Cisco Call Manager, using tail command for log files because RTMT is a POS Java app.

March 21, 2016 - Cisco

If you come form a Linux background and you work with Cisco Call Manager, you are probably wondering why do I have to use this RTMT software just to watch the output of some simple log files? Why can’t I just use tail? This is just Redhat right? Well you can!

So SSH to Call Manager. (Most likely your sub is your active TFTP server so that’s where you’ll want to be.)

Root File listing:

file list activelog /

TFTP logs can be found in:
file list activelog /cm/trace/ctftp/sdl

Add the detail option to get date/time filesize
file list activelog /cm/trace/ctftp/sdl detail

Since you will want to be tailing what is currently happening on the TFTP server you will want the log file currently being written to. So you will need to list the files with the detail option so you can determine the active file.

admin:file list activelog /cm/trace/ctftp/sdl detail
21 Mar,2016 10:59:06 1,243,449 SDL001_600_000075.txt
21 Mar,2016 11:03:11 1,243,551 SDL001_600_000076.txt
21 Mar,2016 11:07:17 1,246,739 SDL001_600_000077.txt
21 Mar,2016 11:11:14 1,245,477 SDL001_600_000078.txt
21 Mar,2016 11:12:12 326,451 SDL001_600_000079.txt
20 Mar,2016 22:21:35 1,243,570 SDL001_600_000080.txt
20 Mar,2016 22:25:18 1,243,302 SDL001_600_000081.txt
20 Mar,2016 22:29:13 1,243,851 SDL001_600_000082.txt
20 Mar,2016 22:32:59 1,245,008 SDL001_600_000083.txt

dir count = 0, file count = 201

So in this abbreviated listing you can see the one I marked in bold is the current file SDL001_600_000079.txt would be the file to tail. It’s important to note that CUCM will only log to this file until it reaches a certain file size, (this is kind of a guess, based on observation) it will start writing to the next file in numerical order. So if you stop seeing updates, stop tailing, (hit ctrl-c) then press the up arrow and then edit the command to start tailing the next file SDL001_600_000080.txt in this case. Keep in mind if it is currently logging to the highest file number, it will start over at the lowest file number. So if I was tailing SDL001_600_000200.txt the next file would be SDL001_600_00001.txt. Also for you none Linux users, Linux is case sensitive, so sdl001_600_000200.txt is not the same as SDL001_600_000200.txt.

Here is what you should see:

admin:file tail activelog /cm/trace/ctftp/sdl/SDL001_600_000106.txt

99137249.000 |11:00:12.916 |AppInfo |<--CReqContext::tftp[0xe6a0dd0~281~] 99137250.000 |11:00:12.916 |AppInfo |<--TID[e846eb70] CReqContext::TFTPProxyRun(), [0xe6a0dd0~281~] 99137251.000 |11:00:12.916 |AppInfo |TID[e846eb70] CReqContext::~CReqContext[0xe6a0dd0~281~] 99137252.000 |11:00:17.439 |AppInfo |RequestPoller::pollForRequest(30), fd(12) Read Ready 99137253.000 |11:00:17.439 |SdlStat |Period: 6s #Lines: 75 #Bytes: 9247 Total Number of Buffers: 2000 Free LWM: 1983 Free LWM(total): 594 99137254.000 |11:00:17.439 |AppInfo |-->TID[d8a55b70] TFTPEngine::getRequest[0xe6a17b0](), server socket(12)
99137255.000 |11:00:17.439 |AppInfo | TID[d8a55b70] TFTPEngine::getRequest[0xe6a17b0](), server socket(12) File Requested CTLSEPE4D945C2E501.tlv
99137256.000 |11:00:17.439 |AppInfo |<--TID[d8a55b70] TFTPEngine::getRequest[0xe6a17b0](), server socket(12) 99137257.000 |11:00:17.439 |AppInfo | TID[d8a55b70] TFTPServer::recvMessage[0x88ca238]() sockets:12 CReqContext[0xe6a17b0] Requested File[CTLSEPE4D945C2E501.tlv]

You will want to enable logging in Putty or whatever SSH client you are using. In large environments this log will be rather chatty, the file will fill up quickly, and move to the next file, which can be a little annoying. Since you are logging it to a file though, you can open it in Notepad++ or whatever and search, usually by the IP of the device you are working with. I've had this method come in handy from time to time for actively logging various services. Sometimes because it's quicker, other times because the RTMT tool can be an annoying POS!

Leave a Reply