siptrace_admin.xml

<?xml version="1.0" encoding='ISO-8859-1'?>
<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [

<!-- Include general documentation entities -->
<!ENTITY % docentities SYSTEM "../../../../doc/docbook/entities.xml">
%docentities;

]>
<!-- Module User's Guide -->

<chapter>

	<title>&adminguide;</title>

	<section>
	<title>Overview</title>
	<para>
		The SIPtrace module offer a possibility to store incoming and outgoing SIP
		messages in a database and/or duplicate to the capturing server (using <acronym>HEP</acronym>,
		the Homer encapsulation protocol, or plain SIP mode). Since version 5.3.0 new levels of tracing
		are available. Transactions and dialogs can be traced.
	</para>
	<para>
		There are multiple ways of storing information:
		<itemizedlist>
		<listitem>
		<para>
		by calling the sip_trace() method explicitly in the &kamailio; configuration
		file. In this case the original message is processed along with it's corresponding
		transaction/dialog if certain flags are used.
		</para>
		</listitem>
		<listitem>
		<para>
		by setting <quote>trace_mode</quote> to mirror or store to db all traffic.
		</para>
		</listitem>
		</itemizedlist>
	</para>

	<para>
	The tracing can be turned on/off using Kamailio <acronym>RPC</acronym> commands.
	</para>
	<para>
	&ctltool; rpc siptrace.status on
	</para>
	<para>
	&ctltool; rpc siptrace.status off
	</para>
	</section>
	<section>
	<title>Dependencies</title>
	<section>
		<title>&kamailio; Modules</title>
		<para>
		The following modules must be conditionally loaded before this module:
			<itemizedlist>
			<listitem>
			<para>
				<emphasis>A database module</emphasis> - Mysql, Postgres,
				dbtext, unixODBC... Optional, if tracing to DB is enabled.
			</para>
			</listitem>
			<listitem>
			<para>
				<emphasis>dialog, tm and sl modules</emphasis> - optional, only if
				you want to trace messages forwarded by these modules.
			</para>
			</listitem>
			</itemizedlist>
		</para>
	</section>
	<section>
		<title>External Libraries or Applications</title>
		<para>
		The following libraries or applications must be installed before running
		&kamailio; with this module loaded:
			<itemizedlist>
			<listitem>
			<para>
				<emphasis>None</emphasis>.
			</para>
			</listitem>
			</itemizedlist>
		</para>
	</section>
	</section>
	<section>
	<title>Parameters</title>
	<section id="siptrace.p.db_url">
		<title><varname>db_url</varname> (str)</title>
		<para>
		Database URL.
		</para>
		<para>
		<emphasis>
			Default value is "&defaultdb;".
		</emphasis>
		</para>
		<example>
		<title>Set <varname>db_url</varname> parameter</title>
		<programlisting format="linespecific">
...
modparam("siptrace", "db_url", "&exampledb;")
...
</programlisting>
		</example>
	</section>
	<section id="siptrace.p.table">
		<title><varname>table</varname> (str)</title>
		<para>
		Name of the table where to store the SIP messages.
		</para>
		<para>
		<emphasis>
			Default value is <quote>sip_trace</quote>.
		</emphasis>
		</para>
		<example>
		<title>Set <varname>table</varname> parameter</title>
		<programlisting format="linespecific">
...
modparam("siptrace", "table", "strace")
...
</programlisting>
		</example>
	</section>
	<section id="siptrace.p.trace_flag">
		<title><varname>trace_flag</varname> (integer)</title>
		<para>
		Which flag is used to mark messages to trace without
		traced user.
		</para>
		<para>
		<emphasis>
			Default value is "0".
		</emphasis>
		</para>
		<example>
		<title>Set <varname>trace_flag</varname> parameter</title>
		<programlisting format="linespecific">
...
modparam("siptrace", "trace_flag", 22)
...
</programlisting>
		</example>
	</section>
	<section id="siptrace.p.trace_on">
		<title><varname>trace_on</varname> (integer)</title>
		<para>
		Parameter to enable/disable trace (on(1)/off(0))
		</para>
		<para>
		<emphasis>
			Default value is "0".
		</emphasis>
		</para>
		<example>
		<title>Set <varname>trace_on</varname> parameter</title>
		<programlisting format="linespecific">
...
modparam("siptrace", "trace_on", 1)
...
</programlisting>
		</example>
	</section>
	<section id="siptrace.p.traced_user_avp">
		<title><varname>traced_user_avp</varname> (str)</title>
		<para>
		The name of the <acronym>AVP</acronym> storing the SIP URI of the traced user. If
		the AVP is set, messages are stored in database table and
		the <quote>traced_user</quote> column is filled with AVP's value. You can store
		the message many times for many users by having multiple values
		for this AVP.
		</para>
		<para>
		<emphasis>
			Default value is "NULL" (feature disabled).
		</emphasis>
		</para>
		<example>
		<title>Set <varname>traced_user_avp</varname> parameter</title>
		<programlisting format="linespecific">
...
modparam("siptrace", "traced_user_avp", "$avp(user)")
...
</programlisting>
		</example>
	</section>
	<section id="siptrace.p.trace_table_avp">
		<title><varname>trace_table_avp</varname> (str)</title>
		<para>
		The name of the AVP storing the name of the table where to
		store the SIP messages. If it is not set, the value of
		<quote>table</quote> parameter is used. In this way one can select
		dynamically where to store the traced messages. The table
		must exist, and must have the same structure as the <quote>sip_trace</quote>
		table.
		</para>
		<para>
		<emphasis>
			Default value is "NULL" (feature disabled).
		</emphasis>
		</para>
		<example>
		<title>Set <varname>trace_table_avp</varname> parameter</title>
