> EDR Format Configuration Mode Commands
> The EDR Format Configuration Mode enables configuring Event Detail Record (EDR) formats.
> Important: The commands or keywords/variables that are available are dependent on platform type, product version, and installed license(s).
> attribute
> This command specifies the order of fields in EDRs.
> Product
> All
> Privilege
> Security Administrator, Administrator
> Syntax
> attribute attribute { [ format { MM/DD/YY-HH:MM:SS | MM/DD/YYYY-HH:MM:SS | YYYY/MM/DD-HH:MM:SS | YYYYMMDDHHMMSS | seconds } ] [ localtime ] | [ { ip | tcp } { bytes | pkts } { downlink | uplink } ] priority priority }
> no attribute attribute [ priority priority ]
> no
> Removes the specified attribute.
> attribute
> Specifies the attribute.
> attribute must be one of the following:

> Attributes | Description
> radius-called-station-id | Called Station ID of the mobile handling the flow.
> radius-calling-station-id | Calling Station ID of the mobile handling the flow.
> radius-fa-nas-identifier | RADIUS NAS identifier of Foreign Agent (FA).
> radius-fa-nas-ip-address | RADIUS IP address of Foreign Agent (FA).
> radius-nas-identifier | RADIUS NAS identifier.
> radius-nas-ip-address | RADIUS NAS IP address.
> radius-user-name | User name associated with the flow.
> sn-3gpp2-always-on | This option is obsolete. To configure this attribute see the rule-variable command.
> sn-3gpp2-bsid | This option is obsolete. To configure this attribute see the rule-variable command.
> sn-3gpp2-esn | This option is obsolete. To configure this attribute see the rule-variable command.
> sn-3gpp2-ip-qos | This option is obsolete. To configure this attribute see the rule-variable command.
> sn-3gpp2-ip-technology | This option is obsolete. To configure this attribute see the rule-variable command.
> sn-3gpp2-release-indicator | This option is obsolete. To configure this attribute see the rule-variable command.
> sn-3gpp2-service-option | This option is obsolete. To configure this attribute see the rule-variable command.
> sn-3gpp2-session-begin | This option is obsolete. To configure this attribute see the rule-variable command.
> sn-3gpp2-session-continue | This option is obsolete. To configure this attribute see the rule-variable command.
> sn-acct-session-id | Unique session identifier for accounting.
> sn-app-protocol | Application protocol for the flow. A value indicating the protocol, such as one of the following:
> • | ACS_PROTO_UNKNOWN = 0
> • | ACS_PROTO_GTP = 1
> • | ACS_PROTO_IP = 2
> • | ACS_PROTO_TCP = 3
> • | ACS_PROTO_UDP = 4
> • | ACS_PROTO_HTTP = 5
> • | ACS_PROTO_HTTPS = 6
> • | ACS_PROTO_FTP = 7
> • | ACS_PROTO_FTP_CONTROL = 8
> • | ACS_PROTO_FTP_DATA = 9
> • | ACS_PROTO_WTP = 10
> • | ACS_PROTO_WSP = 11
> • | ACS_PROTO_WTP_WSP_CONNECTION_ORIENTED = 12
> • | ACS_PROTO_WSP_CONNECTION_LESS = 13
> • | ACS_PROTO_DNS = 14
> • | ACS_PROTO_ICMP = 15
> • | ACS_PROTO_POP3 = 16
> • | ACS_PROTO_SIP = 17
> • | ACS_PROTO_SDP = 18
> • | ACS_PROTO_SMTP = 19
> • | ACS_PROTO_EMAIL = 20
> • | ACS_PROTO_MMS = 21
> • | ACS_PROTO_FILE_TRANSFER = 22
> • | ACS_PROTO_WWW = 23
> • | ACS_PROTO_RTP = 24
> • | ACS_PROTO_RTSP = 25
> • | ACS_PROTO_IMAP = 26
> • | ACS_PROTO_FLOW = 27
> • | ACS_PROTO_CCA = 28
> • | ACS_PROTO_P2P = 29
> • | ACS_PROTO_RTCP = 30
> • | ACS_PROTO_ICMPV6 = 31
> • | ACS_PROTO_TFTP = 32
> • | ACS_PROTO_PPTP = 33
> • | ACS_PROTO_GREv1 = 34
> • | ACS_PROTO_PPTP_GRE = 35
> • | ACS_PROTO_SIP_ADV = 36
> • | ACS_PROTO_SIP_BASIC_ADV = 37
> • | ACS_PROTO_H323 = 38
> sn-cf-category-classification-used | For Category-based Content Filtering, specifies the last classification used by system for the flow, or blank if classification was never successfully performed. For URL Blacklisting, specifies category of the blacklisted URL in the Blacklist database.
> sn-cf-category-flow-action | For Category-based Content Filtering, specifies the last action taken for the flow, or blank if content filtering was never performed. The following are the possible values:
> • | allow
> • | content-insert
> • | discard
> • | redirect-url
> • | terminate-flow
> For URL Blacklisting, specifies the last action taken for the flow, or blank if Blacklist matching was never performed. The following are the possible values:
> • | discard
> • | terminate-flow
> • | redirect-url
> • | www-reply-code-terminate-flow
> sn-cf-category-policy | Specifies the category policy identifier that was used by Category-based Content Filtering for the flow, or blank if content filtering was never attempted for the flow.
> sn-cf-category-rating-type | For Category-based Content Filtering, specifies the type, either “static” or “dynamic” that was last successfully performed for the flow, or blank if content filtering was never successful for the flow. For URL Blacklisting, specifies “blacklisting”.
> sn-cf-category-unknown-url | Identifier for unknown URL under content filtering action. It holds either “1” for unknown URLs or “0” for the URLs having static rating in its database.
> sn-closure-reason | Reason for the termination of the flow/EDR:
> • | 0: Normal end of flow
> • | 1: End of flow by handoff processing
> • | 2: Subscriber session terminated
> • | 3: Inter-chassis Session Recovery switchover
