Trouble shooting on Yealink. Part 2. Collection and initial analysis of logs

In the second part of the article (see part 1), we will discuss the algorithm for collecting logs on Yealink phones, their recording and export, available for setting up the log collection option, and also talk about how to perform an independent primary analysis of the logs.

In addition, below we will consider some issues related to the collection / transfer of logs to a third party (manufacturer, distributor) and opening tickets in the ticket systems of the manufacturer / distributor.

1. Write a network log (Pcap)

Yealink phones can record a network log. The log can be configured and uploaded in the device web interface.

To record a network log using the phone, you must perform the following steps.

1. Log in to the web interface of the phone.

2. Open a tab Settings – Configuration – Pcap.

3. Select the type of logging. Option To phone memory suitable if the volume of traffic is small, and the reproduction of the problem will take no more than 5 minutes. Otherwise, it is recommended to select the option To PC memory.

4. Click Startreproduce the issue, click Stop.

5. If you selected the recording mode in the phone memory in step 3, after stopping the recording, you must press Export. If the recording was made to the PC memory, the log file will be located in the browser’s downloads folder.

Tips to make it easier for you to analyze the network log yourself

Hint 1

• use the SIP filter so that only SIP messages remain in the list;

• use http, dhcp, rtp, rtsp, etc. filters to keep messages of a certain type in the list;

• to filter by IP address use filters ip.addr = 1.1.1.1, ip.src == 1.1.1.1, ip.dst == 1.1.1.2, where id.addr is the IP address, ip.src is the source IP address, ip.dst is the destination IP address;

  

• combine filters ($$ – logical AND, || – logical OR, ! – logical NOT).

  

Hint 2

• use the menu to view the calls made Telephony – VOIP Calls – Flow Sequence;

  

• to view and listen to RTP streams, use the menu Telephony – RTP – RTP streams.

  

Additionally: there are other methods for recording the network log, which are used if the problem is difficult to reproduce on your own, or when for some reason it is not possible to record logs through the web interface.

1. You can set up mirroring of the phone’s Internet port to a PC port, and then intercept the traffic using Wireshark or another network traffic sniffer.
Note: the traffic mirroring algorithm using the phone is described in the first part of this article, paragraph 5.

2. You can configure port mirroring on the switch (traffic from the port to which the phone is connected is mirrored to any other port to which a PC with Wireshark or other network traffic tap is connected. This method requires a managed switch with support for this function.

Capturing and storing traffic with Wireshark

1. Download Wireshark.

2. Open Wireshark and select the capture interface by double clicking the left mouse button on the interface name.

3. In the window that opens, make sure that the traffic capture has started.

4. When the issue has been reproduced, the log must be stopped and downloaded. This can be done in the following way.

Click the button in the upper left corner Stop capturing packets.

Then click File – Save As and save the file to the PC memory.

2. Write system log (local log and syslog)

System log – standard for Unix devices logging of system events. On Yealink phones, there are 2 options for recording the system log: local log and syslog. Both record options can be uploaded by the user; the user can also analyze them on his own, since the records are not encrypted and can be opened with a text editor (Notepad, Notepad++).

Local log

Yealink phones record local log system log in real time with default settings. The logs are stored in the device’s RAM and will be lost when the device is rebooted.

By default, logging is at level 3, and the maximum log file size, depending on the device model, may be limited.

For troubleshooting, logs should be recorded at the maximum logging level, 6. The logging level must be set in advance, before the problem is fixed.

How to write and upload the local log

1. Go to the device web interface.
Web interface: Settings – Configurations – Local Log

2. Set the following options:
Enable local log = Enable
Local Log Level = 6

Maximum log file size = 2048KB (need to set the maximum allowed value; for flagship devices, the log file size can be higher and be, for example, 20480KB).

