SIP communications analysis using 3CX Log Viewer utility

Introduction

The 3CX Bin Log Viewer utility is designed to analyze 3CX Phone System log files. It includes powerful selection mechanisms to quickly find and analyze a variety of system events. 3CX Bin Log Viewer is an indispensable tool for finding and fixing complex system problems.

Installation

3CX Bin Log Viewer is installed from a separate download, or directly from the 3CX Management Console.

3CX 15.X: Download 3CX Bin Log Viewer V15
3CX 14: In the Management Console, go to Help> Download 3CX Log Viewer . A zip archive will be loaded, which should be unpacked and run the 3cxBinLogViewer.exe file .
3CX 12: In the 3CX Management Console, go to 3CX Phone System Updates> Other Updates and download the utility. It is downloaded to the Program Files \ 3CX PhoneSystem \ Bin \ Support \ 3CXBinLogViewer folder . The file being run is 3cxBinLogViewer.exe .
')

Job Overview

After running the utility, go to File> Open and select the folder where the 3CX log files are located. We do not recommend working with logs on the same server on which the 3CX server is running, since log analysis provides additional computational load. It is best to generate and download a file for technical support 3CX.



Then unzip the technical support file, and in the folder / Logs find the file 3CXPhoneSystem.bldef .

3CX Bin Log Viewer has 4 workspaces, as shown below.

Event selection area

In the Filtering Options area, you can select the date, time, and type of events that interest you. After selection, they are displayed in the log viewer (Log Window).



Select by date: Select a range of events limited by date / time. The event time zone corresponds to the settings on the local 3CX server.

Filtering by tag : Most log entries are tagged. For example, all entries associated with a particular call are tagged with a Call ID (for example, CallID 10). There are several useful tags that you will often use. We will look at them at the end of the article.

Click on the desired tag, and it will move to the right window, as well as down, to the Formula text tag selection formula. After building the formula, click Apply , and the events with the necessary tags will be selected. Example of use: you need to select events with the SiPMsg.method (INVITE) tag (INVITE method) for the number 100. Select this tag, click the AND button, and then select the DN tag (100) . You can also use constructs with nested tags. For example, select INVITE requests for two calls - with Call ID 12 and 13, as in the screenshot below.



The event selection formula is updated dynamically when you add or remove tags. We recommend saving the text of the formula in order to quickly apply it in the future. Please note that the log may not contain the required data if it is not generated by the system. For example, if extension number 116 is missing in 3CX, you will not find anything by the DN 116 tag.

Highlight Matching Logs : If this option is enabled, all log entries are shown, and the entries corresponding to the selection are highlighted in red.

Log display area

The log window displays selected (or highlighted) entries. For example, the screenshot above shows the selected entries for extension 100. You can right-click on the entry and select all entries, or copy this entry to the clipboard. You can also select multiple entries by holding Shift or Ctrl.

Tag Area

The tags area displays all tags associated with the selected log entry. By clicking on a tag, you select entries in which this tag is present. When using logical operators, first click on the operator button (AND, OR, NOT), and then on the desired tag.

The tag window is useful for viewing existing tags in the system. In the screenshot above, an entry is selected with the CallId 12 tag and the DestAddr.Host tag corresponding to the IP address of the recipient host.

Record Details Area

When you select a log entry, the expanded events associated with this entry are displayed at the bottom (Detail window). Some entries contain several event lines, for example, detailed SIP messaging, as in the screenshot below.

Other utility features

Number of records / page : 3CX Log Viewer splits the log records into “pages” - displayed information blocks, since the output of the entire log at once may require too much PC resources. In the application settings, you can specify how many records to display per page. The default is 10,000 entries. You can scroll through the pages with the buttons located on top of the log display area.

Search in logs : You can do a search in the log files by specifying the search string in the Find field and pressing Enter . The search is performed from the current cursor position to the end of the file. The buttons with up and down arrows allow you to search to the beginning and end of the log, respectively (search is carried out on all pages of the log).

Opening log files : When running, 3CX Log Viewer automatically loads the last open log file. A new log file can be opened by going to the menu in File> Open . The latest open files are visible in the File> Recent Logs menu.

Preferences : In the View> Preferences menu, you can specify the number of entries displayed per page, the severity of the displayed events and the depth of the log. The screenshot below shows the settings that are suitable for analyzing most situations. The configured parameters are saved when the utility is restarted.



File Associations : In the Settings> Associate log files menu, you can associate files with the blrec and bldef extensions with the 3CX Log Viewer utility.

Export to Text : In the Tools> Export to text menu, you can export selected log entries to a text file. Records from all pages are saved. Details of the saved information can be configured in the Settings> Preferences menu.

Command line : 3CX Log Viewer can be run from the Windows command line:

3cxBinLogViewer.exe <log file path> <text file export path>

• 3cxBinLogViewer.exe c: \ 3cxlogs - downloads log files located in the c: \ 3cxlogs folder
• 3cxBinLogViewer.exe c: \ 3cxlogs c: \ 3cxlogs \ txtlog.txt - downloads the log files located in the c: \ 3cxlogs folder and exports them to the file c: \ 3cxlogs \ txtlog.txt

3CX log file structure

The 3CX Phone System log files are one file with the bldef extension and one or more files with the blrec extension.

• The bldef file contains data about tags and an index
• The blrec file contains logs

To analyze the logs, both of these files are needed, and one bldef file is used in conjunction with several blrec files. These log files are created by the PBX 3CX Phone System Service. Other system services, for example, 3CX PhoneSystem Media Server, write text logs in the .log format, which can be opened using the Notepad ++ utility.

The system is configured to rotate (overwrite) the logs when it reaches 50 MB.

• If archiving of logs in Home> SIP events> Parameters is disabled, two blrec files are supported - the current and the previous one
• If logging is enabled, older blrec files are moved to the backup folder. You can specify the number of days for which the log files should be saved.

Some helpful tags

Here are some commonly used event tags to give you the basics of working with the utility:

• CallId : Each call in the system is assigned a Call ID. The CallId tag allows you to select all events associated with a single call, from its creation to completion.
• Cause.Code : this tag shows SIP events related to a specific reason. For example, if you need to find all the events that led to the “Busy” signal (error code 486), use the selection Cause.Code = 486
• Contact.Host : this tag allows you to select events associated with a specific IP address in the SIP header.
• DestAddr.Host and SrcAddr.Host : this tag is applicable when searching by the IP address of the recipient or source of the call. This is the network IP address of the packet, not the address in the SIP header.
• DN : this tag identifies the extension number in 3CX or the virtual extension number is the registration number of the VoIP gateway port. Use it to select events associated with a specific internal number or device port.
• InboundDID : This tag selects events related to a specific DID number.
• SipMsg.Method : for this tag it is convenient to select events associated with a specific SIP method. For example, if you want to select all registration events, use the REGISTER method. You can then select these events for a specific date or time to determine exactly when the device registered. Also note the other SipMsg.X tags - they are often used when analyzing 3CX performance.