		<programlisting format="linespecific">
...
modparam("siptrace", "trace_table_avp", "$avp(i:345)")
modparam("siptrace", "trace_table_avp", "$avp(s:siptrace_table)")
...
</programlisting>
		</example>
	</section>
	<section id="siptrace.p.duplicate_uri">
		<title><varname>duplicate_uri</varname> (str)</title>
		<para>
		The address in form of a SIP URI where to send a duplicate
		of traced message.
		</para>
		<para>
		<emphasis>
			Default value is "NULL".
		</emphasis>
		</para>
		<example>
		<title>Set <varname>duplicate_uri</varname> parameter</title>
		<programlisting format="linespecific">
...
modparam("siptrace", "duplicate_uri", "sip:10.1.1.1:5888")
...
</programlisting>
		</example>
	</section>
	<section id="siptrace.p.trace_to_database">
		<title><varname>trace_to_database</varname> (integer)</title>
		<para>
		Parameter to enable/disable inserts to the database from this
		&kamailio;.
		</para>
		<para>
		In case we only want to send the SIP messages to the
		<quote>duplicate_uri</quote> and not store the information to the local
		database we can set this to "0".
		</para>
		<para>
		<emphasis>
			Default value is "1".
		</emphasis>
		</para>
		<example>
		<title>Set <varname>trace_to_database</varname> parameter</title>
		<programlisting format="linespecific">
...
modparam("siptrace", "trace_to_database", 0)
...
</programlisting>
		</example>
	</section>
	<section id="siptrace.p.trace_local_ip">
		<title><varname>trace_local_ip</varname> (str)</title>
		<para>
		The address to be used in <quote>fromip</quote> field for
		locally generated messages. If not set, the module sets it to the address
		of the socket that will be used to send the message.
		</para>
		<para>
		<emphasis>
			Default value is "NULL".
		</emphasis>
		</para>
		<example>
		<title>Set <varname>trace_local_ip</varname> parameter</title>
		<programlisting format="linespecific">
...
modparam("siptrace", "trace_local_ip", "10.1.1.1:5064")
...
</programlisting>
		</example>
	</section>
	<section id="siptrace.p.trace_sl_acks">
		<title><varname>trace_sl_acks</varname> (integer)</title>
		<para>
		Parameter to enable/disable tracing of SL-filtered ACKs (on=1
		/ off=0).
		</para>
		<para>
		By default all ACKs to replies generated by SL module are traced. There
		is no way to select among them. The SL module is able to run an event
		route when such an ACK arrives (<emphasis>event_route[sl:filtered-ack]</emphasis>).
		You can set this parameter to 0 and then execute sip_trace() in the event route,
		accompanied by config rules to decide which ACK to trace.
		</para>
		<para>
		<emphasis>
			Default value is "1".
		</emphasis>
		</para>
		<example>
		<title>Set <varname>trace_sl_acks</varname> parameter</title>
		<programlisting format="linespecific">
...
modparam("siptrace", "trace_sl_acks", 0)
...
</programlisting>
		</example>
	</section>
	 <section id="siptrace.p.xheaders_write">
		<title><varname>xheaders_write</varname> (integer)</title>
		<para>
		Parameter to enable/disable writing of x-headers.
		</para>
		<para>
		Stores <quote>fromip</quote>, <quote>toip</quote>, <quote>method</quote> and
		<quote>direction</quote> in <quote>X-Siptrace-*</quote> headers.
		This allows to transmit them to a second &kamailio; server
		using the <quote>duplicate_uri</quote> feature.
		Because the headers are added after the data is written to the database,
		the headers only show up in the packets sent by duplicate_uri.
		</para>
		<para>
		See <varname>xheaders_read</varname>, it should be used on the receiving
		side.
		</para>
		<para>
		<emphasis>Note:</emphasis> The headers are first read, then written. This allows
		relaying the information over more than two &kamailio; servers by setting both
		<varname>xheaders_write</varname> and <varname>xheaders_read</varname>
		to "1" on the servers in the middle.
		</para>
		<para>
		<emphasis>
			Default value is "0".
		</emphasis>
		</para>
		<example>
		<title>Set <varname>xheaders_write</varname> parameter</title>
		<programlisting format="linespecific">
...
modparam("siptrace", "xheaders_write", 0)
...
</programlisting>
		</example>
	</section>
	 <section id="siptrace.p.xheaders_read">
		<title><varname>xheaders_read</varname> (integer)</title>
		<para>
		Parameter to enable/disable reading of x-headers.
		</para>
		<para>
		Reads and removes the <quote>X-Siptrace-*</quote> headers. Packets not containing the
		headers are neither stored to the database nor relayed (duplicate_uri).
		See <varname>xheaders_write</varname> for further information.
		</para>
		<para>
		<emphasis>
			Default value is "0".
		</emphasis>
		</para>
		<example>
		<title>Set <varname>xheaders_read</varname> parameter</title>
		<programlisting format="linespecific">
...
modparam("siptrace", "xheaders_read", 0)
...
</programlisting>
		</example>
	</section>
	<section id="siptrace.p.hep_mode_on">
                <title><varname>hep_mode_on</varname> (integer)</title>
                <para>
                Parameter to enable/disable Homer encapsulate mode (on(1)/off(0))
                </para>
                <para>
                <emphasis>
                        Default value is "0".
                </emphasis>
                </para>
                <example>
                <title>Set <varname>hep_mode_on</varname> parameter</title>
                <programlisting format="linespecific">
...
modparam("siptrace", "hep_mode_on", 1)
...
</programlisting>
                </example>
        </section>

