Events generated by Frafos equipment are JSON documents that report on various situations in operating SIP-based telephony equipment: a call started, a call ended, a telephone registered with the network, etc. The events absorb many details that occur during SIP processing, such as retransmissions, provisional responses, authentication transactions and registration renewals. Most of the events have many attributes in common so that the events can be filtered, grouped, and evaluated by these. For example, all "call-start," "call-end," and "call-attempt" events that describe the beginning of, the start of, and failure of a call include URIs of calling and called party, SIP Call ID, and make of SIP User Agent. However, only "call-end" events include the duration of a completed call and QoS statistics.
The following sections show anonymized examples of real-world SIP events.
Call-end events are generated when a call is successfully terminated using a SIP BYE transaction.
{
"@timestamp": "2024-05-08T17:54:10Z",
"ts": 1715190850,
"@version": "1",
"tls-cn": "5340085e-0e10-4b3c-8f4b-2fefe517bf6b",
"encrypt": "plain",
"AnsweredCalls": "0",
"id": "0E3C951B-663BBC33000044AA-060DD6C0",
"type2": "call-end",
"type": "event",
"attrs": {
"from-ua": "Loxone Pjsua2 Wrapper",
"setup_duration": "8.310",
"start_tm": "2024-05-08T17:53:55Z",
"sourceSubnets": "10.12.192.0",
"dst_ca_id": "backend-proxy",
"rtp-MOScqex-min": 4.4,
"src_ca_id": "public-users",
"rtp-direction": "bidirectional",
"rtp-lossmax": "0.0",
"callee_name": "",
"hangup_cause": "BYE",
"type": "call-end",
"method": "INVITE",
"rtp-lossmax-b": "0.0",
"from-domain": "foo.bar",
"rtp-MOScqex-avg-b": "4.4",
"rtp-lossmax-a": "0.0",
"sip_req_uri": "sip:mranonym@sip.iptel.org",
"release": "5.4",
"rtp-lossavg-b": "0.0",
"sip_from_uri": "smarthome@foo.bar",
"callee_host": "sip.iptel.org",
"rtp-lossavg": 0,
"source": "10.12.192.164",
"connect_tm": "2024-05-08T17:54:03Z",
"xcallid": "6FB115AF-663BBC330000561F-30E5A6C0",
"caller_host": "foo.bar",
"x-org-connid": "10.12.192.164-20240508195355-DtN8FjCu1iGbXqO",
"dst_ca_name": "proxy",
"rtp-lossavg-a": "0.0",
"rtp-stats-b": [
{
"bytes": "73508",
"data_drop_ip_restricted": 0,
"data_drop_rfc1918": 0,
"data_dropped": 0,
"dir": "in",
"drop_ip_restricted": 0,
"drop_rfc1918": 0,
"dropped": "0",
"dst_ip": "192.168.0.155",
"dst_port": "42218",
"expected": "799",
"gaps": "0",
"jitter": "0",
"last_seq_nr": "20959",
"lost_percentage": "0.0",
"max_delta": "96",
"max_delta_seq": "20204",
"MOScqex": "4.410",
"packets": "799",
"payload": "PCMA/8000",
"rtcp_drop_ip_restricted": 0,
"rtcp_drop_rfc1918": 0,
"rtcp_dropped": 0,
"seconds_since_last_received_packet": "0",
"src_ip": "192.168.0.155",
"src_port": "32850",
"ssrc": "4263867279",
"ssrc_hex": "FE25738F"
},
{
"bytes": "25268",
"data_drop_ip_restricted": 0,
"data_dropped": 0,
"dir": "out",
"drop_ip_restricted": 0,
"dropped": "0",
"dst_ip": "192.168.0.155",
"dst_port": "32850",
"jitter": "0",
"last_seq_nr": "4571",
"lost_percentage": "0",
"packets": "159",
"rtcp_drop_ip_restricted": 0,
"rtcp_dropped": 0,
"rtt_avg": "-",
"rtt_max": "-",
"rtt_min": "-",
"seconds_since_last_sent_packet": "2",
"src_ip": "192.168.0.155",
"src_port": "42218",
"ssrc": "1943530555",
"ssrc_hex": "73D7EC3B"
}
],
"from": "sip:smarthome@foo.bar",
"to": "sip:mranonym@sip.iptel.org",
"durationGroup": [
"S",
"U"
],
"dst_rlm_name": "backend",
"terminator": "caller",
"disposition": "answered",
"sip_to_uri": "mranonym@sip.iptel.org",
"duration": 16,
"routing_rule": {
"id": "7ccae64b-32e8-b808-6abd-000051f241ef",
"comment": "single (pre-duplex) rule if it came from outside, send itin"
},
"invite_reason": "OK",
"rtp-MOScqex-avg": 4.4,
"callee_user": "mranonym",
"rtp-stats-a": [