> • | 12: Completion of transaction
> sn-content-label | Identifier of text label for content-id.
> sn-correlation-id | RADIUS correlation identifier.
> sn-direction | Direction of the first packet for the flow. It has following values:
> • | toMobile: This value appears when direction of first packet is towards mobile node.
> • | fromMobile: This value appears when direction of first packet is towards mobile node.
> • | unknown: This value appears when the original originator of a flow can not be determined (e.g. a flow that is interrupted due to a Inter-chassis Session Recovery switchover).
> sn-duration | Duration between the last and first packet for the record.
> sn-end-time [ format format ] localtime | Timestamp for last packet of flow in UTC.
> sn-fa-correlation-id | RADIUS Correlation Identifier of the Foreign Agent (FA).
> sn-fa-ip-address | Foreign Agent (FA) IP address
> sn-filler-blank | Keeps attributes place blank.
> sn-filler-zero | Fills ‘0’ for this attribute place.
> sn-flow-end-time | The time of flow-end EDR generation—when EDRs are generated at hagr, session-end, timeout, or normal-end-signaling conditions. sn-start-time and sn-end-time fields of flow end-condition EDRs cannot be used to determine the duration of the flow if intermediate EDRs are generated (rule-match or transaction-complete or any other intermediate EDR). sn-start-time field in an EDR gives the time the first packet was received after the last EDR was generated. So, whenever an EDR is generated, this field is reset to the time the EDR gets generated. So the sn-start-time field in flow end-condition EDRs may not have the time of the first packet received on that flow. It will have the time at which the last EDR was generated or the first packet time if no EDR was generated for that flow. sn-end-time field gives the time at which the last packet on the flow was received. Flow end-condition EDRs may not be generated immediately after receiving the last packet. For example, in case of session-end or timeout EDRs, last packet time and EDR generation time may be different. sn-flow-start-time gives the time of the first packet of the flow (irrespective of whether intermediate EDRs were generated), and sn-flow-end-time gives the time when EDRs are generated at hagr, session-end, timeout or normal-end-signaling conditions. The values of these fields will be populated in EDRs only for hagr, session-end, timeout and normal-end-signaling EDRs.
> sn-flow-id | Flow-id assigned internally by the ACS module to each flow.
> sn-flow-start-time | The time of the first packet of the flow (irrespective of whether intermediate EDRs were generated). Also see, sn-flow-end-time.
> sn-format-name | Name of the EDR/UDR format used.
> sn-group-id | Sequence group ID of the record.
> sn-ha-ip-address | Home Agent (HA) IP address.
> sn-nat-binding-timer | Port chunk hold timer.
> sn-nat-gmt-offset | GMT offset of the node generating NAT bind record.
> sn-nat-ip | NAT IP address of the port chunk.
> sn-nat-last-activity-time-gmt | The time when the last flow in a specific NAT set of flows was seen.
> sn-nat-port-block-end | Last port number of the port chunk.
> sn-nat-port-block-start | Starting port number of the port chunk.
> sn-nat-port-chunk-alloc-dealloc-flag | Indicates whether the port chunk is allocated or released.
> sn-nat-port-chunk-alloc-time-gmt | Indicates when the port chunk was allocated.
> sn-nat-port-chunk-dealloc-time-gmt | Indicates when the port chunk was released.
> sn-nat-realm-name | Name of the NAT realm.
> sn-nat-subscribers-per-ip-address | Subscriber(s) per NAT IP address.
> sn-parent-protocol | Indicates parent protocol of flow.
> sn-rulebase | Name of the ACS rulebase applied.
> sn-sequence-no | Unique sequence number (per sn-sequence-group and radius-nas-ip-address) of EDR identifier and linearly increasing in EDR file.
> sn-server-port | TCP/UDP port number of the server in a subscriber’s data flow.
> sn-start-time [ format format ] localtime | Timestamp for last packet of flow in UTC.
> sn-subscriber-nat-flow-ip | NAT IP address of NAT-enabled subscriber.
> sn-subscriber-nat-flow-port | NAT port number of NAT-enabled subscriber.
> sn-subscriber-port | TCP/UDP port number of the Mobile handling subscriber data flow.
> sn-volume-amt { ip | tcp } { bytes | pkts } { uplink | downlink } | Protocol-specific uplink/downlink volume amount in bytes/packets for EDR.
> sn-volume-dropped-amt { ip | tcp } { bytes | packets } { downlink | uplink } | Protocol-specific uplink/downlink dropped volume amount in bytes/packets for EDR.
> sn-volume-ip-with-rtsp-or-rtp bytes { downlink | priority | uplink } | Shows the collected EDRs that contains the total bytes of an RTSP flow and the RTP flows controlled by it in uplink or downlink direction, or CSV position priority of this field. If uplink or downlink is not specified it shows the total of both.
> transaction-downlink-bytes | Total downlink bytes for the transaction.
> transaction-downlink-packets | Total downlink packets for the transaction.
> transaction-uplink-bytes | Total uplink bytes for the transaction.
> transaction-uplink-packets | Total uplink packets for the transaction.