	<section id="siptrace.p.hep_version">
                <title><varname>hep_version</varname> (integer)</title>
                <para>
                The parameter indicate the version of the HEP protocol.
                Can be <quote>1</quote>, <quote>2</quote> or <quote>3</quote>.
                In HEPv2 and HEPv3 the timestamp and capture agent ID will be
                included in the HEP header.
                </para>
                <para>
                <emphasis>
                        Default value is "1".
                </emphasis>
                </para>
                <example>
                <title>Set <varname>hep_version</varname> parameter</title>
                <programlisting format="linespecific">
...
modparam("siptrace", "hep_version", 3)
...
</programlisting>
                </example>
        </section>
	<section id="siptrace.p.hep_capture_id">
                <title><varname>hep_capture_id</varname> (integer)</title>
                <para>
                The parameter indicate the capture agent ID for the <acronym>HEPv2</acronym>
                or <acronym>HEPv3</acronym> protocol.
                Limitation: 16-bit integer for HEPv2, 32-bit for HEPv3.
                </para>
                <para>
                <emphasis>
                        Default value is "1".
                </emphasis>
                </para>
                <example>
                <title>Set <varname>hep_capture_id</varname> parameter</title>
                <programlisting format="linespecific">
...
modparam("siptrace", "hep_capture_id", 234)
...
</programlisting>
                </example>
        </section>
	<section id="siptrace.p.trace_delayed">
                <title><varname>trace_delayed</varname> (integer)</title>
                <para>
		Use <quote>INSERT DELAYED</quote> to store to database when it is available,
		instead of <quote>INSERT</quote>.
                </para>
                <para>
                Default value is <emphasis>0 (off)</emphasis>.
                </para>
                <example>
                <title>Set <varname>trace_delayed</varname>
                parameter</title>
                <programlisting format="linespecific">
...
modparam("siptrace", "trace_delayed", 1)
...
</programlisting>
                </example>
        </section>
	<section id="siptrace.p.send_sock_name">
                <title><varname>send_sock_name</varname> (str)</title>
                <para>
			The name of the local listen socket from where to send
			the duplicated traffic via SIP or HEP. In the absence of this parameter
			&kamailio; automatically picks an interface. It has priority over
			'send_sock_addr' parameter.
                </para>
                <example>
                <title>Set <varname>send_sock_name</varname> parameter</title>
                <programlisting format="linespecific">
...
modparam("siptrace", "send_sock_name", "sock1")
...
</programlisting>
                </example>
        </section>
	<section id="siptrace.p.send_sock_addr">
                <title><varname>send_sock_addr</varname> (str)</title>
                <para>
			The local interface in the form of SIP URI from where to send
			the duplicated traffic. In the absence of this parameter
			&kamailio; automatically picks an interface.
                </para>
                <example>
                <title>Set <varname>send_sock_addr</varname> parameter</title>
                <programlisting format="linespecific">
...
modparam("siptrace", "send_sock_addr", "sip:10.1.1.2:5000")
...
</programlisting>
                </example>
        </section>
	<section id="siptrace.p.force_send_sock">
                <title><varname>force_send_sock</varname> (str)</title>
				<para>It is the same as 'send_sock_addr' parameter, this being
				kept for backward compatibility when 'send_sock_name' and
				'send_sock_addr' were introduced.</para>
        </section>

