topic Monitoring Polycom syslog with Splunk in Getting Data In

Monitoring Polycom syslog with Splunk

xzou_splunk — Wed, 11 Mar 2020 11:03:28 GMT

Hi all,

We are trying to analyze the Syslog from Polycom, such as server.log, access.log, etc.

However, we don't understand the content of those logs.
Is there any place we can get a detailed description of those logs?

Re: Monitoring Polycom syslog with Splunk

FrankVl — Wed, 11 Mar 2020 13:06:09 GMT

Normally you'd find that in the documentation of the product that is producing those logs. If not there, than your guess is as good as mine.

You could post a few sample events here, see if someone recognizes it.

Re: Monitoring Polycom syslog with Splunk

xzou_splunk — Wed, 11 Mar 2020 13:27:26 GMT

Yes, normally. But this time, there's no any detail in Polycom's manual or maybe I didn't find the right one. Here's some sample event from server.log.

020-03-10T12:00:04.647+0800|DEBUG|RegistrationMgr-ScheduledTasks:3552:|347|com.polycom.proximo.callserver.registration.RegistrationsMgr| Removed HighAvailabilityRegistrationKey commObject=3d1d6e75-f200-46c1-80bb-962a0ba8c771
2020-03-10T12:00:04.647+0800|DEBUG|RegistrationMgr-ScheduledTasks:3552:|347|com.polycom.proximo.callserver.registration.ManagedRegistrationImpl| cancel all timer tasks for registration:com.polycom.proximo.callserver.registration.H323ManagedRegistration@c96e659b:commObject ID[3d1d6e75-f200-46c1-80bb-962a0ba8c771] expireTask[com.polycom.rpp.commons.util.RppScheduledExecutor@5dd9c0de[Running, pool size = 1, active threads = 1, queued tasks = 270, completed tasks = 37689]] expireTasks[{}] idKey[3d1d6e75-f200-46c1-80bb-962a0ba8c771] lastContact[null] lastContactExpires[null] expiredReg[true] responseTerritory[PN:DMA:TER-A] rasAddress[/99.46.23.40:1719] allow LRRQ[true] remoteAddress[/99.46.23.40:1719]
2020-03-10T12:00:04.647+0800|DEBUG|RegistrationMgr-ScheduledTasks:3552:|347|com.polycom.proximo.callserver.registration.RegistrationsMgr| removed registration:3d1d6e75-f200-46c1-80bb-962a0ba8c771 because:UNREGISTERED key:3d1d6e75-f200-46c1-80bb-962a0ba8c771
2020-03-10T12:00:04.647+0800|DEBUG|RegistrationMgr-ScheduledTasks:3552:|347|com.polycom.proximo.callserver.registration.RegistrationsMgr| registration[com.polycom.proximo.callserver.registration.H323ManagedRegistration@c96e659b:commObject ID[3d1d6e75-f200-46c1-80bb-962a0ba8c771] expireTask[com.polycom.rpp.commons.util.RppScheduledExecutor@5dd9c0de[Running, pool size = 1, active threads = 1, queued tasks = 270, completed tasks = 37689]] expireTasks[{}] idKey[3d1d6e75-f200-46c1-80bb-962a0ba8c771] lastContact[null] lastContactExpires[null] expiredReg[true] responseTerritory[PN:DMA:TER-A] rasAddress[/99.46.23.40:1719] allow LRRQ[true] remoteAddress[/99.46.23.40:1719]] deactivate notify watcher:com.polycom.proximo.callserver.registration.GatekeeperRegistrationPolicyImpl@576af8c5
2020-03-10T12:00:04.647+0800|WARN |MsMonSup-Poll-MCU-99.38.80.100-ScheduledTasks:8480:|347|com.polycom.proximo.videoms.driver.util.XmlMcuExecutorBase| slow response 1013ms from 99.38.80.100 0Status OK

Re: Monitoring Polycom syslog with Splunk

xavierashe — Thu, 12 Mar 2020 03:33:49 GMT

Typical application logs... it will be hard to get a lot out of them without vendor help. I would start with a basic parser to make it usable.

^(?<timestamp>.*?)\|(?<loglevel>.*?)\|(?<thread>.*?)\|(?<pid>.*?)\|(?<module>.*?)\|\s(?<message>.*?)$

Then you will have to go through each of them and pull out useful data. Some of the message use a key:value format while others use a key[value] format.

Re: Monitoring Polycom syslog with Splunk

xzou_splunk — Thu, 12 Mar 2020 03:39:35 GMT

Yes, you may be right. We need vendor's help with the content.