{
"bytes": "25268",
"data_drop_ip_restricted": 0,
"data_drop_rfc1918": 0,
"data_dropped": 0,
"dir": "in",
"drop_ip_restricted": 0,
"drop_rfc1918": 0,
"dropped": "0",
"dst_ip": "212.79.111.155",
"dst_port": "26654",
"expected": "159",
"gaps": "0",
"jitter": "1",
"last_seq_nr": "4571",
"lost_percentage": "0.0",
"max_delta": "39",
"max_delta_seq": "4482",
"MOScqex": "4.410",
"packets": "159",
"payload": "PCMA/8000",
"rtcp_drop_ip_restricted": 0,
"rtcp_drop_rfc1918": 0,
"rtcp_dropped": 0,
"seconds_since_last_received_packet": "2",
"src_ip": "10.12.192.164",
"src_port": "48778",
"ssrc": "1943530555",
"ssrc_hex": "73D7EC3B"
},
{
"bytes": "73416",
"data_drop_ip_restricted": 0,
"data_dropped": 0,
"dir": "out",
"drop_ip_restricted": 0,
"dropped": "0",
"dst_ip": "10.12.192.164",
"dst_port": "48778",
"jitter": "24",
"last_seq_nr": "20959",
"lost_percentage": "0",
"packets": "798",
"rtcp_drop_ip_restricted": 0,
"rtcp_dropped": 0,
"rtt_avg": "-",
"rtt_max": "-",
"rtt_min": "-",
"seconds_since_last_sent_packet": "0",
"src_ip": "212.79.111.155",
"src_port": "26654",
"ssrc": "4263867279",
"ssrc_hex": "FE25738F"
}
],
"r-uri": "sip:mranonym@sip.iptel.org",
"caller_name": "",
"src_ca_name": "users",
"originator": "caller-terminated",
"vars": {
"hello": "100"
},
"sbc": "2519f6fa-8b82-429a-9133-c9f95770b336",
"r-uri-shorted": "mranonym",
"bill_duration": "7.464",
"call-id": "sgGqiNF6p5GgByLjj4yUkh2G.msvDN-A",
"caller_user": "smarthome",
"hangup_initiator": "caller",
"hostname": "sbc",
"invite_code": 200,
"dst_cc": "unknown",
"src_rlm_name": "public",
"rtp-MOScqex-min-b": "4.4",
"durationMin": 0.26,
"end_tm": "2024-05-08T17:54:10Z",
"rtp-MOScqex-avg-a": "4.4",
"rtp-MOScqex-min-a": "4.4",
"transport": "udp",
"src-port": 52505
}
}
call-attempt events are generated when a SIP INVITE transaction completes with a non-200 status: 3xx, 4xx, 5xx or 6xx. failed authentication 407 and 401 is included in a separate event.
{
"@timestamp": "2024-05-08T17:59:02Z",
"tls-cn": "5340085e-0e10-4b3c-8f4b-2fefe517bf6b",
"encrypt": "plain",
"failure": "100",
"type": "event",
"attrs": {
"from-ua": "SIPPER for phoner",
"routing_rule": {
"id": "7ccae64b-32e8-b808-6abd-000051f241ef",
"comment": "single (pre-duplex) rule if it came from outside, send itin"
},
"to-ua": "ser (3.3.0-pre1 (i386/linux))",
"r-uri": "sip:johndoe@iptel.org",
"sip-code": 480,
"warning_hdr": "392 192.168.0.85:5060 \"Noisy feedback tells: pid=799 req_src_ip=192.168.0.155 req_src_port=6060 in_uri=sip:johndoe@iptel.org out_uri=sip:johndoe@iptel.org via_cnt==1\"",
"sourceSubnets": "192.168.102.0",
"src_ca_name": "users",
"src_ca_id": "public-users",
"dst_ca_id": "backend-proxy",
"vars": {
"hello": "100"
},
"type": "call-attempt",
"method": "INVITE",
"sbc": "2519f6fa-8b82-429a-9133-c9f95770b336",
"from-domain": "iptel.org",
"r-uri-shorted": "terlaradio",
"time-to-decline": "0.007",
"call-id": "80734C50-D20B-EF11-8AA1-D57BF9386386@192.168.0.11",
"release": "5.4",
"local-reply": false,
"source": "192.168.102.27",
"xcallid": "2C4194B0-663BBD6600011326-3024E6C0",
"hostname": "sbc",
"x-org-connid": "192.168.102.27-20240508195902-zdofj5nYzrL0u/g",
"sip-reason": "Temporarily unavailable",
"src_rlm_name": "public",
"dst_cc": "unknown",
"dst_ca_name": "proxy",
"from": "sip:foobar@iptel.org",
"to": "sip:johndoe@iptel.org",
"transport": "udp",
"dst_rlm_name": "backend",
"src-port": 5060
},
"ts": 1715191142,
"@version": "1",
"attrs_source_copy": "192.168.102.27",
"success": "0",
"tags": [
"beats_input_codec_json_applied"
],
"id": "73CD58FE-663BBD660000FF12-060DD6C0",
"type2": "call-attempt",
"termination": "netfailure"
}
Call-start events are generated when a SIP call begins, i.e. a SIP INVITE transaction completed using the 200 response code.