3. If the device supports parameter setting Module loggingparameter Module logging level should be set like All 6.
Web interface: Settings – Configurations – Module logging

4. Save the logging settings by pressing the key Save.
Web interface: Settings – Configurations – Save

5. After the occurrence of the incident, export the log file.
Web interface: Settings – Configurations – Local log – Export

Note1: The local log system log consists of several files, among which:
boot.log – a log showing the process of loading the device;
system_dump.log — a log showing the current state of the device;
MAC.log.X – system log files.

syslog

Yealink phones can record the system log to an external syslog server. This option requires preliminary configuration: you need to start and configure the server, as well as configure the logging function on the phone itself.

How to write and upload syslog

1. Set up the server side. As an example of the simplest syslog server, let’s take TFTPD64 deployed locally on a PC. Download link

2. Set up the client part (phone web interface).
Web interface: Settings – Configurations – Syslog

The minimum required settings: enabling logging, specifying the server address and port, specifying the logging level.

Optionally, you can set other logging parameters, their description is given below:
Syslog Server — URL address of the syslog server;
Port — syslog server port, by default — 514;
Syslog Transport Type — transport logging protocol;
Syslog level – logging level. For debugging (most cases) you need to set the level 6. To troubleshoot some specific problems, you can lower the logging level (more details later in this article);
Syslog Facility – options for generating system log messages according to RFC 3164;
Syslog Prepend MAC — add MAC address to system log messages;
Automatic export of system log to USB — write the system log to a USB drive (for phones with a USB port).

3. If the device supports parameter setting Module loggingparameter Module logging level should be set like All 6.
Web interface: Settings – Configurations – Module logging

4. Download the recorded log from the syslog server.

Using TFTPD64 as an example: press the key Copy and paste the content into a text file.

Briefly about the module logging option

Option Module log was added to the firmware of the 86th generation for some devices and is designed to fine-tune the logging of the system log (local log and syslog).
Web interface: Settings – Configurations – Module logging

The logging level is set by two parameters:

• logging level from 0 to 6 (the higher the level, the more entries the log contains);

• defining the type of records that will be included in the log – for example, events of the operating system, voice and video transmissions, drivers, etc.

3. Logs for technical support and export of all diagnostic files

Correctly collected logs attached to the ticket when it is opened can significantly speed up the consideration of the application, and, as a result, the solution of the problem that has arisen. Let’s consider what package of logs will be optimally provided in a particular case, as well as how to collect logs correctly.

The standard package of logs for opening a ticket in the Yealink ticket system looks like this:

• system log local log;

• network log;

• full configuration config.bin;

• optional for speech quality problems – audio diagnostics.

Note 1. When recording a system log (local log or syslog), you can independently verify that logging is carried out at the desired level by the presence of messages with the desired logging level (the level of system log recording is determined by the highest level of messages immediately at the time of the problem).

Note 2. Option Module log sets the logging components when writing the system log syslog, local log (OS, driver, peripherals, protocol, etc.). The range of valid values ​​is from 0 to 6, while the higher the level, the more logging components, and, accordingly, more messages.

Note 3. All 4 files (system log, network log, configuration, audio diagnostics) can be uploaded at the same time using the option Export all diagnostic files.

Important: when exporting logs in this way, you must set the parameter local log level into meaning 6 and (if necessary) specify the maximum size of the log file (parameter Maximum log file size in local log settings). On devices where there is an option Module log levelits value must also be set to All 6.
Web interface: Settings – Configurations – Diagnostics – Export all diagnostic files

Contacting distributor or reseller technical support

As a rule, the distributor or reseller does not have any specific requirements for the logs that must be provided when opening a ticket. However, as is the case with the vendor’s ticket system, timely provision of a correctly compiled log package can expedite the consideration of the ticket. Let’s consider this situation using the example of the IPiMatica ticket system.

When submitting an application through the support.ipmatika.ru website, the user will be prompted to fill out an application form, to which files can be attached.

Attach logs to the ticket, based on which (in the opinion of a technical specialist) a problem that has arisen in the system can be identified.

If there is no understanding of the specifics of the problem, the network log, system log (local log or syslog) and the CFG configuration file can act as a universal set of logs.