Call analysis: read the call list, details and call flow

What it is for

After a call analysis run, the call list of the period is available. This chapter describes how to find the conspicuous call in it and what the detail page of a call shows: overview with explained causes, call flow, media and quality, devices involved and raw data.

If both CDR and SIP exist for a call, the CDR is authoritative for result, numbers, times and duration. The SIP messages provide call flow, SIP status, quality values, nodes and device names. The detail page always states how CDR and SIP were matched.

Prerequisites

A finished call analysis run with status Completed or Partial.
Role ROLE_APP_CALL_DIAGNOSTICS. Viewing and exporting also works with a read-only account.
For CUBE messages in the call flow: read access to the CUBEs. This data is not stored in the run; it is added fresh from the CUBE capture when the call flow is opened.
The description reflects the lab system.

Step by step: find a call in the list

Open Logs → Call Analysis and click the run under Stored runs.
Enter a known value in the search field Search number, device, user or Call-ID.
Narrow down with the buttons under Result, for example Failed, Busy or No answer.
If required, use Features (for example Forwarded, Trunk / gateway), Source, Quality and Call flow (With call flow / Without call flow).
Sort by clicking the column headers Start, Caller, Reached, Duration or Result.
Click the row of the call to open the detail page.
Reset filters removes all filters again.

Step by step: evaluate a call

On the Overview tab, read result, causes, times and the redirect chain.
Switch to the Call flow tab. The diagram is the same as in call diagnostics: lanes per peer, arrows per SIP message, click an arrow for the message.
If the call flow is missing, read the reason given. Click Start a single diagnosis to create a call diagnosis for exactly this call.
On the Media / quality tab, check codec, media address, encryption and the RTP statistics of the endpoints.
On the Devices tab, use Open device or Open user to open the phone or user involved in EasyUC.
The Raw data tab holds the CDR fields and the SIP messages in their original form. Use Filter field or value to look for a specific CDR field.
Click Export and choose Everything (JSON), SIP messages (text), Call flow (JSON) or CDR (CSV).
Back to the call list returns to the run. Export the whole list there with List as CSV.

Fields and options

Fields and options
Field / action	Meaning and use
Start	Time at which the call began. A call belongs to the run if it began within the period.
Caller	Calling number.
Dialled / Reached	Number originally dialled and the number where the call finally arrived. If they differ, the call was redirected.
Duration	Talk time.
Result	Answered, Abandoned by caller, Busy, No answer, Rejected, Unreachable, Failed, In progress (from SIP only) or Unknown.
Devices / trunks	Phones, softphones, trunks and gateways involved.
Nodes	CallManager nodes the call went through.
Features	Forwarded, Transfer, Conference, Hunt group, Queue, Trunk / gateway, Encrypted, Video.
Quality	Good, Fair, Poor or No data. Based on the worst receive statistics: MOS from 4.0 good, from 3.6 fair; without MOS, packet loss below 1 % and jitter below 30 ms good, below 3 % and below 60 ms fair.
Call flow	Call flow available, Call flow incomplete or No call flow.
Source	CDR and SIP, CDR only or SIP only.
Per page	25, 50 or 100 calls.
Result: origin	With a CDR, the CDR decides: a connect time means Answered, otherwise the cause counts. Without a CDR, the last SIP response decides. The exact mapping is in the chapter on cause codes.
Features: origin	From the redirect reasons and other fields of the CDRs and from the SIP messages: the `Diversion` header for forwarding, `REFER` and `Replaces` for transfer, the SDP for video and encryption.
List as CSV	Exports the list with the filters that are set. The times are in UTC.