> ‌
> format { MM/DD/YY-HH:MM:SS | MM/DD/YYYY-HH:MM:SS | YYYY/MM/DD-HH:MM:SS | YYYYMMDDHHMMSS | seconds }
> Specifies the timestamp format.
> localtime
> Specifies timestamps with the local time. By default, timestamps are displayed in GMT.
> { ip | tcp } { bytes | pkts } { downlink | uplink }
> Specifies bytes/packets sent/received from/by mobile.
> priority priority
> Specifies the position priority of the value within the EDR record. Lower numbered priorities (across all attribute, event-label, and rule-variable) occur first.
> priority must be an integer from 1 through 65535. Up to 50 position priorities (across all attribute, event-label, and rule-variable) can be configured.
> Usage
> Use this command to set the attributes and priority for EDR file format.
> A particular field in EDR format can be entered multiple times at different priorities. While removing the EDR field using the no attribute command either you can remove all occurrences of a particular field by specifying the field name or a single occurrence by additionally specifying the optional priority keyword.
> Example
> The following is an example of this command:
> attribute radius-user-name priority 12
> end
> This command returns the CLI prompt to the Exec Mode.
> Product
> All
> Privilege
> Security Administrator, Administrator
> Syntax
> end
> Usage
> Use this command to change to the Exec Mode.
> event-label
> This command specifies an optional event ID to use in the generated billing records.
> Product
> All
> Privilege
> Security Administrator, Administrator
> Syntax
> event-label label priority priority
> no event-label
> no
> Removes previously configured event label for EDR attribute.
> label
> Specifies event label for attribute to be used for EDR format.
> label must be an alpha and/or numeric string of 1 through 63 characters in length.
> priority priority
> Indicates the CSV position of event ID in EDR record.
> priority must be an integer from 1 through 65535.
> Usage
> Use this command to set the event ID and its position in EDR file format.
> Example
> event-label radius_csv1 priority 23
> exit
> This command exits the EDR Format Configuration Mode and returns to the ACS Configuration Mode.
> Product
> All
> Privilege
> Security Administrator, Administrator
> Syntax
> exit
> Usage
> Use this command to return to the ACS Configuration Mode.
> rule-variable
> This command specifies the order of fields in the EDR.
> Product
> All
> Privilege
> Security Administrator, Administrator
> Syntax
> rule-variable protocol rule priority priority [ in-quotes ]
> no rule-variable protocol rule [ priority priority ]
> no
> Removes the previously configured rule variable protocol rule and/or priority for EDR attribute.
> protocol rule
> Specifies the rule variable for EDR format.
> protocol must be one of the following with specified rule:

> • | bearer 3gpp: 3GPP bearer-related configuration:

> • | charging-id: Charging ID of the bearer flow

> • | imei: IMEI or IMEISV (depending on the case) associated with the bearer flow. Only available in StarOS 8.1 and later releases.