{
"@timestamp": "2024-05-08T17:54:03Z",
"tls-cn": "5340085e-0e10-4b3c-8f4b-2fefe517bf6b",
"encrypt": "plain",
"failure": "0",
"type": "event",
"attrs": {
"from-ua": "Loxone Pjsua2 Wrapper",
"routing_rule": {
"id": "7ccae64b-32e8-b808-6abd-000051f241ef",
"comment": "single (pre-duplex) rule if it came from outside, send itin"
},
"to-ua": "",
"time-to-accept": "8.310",
"r-uri": "sip:JohnDoe@sip.iptel.org",
"sip-code": 200,
"sourceSubnets": "192.168.192.0",
"src_ca_id": "public-users",
"src_ca_name": "users",
"dst_ca_id": "backend-proxy",
"vars": {
"hello": "100"
},
"type": "call-start",
"method": "INVITE",
"sbc": "2519f6fa-8b82-429a-9133-c9f95770b336",
"from-domain": "yadi.yada",
"r-uri-shorted": "JohnDoe",
"call-id": "sgGqiNF6p5GgByLjj4yUkh2G.msvDN-A",
"release": "5.4",
"local-reply": false,
"source": "192.168.192.164",
"xcallid": "6FB115AF-663BBC330000561F-30E5A6C0",
"hostname": "sbc",
"x-org-connid": "192.168.192.164-20240508195355-DtN8FjCu1iGbXqO",
"sip-reason": "OK",
"src_rlm_name": "public",
"dst_cc": "unknown",
"dst_ca_name": "proxy",
"from": "sip:smarthome@yadi.yada",
"to": "sip:JohnDoe@sip.iptel.org",
"transport": "udp",
"dst_rlm_name": "backend",
"src-port": 52505
},
"ts": 1715190843,
"@version": "1",
"success": "100",
"id": "0E3C951B-663BBC33000044AA-060DD6C0",
"type2": "call-start"
}
The alerting system generates systems on its own to make its performance measurable.
this event provides periodic updates on traffic passing frafos SBC from/to respective Call Agents
{
"@timestamp": "2024-05-07T08:13:55Z",
"@version": "1",
"tls-cn": "5340085e-0e10-4b3c-8f4b-2fefe517bf6b",
"encrypt": "plain",
"type": "event",
"attrs": {
"realm_name": "backend",
"bits_from": 32096057,
"ca_name": "proxy",
"ca_uuid": "213a8124-5e1f-9e29-1a53-0000131ca241",
"call_start_to": 38,
"release": "5.4",
"call_start_from": 42,
"hostname": "sbc",
"call_to": 4,
"bits_to": 32096333,
"type": "call_agents_counters",
"call_from": 27,
"realm_uuid": "7a859c41-504f-6dc9-5298-00005adb8e34",
"sbc": "2519f6fa-8b82-429a-9133-c9f95770b336"
}
}
The alerting system generates systems on its own to make its performance measurable.
The events are periodically generated to report on REDIS use of memory. They are of type "ingest_redishealth". Their content is specified in https://redis.io/docs/latest/commands/memory-stats .
{
"db": {
"0": {
"overheadHashtableMain": 17471544,
"overheadHashtableExpires": 10168,
"undefined": 0
}
},
"peakAllocated": 1675005456,
"totalAllocated": 1674022136,
"startupAllocated": 1193208,
"replicationBacklog": 0,
"clientsReplicas": 0,
"clientsNormal": 25352,
"undefined": 184,
"aofBuffer": 0,
"luaCaches": 1912,
"overheadTotal": 18702368,
"keysCount": 331931,
"keysBytesPerKey": 5039,
"datasetBytes": 1655319768,
"datasetPercentage": 98.95332336425781,
"peakPercentage": 99.94129180908203,
"allocatorAllocated": 1674609784,
"allocatorActive": 1684799488,
"allocatorResident": 1698037760,
"allocatorFragmentationRatio": 1.0060847997665405,
"allocatorFragmentationBytes": 10189704,
"allocatorRssRatio": 1.0078574419021606,
"allocatorRssBytes": 13238272,
"rssOverheadRatio": 1.0011746883392334,
"rssOverheadBytes": 1994752,
"fragmentation": 1.0155377388000488,
"fragmentationBytes": 26010456,
"attrs": {
"type": "ingest_redishealth",
"duration": 0
},
"tls-cn": "5340085e-0e10-4b3c-8f4b-2fefe517bf6b",
"@timestamp": "2024-05-10T14:30:17.000Z"
"encrypt": "plain"
}