	<section id="siptrace.p.trace_init_mode">
                <title><varname>trace_init_mode</varname> (integer)</title>
				<para>
					Control what tracing modes are initialized.
                </para>
				<para>
				The value of the parameter can be a combination of next values:
				<itemizedlist>
				<listitem>
                <para>
                0 - all modes are initialized.
                </para>
				</listitem>
				<listitem>
                <para>
				1 - module initialized to do tracing only with core callback
				functions (see also 'trace_mode' parameter).
                </para>
				</listitem>
				<listitem>
                <para>
				2 - module initialized to do tracing only using config script flags
				and functions.
                </para>
				</listitem>
				</itemizedlist>
				</para>
                <para>
                Default value is <emphasis>0</emphasis>.
                </para>
                <example>
                <title>Set <varname>trace_init_mode</varname> parameter</title>
                <programlisting format="linespecific">
...
modparam("siptrace", "trace_init_mode", 1)
...
</programlisting>
                </example>
        </section>
	<section id="siptrace.p.trace_mode">
                <title><varname>trace_mode</varname> (integer)</title>
                <para>
				If not set to 0, the module uses core events triggered when receiving
				or sending SIP traffic to store it to database or mirror it to a SIP
				capture server using HEP or UDP forwarding.
				It will automatically do the handling of all SIP traffic.
				It is no longer needed to set the siptrace flag per request or
				execute sip_trace(), if it is done, then the storing and mirroring is
				duplicated.
                </para>
				<para>
				The value of the parameter can be a combination of next values:
				<itemizedlist>
				<listitem>
                <para>
                0 - no automatic mirroring or storing of SIP traffic.
                </para>
				</listitem>
				<listitem>
				<para>
				1 (1st bit set) - mirror the traffic to HEP server.
				</para>
				</listitem>
				<listitem>
				<para>
				2 (2nd bit set) - store the traffic to database server.
				</para>
				</listitem>
				<listitem>
				<para>
				4 (3rd bit set) - mirro the traffic to the SIP URI specified by
				duplicate_uri.
				</para>
				</listitem>
				</itemizedlist>
				</para>
                <para>
                The trace_on parameter still has to be set, allowing also to control
                this mode of mirroring via RPC commands.
                </para>
                <para>
                Default value is <emphasis>0</emphasis>.
                </para>
                <example>
                <title>Set <varname>trace_mode</varname>
                parameter</title>
                <programlisting format="linespecific">
...
modparam("siptrace", "trace_on", 1)
modparam("siptrace", "trace_mode", 1)
...
modparam("siptrace", "trace_mode", 3)
...
</programlisting>
                </example>
        </section>
	<section id="siptrace.p.auth_key">
                <title><varname>auth_key</varname> (integer)</title>
                <para>
A string with an authorization key.
Supported on HEPv3 only.
                </para>
                <para>
                Default value is empty.
                </para>
                <example>
                <title>Set <varname>auth_key</varname>
                parameter</title>
                <programlisting format="linespecific">
...
modparam("siptrace", "auth_key", "spoihepuirthpeuia")
...
</programlisting>
                </example>
        </section>
	</section>