> • | imsi: Specific Mobile Station Identification Number.

> • | rat-type: RAT type associated with the bearer flow. Only available in StarOS 8.1 and later releases.

> • | sgsn-address: SGSN associated with the bearer flow. Only available in StarOS 8.1 and later releases. For MIPv6 calls, sgsn-address field is populated with HSGW address.

> • | user-location-information: User location information associated with the bearer flow. Only available in StarOS 8.1 and later releases.

> • | bearer 3gpp2: 3GPP2 bearer-related configuration:

> • | always-on

> • | bsid

> • | esn

> • | ip-qos

> • | ip-technology

> • | release-indicator

> • | service-option

> • | session-begin

> • | session-continue

> • | bearer ggsn-address: GGSN IP address field. For MIPv6 calls, ggsn-address field in EDR will be populated with PGW address.

> • | dns: Domain Name System (DNS) related configuration:

> • | answer-name

> • | previous-state

> • | query-name

> • | return-code

> • | state

> • | tid

> • | file-transfer: File transfer related configuration:

> • | chunk-number

> • | current-chunk-length

> • | declared-chunk-length

> • | declared-file-size

> • | filename

> • | previous-state

> • | state

> • | transferred-file-size

> • | ftp: File Transfer Protocol (FTP) related configuration:

> • | client-ip-address

> • | client-port

> • | command name

> • | connection-type

> • | filename

> • | pdu-length

> • | pdu-type

> • | previous-state

> • | reply code

> • | server-ip-address

> • | server-port

> • | session-length

> • | state

> • | url

> • | user

> • | http: Hypertext Transport Protocol (HTTP) related configuration:

> • | ad-delivered — advertisement delivered using TPO text-with-click

> • | ad-replaced — advertisement replaced with TPO 0-byte response

> • | attribute-in-data— dynamic header field in application payload

> • | attribute-in-url— dynamic header field in URL

> • | compression-bytes-in — TPO compression bytes in

> • | compression-bytes-out — TPO compression bytes out

> • | content disposition

> • | content length

> • | content type

> • | domain

> • | dns-resolution-locally — TPO DNS resolution done locally

> • | dns-resolution-remotely — TPO DNS resolution done remotely

> • | header-length

> • | host

> • | payload-length

> • | pdu-length

> • | previous-state

> • | referer

> • | reply code

> • | request method

> • | session-length

> • | state

> • | tpo-enabled — TPO enabled/disabled for HTTP

> • | transaction-length

> • | transfer-encoding

> • | uri

> • | url

> • | user-agent

> • | version

> • | x-header—extension header

> • | icmp: Internet Control Message Protocol (ICMP) related configuration:

> • | code

> • | type

> • | icmpv6: Internet Control Message Protocol Version 6 (ICMPv6) related configuration:

> • | code

> • | type

> • | imap: Internet Message Access Protocol (IMAP) related configuration:

> • | cc

> • | command

> • | content

> • | date

> • | final-reply

> • | from

> • | mail-size

> • | mailbox-size

> • | message-type

> • | previous-state

> • | session-length

> • | session-previous-state

> • | session-state

> • | state

> • | subject

> • | to

> • | ip: Internet Protocol (IP) related configuration:

> • | dst-address

> • | protocol

> • | server-ip-address: This field in EDR contains either the IPv4 or IPv6 address of the server for a particular flow (flow level). The maximum length of this field is 48 characters. In case of IPv6 address, the maximum length will be 45 characters, and in case of IPv4 address, the maximum length will be 15 characters.

> • | src-address

> • | subscriber-ip-address: This field in EDR contains either the IPv4 or IPv6 address of the client/subscriber for a particular call (subscriber level). The value of this field does not change for a particular call. The maximum length of this field is 48 characters. In case of IPv6 address, the maximum length will be 45 characters, and in case of IPv4 address, the maximum length will be 15 characters.

