Example: RTPProxy Logs

RTPProxy to RTPAgent Correlation

PaStash app_rtpproxy is designed to extract RTP-to-SIP correlation and details from debug logs of a running RTPProxy instance, managed by OpenSIPS. It can use ZeroMQ to distribute correlation across many nodes.

Sample Logs

Aug 18 06:01:41 rtpa rtpproxy[8027]: DBUG:handle_command: received command "17402_275704 Uc18,0,8,101 b372ce50185fadc713c466c071f15fbd25bb650dbc8cab4a0c0-0082-7266 10.0.10.1 55078 -45026-66c071f-4496f1ad-66c071f;1"
Aug 18 06:01:41 rtpa rtpproxy[8027]: INFO:handle_command: new session b372ce50185fadc713c466c071f15fbd25bb650dbc8cab4a0c0-0082-7266, tag -45026-66c071f-4496f1ad-66c071f;1 requested, type strong
Aug 18 06:01:41 rtpa rtpproxy[8027]: INFO:handle_command: new session on a port 56726 created, tag -45026-66c071f-4496f1ad-66c071f;1
Aug 18 06:01:41 rtpa rtpproxy[8027]: INFO:handle_command: pre-filling caller's address with 10.0.10.1:55078
Aug 18 06:01:41 rtpa rtpproxy[8027]: DBUG:doreply: sending reply "17402_275704 56726 10.20.0.2#012"

Recipe

RTPProxy > Log Agent(s)

input {
  file {
    path => "/var/log/rtpproxy.log"
  }
}

output {
  zeromq {
    address => ["tcp://log_server:5555"]
  }
}

Log Server > RTPAgent

input {
 zeromq {
    address => ["tcp://0.0.0.0:5555"]
  }
}

filter {
  app_rtpproxy {}
}

output {
  http_post {
    host => ['127.0.0.1']
    port => 18090
    path => '/api/transaction/#{method}'
  }
}

Output

[STDOUT] {
  "media": [
    {
      "codec_name": "PCMU",
      "codec_pt": 18,
      "codec_rate": 8000,
      "direction": 0,
      "port": "56726",
      "ip": "10.20.0.2"
    }
  ],
  "method": "create",
  "correlation_id": "b372ce50185fadc713c466c071f15fbd25bb650dbc8cab4a0c0-0082-7266"
}
[STDOUT] {
  "media": [
    {
      "codec_name": "PCMU",
      "codec_pt": 0,
      "codec_rate": 8000,
      "direction": 1,
      "port": "56726",
      "ip": "10.20.0.2"
    }
  ],
  "method": "delete",
  "correlation_id": "b372ce50185fadc713c466c071f15fbd25bb650dbc8cab4a0c0-0082-7266"
}