	<section>
	<title>Functions</title>
	<section id="siptrace.f.sip_trace">
		<title>
		<function moreinfo="none">sip_trace([address][,correlation_id][,mode])</function>
		</title>
		<para>
		Store or forward the current processed SIP message/transaction/dialog in database.
		It is stored in the form prior applying changes made to it. Based on mode, one can trace
		the current message('m' - default), the current transaction('t') or the current dialog('d').
		</para>
		<para>Meaning of the parameters is as follows:</para>
		<itemizedlist>
		<listitem>
		<para><emphasis>address</emphasis> - The address in form of SIP URI
		where to send a duplicate of traced message. This parameter trumps
		duplicate_uri and allows tracing to more than one server.
		</para>
		</listitem>
		<listitem>
		<para><emphasis>correlation_id</emphasis> - A string with a correlation ID
		to be added to the HEP header when using HEPv3.
		It's possible to use PVs.
		</para>
		</listitem>
		<listitem>
		<para><emphasis>mode</emphasis> - SIP messages to be traced. One can trace the current message
		(function can be called on either a reply or a request), the current transaction(the route must
		belong to a request) or the current dialog(the message has to be an invite).
		</para>
		</listitem>
		</itemizedlist>
		<para>
		This function can be used from REQUEST_ROUTE, FAILURE_ROUTE,
		ONREPLY_ROUTE, BRANCH_ROUTE.
		</para>
		<emphasis>
			Default value is "NULL".
		</emphasis>
		<example>
		<title><function>sip_trace()</function> usage</title>
		<programlisting format="linespecific">
...
sip_trace();
...
sip_trace("sip:10.1.1.2:5085");
...
sip_trace("sip:10.1.1.2:5085", "$ci-abc");
...
/* trace current dialog; needs to be done on initial INVITE and dialog has to be loaded */
sip_trace("sip:10.1.1.2:5085", "$ci-abc", "d");
...
</programlisting>
		</example>
	</section>