> • | total-length

> • | version

> • | mms: Multimedia Message Service (MMS) related configuration:

> • | bcc

> • | cc

> • | content location

> • | content type

> • | date [ format { MM/DD/YYYY-HH:MM:SS | YYYY/MM/DD-HH:MM:SS } ]

> • | from

> • | message-size

> • | previous-state

> • | response status

> • | state

> • | subject

> • | tid

> • | to

> • | p2p protocol: Peer-to-peer protocol related configuration

> • | pop3: Post Office Protocol version 3 (POP3) related configuration:

> • | command name

> • | mail-size

> • | pdu-length

> • | pdu-type

> • | previous-state

> • | reply status

> • | session-length

> • | state

> • | user-name

> • | rtcp: RTP Control Protocol (RTCP) related configuration:

> • | control-session-flow-id

> • | jitter

> • | rtsp-id

> • | uri

> • | rtp: Real-time Transfer Protocol (RTP) related configuration:

> • | control-session-flow-id

> • | pdu-length

> • | rtsp-id

> • | session-length

> • | uri

> • | rtsp: Real Time Streaming Protocol (RTSP) related configuration:

> • | command-id

> • | content type

> • | date

> • | previous-state

> • | reply code

> • | request method 1: play method

> • | request method 2: setup method

> • | request method 3: pause method

> • | request method 4: record method

> • | request method 5: options method

> • | request method 6: redirect method

> • | request method 7: describe method

> • | request method 8: announce method

> • | request method 9: teardown method

> • | request method 10: get-parameter method

> • | request method 11: set-parameter method

> • | request packet

> • | rtp-uri

> • | session-id

> • | session-length

> • | state

> • | uri

> • | uri sub-part

> • | user-agent

> • | sdp: Session Description Protocol (SDP) related configuration:

> • | connection-ip-address

> • | media-audio-port

> • | media-video-port

> • | secure-http: HTTPS related configuration

> • | sip: Session Initiation Protocol (SIP) related configuration:

> • | call-id

> • | content type

> • | from

> • | previous-state

> • | reply code

> • | request method

> • | request packet

> • | state

> • | to

> • | uri

> • | uri sub-part

> • | smtp: Simple Mail Transfer Protocol (SMTP) related configuration:

> • | command name

> • | mail-size

> • | pdu-length

> • | previous-state

> • | recipient

> • | reply status

> • | sender

> • | session-length

> • | state

> • | tcp: Transmission Control Protocol (TCP) related configuration:

> • | dst-port

> • | duplicate

> • | flag

> • | out-of-order

> • | payload-length

> • | previous-state

> • | src-port

> • | state

> • | tpo-enabled

> • | traffic-type: Traffic type of flow (voice or non-voice depending upon flow type).

> • | udp: User Datagram Protocol (UDP) related configuration:

> • | dst-port

> • | src-port

> • | voip-duration: Duration of voice call, in seconds. For a flow in which voice call end is detected, output will be a non-zero value. For other flows it will be zero.

> • | wsp: Wireless Session Protocol (WSP) related configuration

> • | content type

> • | domain

> • | host

> • | pdu-length

> • | pdu-type

> • | reply code

> • | session-length

> • | tid

> • | total-length

> • | url

> • | user-agent

> • | wtp: Wireless Transaction Protocol (WTP) related configuration

> • | gtr—Group Transmission Flag

> • | pdu-length

> • | pdu-type

> • | previous-state

> • | state

> • | tid

> • | transaction class

> • | ttr—Trailer Transmission flag

> Important: For more information on protocol-based rules, see the ACS Ruledef Configuration Mode Commands chapter.
> priority priority
> Specifies the CSV position of protocol rule related information in EDR.
> priority must be an integer from 1 through 65535.
> in-quotes
> Specifies placing double quotes (“ ”) around the specified EDR field in the EDR.
> Important: At the present time this keyword is only valid for the MMS protocol to and subject fields. rule-variable mms to priority priority [in-quotes] rule-variable mms subject priority priority [in-quotes]
> Usage
> Use this command to set what field appears where—in which order—in the EDR.
> A particular field in an EDR format can be entered multiple times at different priorities. While removing the EDR field using the no rule-variable command you can remove all occurrences of a particular field by specifying the field name or a single occurrence by additionally specifying the optional priority keyword.
> Example
> The following is an example of this command:
> rule-variable tcp dst-port priority 36

Cisco Systems Inc.
Tel: 408-526-4000
Fax: 408-527-0883