes of the alarm, review the data field "Failure Details" and "Probable Causes" datawords. For the corrective actions for the alarm, review the data field "Corrective Actions" dataword. Once the "Corrective Actions" dataword has been reviewed, proceed with the corrective actions listed.

Major Internal Audit Failure - Audit (6)

The Major Internal Audit Failure alarm (major) indicates that a major internal audit failure has occurred. To find the probable causes of the alarm, review the data field "Failure Details" and "Probable Causes" datawords. For the corrective actions for the alarm, review the data field "Corrective Actions" dataword. Once the "Corrective Actions" dataword has been reviewed, proceed with the corrective actions listed.

Minor Internal Audit Failure - Audit (7)

The Minor Internal Audit Failure alarm (minor) indicates that a minor internal audit failure has occurred. To find the probable causes of the alarm, review the data field "Failure Details" and "Probable Causes" datawords. For the corrective actions for the alarm, review the data field "Corrective Actions" dataword. Once the "Corrective Actions" dataword has been reviewed, proceed with the corrective actions listed.