Monitoring Polycom syslog with Splunk

[xzou_splunk]

Hi all,

We are trying to analyze the Syslog from Polycom, such as server.log, access.log, etc.

However, we don't understand the content of those logs.
Is there any place we can get a detailed description of those logs?

[xavierashe]

Typical application logs... it will be hard to get a lot out of them without vendor help. I would start with a basic parser to make it usable.

^(?<timestamp>.*?)\|(?<loglevel>.*?)\|(?<thread>.*?)\|(?<pid>.*?)\|(?<module>.*?)\|\s(?<message>.*?)$

Then you will have to go through each of them and pull out useful data. Some of the message use a key:value format while others use a key[value] format.

[xzou_splunk]

Yes, you may be right. We need vendor's help with the content.

[FrankVl]

Normally you'd find that in the documentation of the product that is producing those logs. If not there, than your guess is as good as mine.

You could post a few sample events here, see if someone recognizes it.

[xzou_splunk]

Yes, normally. But this time, there's no any detail in Polycom's manual or maybe I didn't find the right one. Here's some sample event from server.log.

020-03-10T12:00:04.647+0800|DEBUG|RegistrationMgr-ScheduledTasks:3552:|347|com.polycom.proximo.callserver.registration.RegistrationsMgr| Removed HighAvailabilityRegistrationKey commObject=3d1d6e75-f200-46c1-80bb-962a0ba8c771
2020-03-10T12:00:04.647+0800|DEBUG|RegistrationMgr-ScheduledTasks:3552:|347|com.polycom.proximo.callserver.registration.ManagedRegistrationImpl| cancel all timer tasks for registration:com.polycom.proximo.callserver.registration.H323ManagedRegistration@c96e659b:commObject ID[3d1d6e75-f200-46c1-80bb-962a0ba8c771] expireTask[com.polycom.rpp.commons.util.RppScheduledExecutor@5dd9c0de[Running, pool size = 1, active threads = 1, queued tasks = 270, completed tasks = 37689]] expireTasks[{}] idKey[3d1d6e75-f200-46c1-80bb-962a0ba8c771] lastContact[null] lastContactExpires[null] expiredReg[true] responseTerritory[PN:DMA:TER-A] rasAddress[/99.46.23.40:1719] allow LRRQ[true] remoteAddress[/99.46.23.40:1719]
2020-03-10T12:00:04.647+0800|DEBUG|RegistrationMgr-ScheduledTasks:3552:|347|com.polycom.proximo.callserver.registration.RegistrationsMgr| removed registration:3d1d6e75-f200-46c1-80bb-962a0ba8c771 because:UNREGISTERED key:3d1d6e75-f200-46c1-80bb-962a0ba8c771
2020-03-10T12:00:04.647+0800|DEBUG|RegistrationMgr-ScheduledTasks:3552:|347|com.polycom.proximo.callserver.registration.RegistrationsMgr| registration[com.polycom.proximo.callserver.registration.H323ManagedRegistration@c96e659b:commObject ID[3d1d6e75-f200-46c1-80bb-962a0ba8c771] expireTask[com.polycom.rpp.commons.util.RppScheduledExecutor@5dd9c0de[Running, pool size = 1, active threads = 1, queued tasks = 270, completed tasks = 37689]] expireTasks[{}] idKey[3d1d6e75-f200-46c1-80bb-962a0ba8c771] lastContact[null] lastContactExpires[null] expiredReg[true] responseTerritory[PN:DMA:TER-A] rasAddress[/99.46.23.40:1719] allow LRRQ[true] remoteAddress[/99.46.23.40:1719]] deactivate notify watcher:com.polycom.proximo.callserver.registration.GatekeeperRegistrationPolicyImpl@576af8c5
2020-03-10T12:00:04.647+0800|WARN |MsMonSup-Poll-MCU-99.38.80.100-ScheduledTasks:8480:|347|com.polycom.proximo.videoms.driver.util.XmlMcuExecutorBase| slow response 1013ms from 99.38.80.100 0Status OK