	<section id="siptrace.f.sip_trace_mode">
		<title>
		<function moreinfo="none">sip_trace_mode(tmode)</function>
		</title>
		<para>
			Set the tracing mode: message, transaction or dialog. Only the first
			character of the parameter matters: m or M for message; t or T for
			transaction; d or D for dialog.
		</para>
		<para>
			In message tracing mode only the current message is stored or mirrored.
			In transaction tracing mode, all the messages of the current transaction
			are stored or mirrored. In dialog tracing mode, all the messages of the
			current dialog are stored or mirrored.
		</para>
		<para>
		This function can be used in ANY_ROUTE.
		</para>
		<example>
		<title><function>sip_trace_mode()</function> usage</title>
		<programlisting format="linespecific">
...
sip_trace_mode("t");
...
</programlisting>
		</example>
	</section>

	<section id="siptrace.f.hlog">
		<title>
		<function moreinfo="none">hlog([correlation_id,] message)</function>
		</title>
		<para>
		Sends a log event as a HEP3 packet to the homer host configured in
		<emphasis>duplicate_uri</emphasis>.
		</para>
		<para>Meaning of the parameters is as follows:</para>
		<itemizedlist>
			<listitem>
			<para><emphasis>correlation_id</emphasis> (optional) - Homer correlation
			ID for this event. If this parameter is not set, the current message's
			call-id will be used. (This parameter may contain PVs)
			</para>
			</listitem>
			<listitem>
			<para><emphasis>message</emphasis> - The text to send to Homer as log
			event. (This parameter may contain PVs)
			</para>
			</listitem>
		</itemizedlist>
		<example>
		<title><function>hlog()</function> usage</title>
		<programlisting format="linespecific">
...
hlog("[cfg:$cfg(line)] This is a log from kamailio to Homer");
...
hlog("$hdr(P-MyID)", "Another one with a custom correlation ID");
...
</programlisting>
		</example>
	</section>

	</section>

    <section>
	<title>RPC Commands</title>
	<section id="siptrace.r.siptrace.status">
		<title>
		<function moreinfo="none">siptrace.status param</function>
		</title>
		<para>

		</para>
		<para>
		Name: <emphasis>siptrace.status</emphasis>
		</para>
		<para>Parameters: </para>
		<itemizedlist>
			<listitem><para>on or off: turns on/off SIP message tracing.
			Possible values are:</para>
			<itemizedlist>
				<listitem><para>on</para></listitem>
				<listitem><para>off</para></listitem>
			</itemizedlist>
			</listitem>
			<listitem><para><quote>check</quote> does not change
			siptrace status, just reports the current status.</para>
			</listitem>
		</itemizedlist>
		<para>
		RPC Command Format:
		</para>
		<programlisting  format="linespecific">
...
&kamcmd; siptrace.status on
&kamcmd; siptrace.status off
&kamcmd; siptrace.status check
...
		</programlisting>
	</section>
	</section><!-- RPC commands -->

	<section>
		<title>Database setup</title>
		<para>
		Before running &kamailio; with siptrace, you have to setup the database
		tables where the module will store the data. For that, if the
		table were not created by the installation script or you choose
		to install everything by yourself you can use the siptrace-create.sql
		<acronym>SQL</acronym> script in the database directories in the
		kamailio/scripts folder as template.
		You can also find the complete database documentation on the
		project webpage, &kamailiodbdocslink;.
		</para>
	</section>

	<section>
	<title>Known issues</title>
	<para>
	Stateless forwarded messages (forward()) are not logged if you set the
	flag, use sip_trace() inside <emphasis>onsend_route</emphasis> block.
	</para>
	<para>
	If dialog level tracing is used internally generated BYE transaction(in
	case of internal timeouts) won't be traced. At the moment kamailio offers
	no posibility to trace those messages.
	</para>
	<para>
		<emphasis>Trace_info</emphasis> xavp name is reserved by this module.
		Any use of xavp with this name will result in overlapping internal
		avp used by the module therefore causing unknown consequences.
	</para>
	<example>
	<title>Send relayed ACK message</title>
	<programlisting format="linespecific">
...
onsend_route {
    if (is_method("ACK")) {
        sip_trace();
    }
}
...
</programlisting>
	</example>
	</section>

</chapter>