How to read the detail page

How to read the detail page
Field / action	Meaning and use
Overview: Start, Answered, End	Times of the call, plus Ring time and Talk time.
Result and Ended by	Outcome of the call and the side that hung up.
Causes	Cause values of the calling side and the called side as text. The text names the Q.850 cause, the SIP status where applicable and always the raw value. Unknown values remain visible as "Code n".
Redirect chain	Stations from Dialled through Intermediate and Last redirected by to Reached. The CDR records only the first and the last redirect.
Hunt pilot / Time in queue	Hunt pilot and waiting time if the call went through a hunt group with a queue.
Matched by	Session-ID, CUCM leg identifier, Cisco-Guid or Time and numbers. The last one is the least certain; the page points this out separately.
Legs (CDR rows)	The individual CDR rows of the call, for example for a transfer or conference.
Media / quality: Media streams	Per side codec, bandwidth, media address, DTMF method, video and encryption from the CDRs.
RTP statistics of the endpoints	Per reporting device and direction (Receive, Send): packets, loss, jitter and MOS. The values come from the SIP messages the endpoints send at the end of the call. MOS is shown only if the endpoint sends it.
Devices: Role	Caller, Called or In the call flow, plus name, kind, IP address, model, description and user.
Raw data	Credentials, keys and keypad input are redacted.
Overview: Users, Identifiers, Partitions	Users of the devices involved, the identifiers of the call (Call-IDs, Session-ID, leg identifiers) and the partitions of the numbers.
Call flow: With messages of the CUBE debug capture	Names the CUBEs whose messages are merged into the flow. They are read fresh every time the call flow is opened and are not stored in the run.
Media: DTMF	No preference (any matched method), Out of band, RFC 2833, Out of band and RFC 2833 or Unknown. "No preference" is the normal case between phones and does not mean that no key presses were transmitted.
Media: Encryption	Not secured, Authenticated or Encrypted.
Media: Rating	Overall rating of the call based on the worst receive direction reported.
Devices: Type	IP phone, Jabber / Webex, Webex App, Analog port, Trunk, Gateway / CUBE, Expressway, Other CUCM cluster, Voicemail, Media resource, CUCM node or Unknown.
Export: Everything (JSON)	All data of the call: overview, causes, media, devices, CDR fields and SIP messages.
Export: SIP messages (text) / Call flow (JSON) / CDR (CSV)	The SIP messages as text, the diagram model with lanes and arrows, or the CDR rows of the call.
Redacted content	Removed before storage: the headers `Authorization` and `Proxy-Authorization`, SRTP keys in the SDP, key presses sent over KPML or `INFO`, the password in a SIP address and the authorization code in the CDRs.

Check the result and narrow down errors

A call is evaluated conclusively when result, cause and the last response code in the call flow agree, for example Busy and 486 Busy Here.
"There is no CDR for this call: not completed, still active, not imported yet or CDR import off.": the call comes from the traces only. Pull the period again later, once the CDRs have arrived.
"No SIP was found in the traces for this call (no SIP device, trace level or traces overwritten).": SCCP or analogue devices have no call flow. Otherwise check the trace level.
"The call lies outside the trace range that was read.": the run did not read the traces for the whole period. Pull a shorter period.
"The call flow is incomplete: the call was still running at the end of the range read, or a node is missing.": repeat the run after the call has ended or check the Nodes read table.
"CDR and SIP were matched by time and numbers only.": with several simultaneous calls between the same numbers, cross-check the match using the times.
"The endpoints reported no RTP statistics.": the quality is then No data. This is not an error of the call.
The notice about CMR data on the Media / quality tab means that no CUCM CMRs are evaluated. The quality values come exclusively from the SIP messages of the endpoints.
"This call no longer exists." or "This run no longer exists (deleted or expired).": the run is older than 7 days or was deleted. Pull the period again while the traces still exist on the CUCM.
"The run did not read traces.": the run was started with the CDR source only. Pull the period again with the traces source or click Start a single diagnosis.
"The call flow was limited to … messages.": the call has more than 800 SIP messages. The beginning is complete.
"The stored raw data of this call cannot be read.": the columns of the list remain visible, call flow and raw data are missing. Pull the period again.
"There is no call flow for this call." or "The call flow could not be loaded.": in the first case there is no SIP, in the second the server cannot be reached. Reload the page.
"You do not have permission for this.": the account lacks ROLE_APP_CALL_DIAGNOSTICS, or it is a read-only account and the action would change something.