Call analysis: pull all calls of a period

What it is for

Call analysis pulls all calls of a period for one CUCM connection and shows them as a list. You need it when you do not yet know the affected call: "calls did not get through between 10:00 and 10:30". Call diagnostics, by contrast, examines a single call that is already known.

Such a pull is called a run. It combines two sources. The CDRs provide the complete list of finished calls with times, numbers, devices and causes. The SDL traces of the CallManager nodes provide the SIP messages and therefore the call flow, including calls that were not completed or are still in progress. If one source is missing, the list is built from the other, with a notice on the run.

The run works in the background and is then stored for 7 days. During that time you can open the result as often as you like without querying the CUCM again. Without the traces source the CUCM is not contacted at all.

Prerequisites

• Licence module cucm. The function is described as it runs on the lab system (menu entry Logs → Call Analysis).
• Role ROLE_APP_CALL_DIAGNOSTICS with page role ROLE_APP_VIEW_CALL_DIAGNOSTICS_PAGE. Read-only accounts may view and export stored runs but may not start, cancel or delete runs.
• The account is not restricted to locations. The analysis shows all calls of the cluster and is not available to location-restricted accounts.
• For the list of finished calls: the CDR import of the CUCM connection is enabled.
• For call flows: on the CUCM, Cisco CallManager uses trace level Detailed with Enable SIP Call Processing Trace.
• For call flows: the AXL user of the connection has the CUCM roles Standard CCM Admin Users and Standard RealtimeAndTraceCollection.
• At least 256 MiB of disk space is free on the EasyUC server for the run.

Step by step: pull calls

1. Select the CUCM connection in the header. The page shows it at the top right under CUCM connection.
2. Open Logs → Call Analysis.
3. In the Pull calls area, choose a quick selection under Period: Last 15 minutes, Last 30 minutes or Last 60 minutes.
4. For a different window, click Custom period and enter From and To.
5. Under Data sources, select CDRs (finished calls) and Call flows from CUCM traces (SIP). At least one source must be selected.
6. If required, open Filters (optional) and enter a Number or a Device name to keep only matching calls.
7. Read the hints below the button. They state the permitted length and how current the CDRs are, for example "CDRs are available up to …. Later calls come from the traces only."
8. Click Pull calls. EasyUC creates the run and opens its page.
9. Follow the progress. The display names the phase ("Reading CDRs", "Downloading and reading trace files", "Combining calls" …), the node, the file counter and the CDRs and SIP messages read so far.
10. When the run has finished, the page shows the call list. The chapter on the call list continues from here.

Step by step: cancel, reopen or delete a run

1. To stop a run in progress, click Cancel run on its page. A cancelled run stores no calls.
2. To open an earlier result, open Logs → Call Analysis and click the row under Stored runs.
3. To repeat the same period with more recent CDRs, click Pull this period again on the page of the run.
4. To remove a run, click the bin icon in its row and confirm Delete this run with all its stored calls?. A run in progress must be cancelled first.

Fields and options

How to read the page of a run

Check the result and narrow down errors

• You recognise success by the status Completed and by the number under With call flow matching the number of SIP calls in the period.
• "A run is already active for this connection.": one run per connection at a time. Open the active run takes you to it.
• "Several runs are already waiting. Please try again later.": at most three runs are active at the same time overall.
• "The run is waiting. If another diagnosis is running, it starts afterwards.": trace collections run one after the other, also in relation to call diagnostics.
• "The period must not be longer than … minutes." or "The period must be at least … seconds long.": adjust the period or deselect the traces source.
• "Call analysis shows all calls of the cluster and is not available to accounts restricted to locations.": use an account without a location restriction.
• "There is not enough free disk space on the server for a run.": delete old runs and check the storage page.
• "The traces contain no SIP messages. Set the trace level "Detailed" with "Enable SIP Call Processing Trace".": correct the trace setting on the CUCM.
• "Node … could not be read (role missing)": add the CUCM roles to the AXL user. For "TLS error" or "not reachable", check the certificate and the network path to the node.
• "CDR import is off for this connection. The list comes from the traces only.": set up the CDR import on the CUCM connection if you want to see finished calls completely.
• Failed runs state the reason, for example "The worker stopped responding." or "The run was not started in time." In that case check the background services.
• Protective limits per run: 40 trace files per node and 120 in total, 40,000 SIP messages, 20,000 CDR rows, 10,000 calls, 10 minutes of trace reading time and 15 minutes of total run time.
• "The period is … hours old; the traces may already be overwritten on the CUCM.": the run tries anyway. If the call flows are missing, the list from the CDRs remains.
• "More than … CDRs in the period; the rest is missing. Choose a shorter period." and "More than … calls in the period; the list is cut off. Choose a shorter period or a filter.": a protective limit was reached.
• "More than … SIP messages in the period; later ones are missing. Choose a shorter period.", "Reading the traces stopped after … seconds." and "The worker's memory limit was reached; later SIP messages are missing.": on a busy cluster the limit is not enough for 60 minutes. The notice "Call flows were read only for … – …." names the range covered.
• "… calls began before the period and are not listed.": a call belongs to the run if it began within the period. Let the period start earlier.
• "The devices could not be resolved; the call flow shows addresses.": the lanes then carry IP addresses instead of device names. The flow itself is complete.
• "Run filter: … calls kept, … dropped.": confirms the effect of the filters Number and Device name.
• Further reasons for failed runs: "The CUCM connection is not available.", "The result could not be stored.", "The run could not be handed to the worker." and "Internal error. See the worker log for details."
• A run without a sign of life counts as failed after 5 minutes, a waiting run after 60 minutes.