Enhanced Event Logging
Feature Summary and Revision History
Feature Description
How Event Logging Works
Configuring Event Logging
Monitoring and Troubleshooting Event Logging
- Event Logging Show Command(s) and/or Outputs

Enhanced Event Logging

This chapter describes the MME's Event Logging functionality which occurs at the subscriber level, from the MME to an external server.

Feature Summary and Revision History

Summary Data


Applicable Product(s) or Functional Area	MME
Applicable Platform(s)	ASR 5500 VPC-DI VPC-SI
Feature Default	Enabled- Always-on
Related Changes in This Release	Not applicable
Related Documentation	MME Administration Guide Statistics and Counters Reference

Revision History


Revision Details	Release
Customization of Attributes and Events in EDR Profile has been added.	21.24
Customization of Attributes and Events in EDR Profile functionality has been introduced.	21.23.1
First Introduced	21.1

Feature Description

The MME handles numerous subscriber calls from different eNodeBs in the network. In order to troubleshoot any issues for a particular subscriber, the events that caused the issue is recorded. The events could be individual procedures listed below:

Attach Procedures
Detach Procedures
TAU Procedures
Handover Procedures
All types of Service Requests
Paging based on different triggers
PDN Connectivity Requests
All types of PDN detach and network initiated PDN detach procedures
Dedicated Bearer Activation Requests
Dedicated Bearer Deactivation Requests
All types of Bearer modification procedures
CSFB procedures
SRVCC procedures
eCSFB procedures
eSRVCC procedures

The Event Data Record is a proprietary feature of StarOS. In this feature, MME provides a debugging framework to capture procedure level information for each subscriber. On the completion of a procedure successfully or unsuccessfully, the MME generates a procedure summary. This summary provides details of the events and issues, which is nearly comparable to real-time debugging.

Important

This feature is license controlled. Please consult your Cisco Account Representative for information about the specific license.

MME supports the following functionality in this feature:

Event Logging for 4G subscribers.
The Event Records are stored in CSV file format.
A framework to collect information and eventually provide log information. The framework is extensible to hold more procedures and information fields.
The order of fields are not changeable.
The event logs are generated on completion of the procedure successfully or unsuccessfully. The procedure could be unsuccessful because of local reasons such as – HSS/Peer element triggered reasons, Timeouts for responses, arrival of procedures and so on.
Each record has a smgr-no and sequence-no field. If there is no guaranteed delivery of events, the sequence number will help in identifying the lost events.
Event reporting can be enabled or disabled through the CLI command reporting-action mme-event-record under the Call Control Configuration mode. For detailed information on feature configuration see the Configuring Event Logging section in this feature chapter.

How Event Logging Works

Event Logging in the MME is implemented by providing subscriber event information to an external server. Data analyzers use the event information in the record, which is stored in the external server, to debug and troubleshoot subscriber issues.

Architecture

This section describes the framework designed in the MME to support Event Logging.

The interface between the MME and the external server is based on SFTP. Each record (CSV record) is generated as comma-separated ASCII values. The MME sends one ASCII formatted CSV record per line. The CSV records are stored in a file. If configured, these files can be compressed before sending it to the external server.

The transfer of CSV record files between the MME and the external server is based on either PULL or PUSH model. In case of the PULL model, the external server is responsible for initiating the SFTP with MME, and in the PUSH model, MME is responsible for sending the CSV record file to external server based on the configured PUSH timer interval.

The event report includes the information in CSV format as shown in the table given below.

Table 1. Information Fields in the EDR
Sl.No	Description	Format information	Range
1	smgr_number	Number	1 up to 1023
2	sequence_no	Number	1 up to 4294967295
3	Time	YYYY-MMM-DD+HH:MM:SS
4	event-idenity	enum: Attach; Detach; TAU; Handover ; Service Request; Paging; PDN Connect/Disconnect; Bearer Activation/Deactivation; CSFB and SRVCC procedures.
5	Result	enum: 0-Success; 1-failure; 2-Aborted;3-eps_only
6	mme-address	Dotted-string
7	Msisdn	String of decimal digits
8	imsi	String of decimal digits	1 - 15 digits
9	Imei (sv)	String of decimal digits	14 or 16 digits
10	old-guti	mcc: mnc: mmegroup: mmecode: mtmsi
11	old-guti-type	Enumeration [0 - native, 1 - mapped]
12	guti	mcc: mnc: mmegroup: mmecode: mtmsi	0 up to 65535
13	Ecgi	mcc: mnc: cellid
14	current-tac	Tac
15	enodeB-id	20 bit value	1 - 1048574
16	disc-reason	Number	0 up to 65535
17	ebi	Number	5-15
18	linked-ebi	Number
19	apn	String
20	pdn-type	Number	1-4
21	ipv4-address	Dotted String
22	ipv6-address	Dotted String
23	pti	Number	1-255
24	qci	Number	1-9,65,66, 69,70,128-254
25	arp	Number	1-255
26	qos-change	Enum [0-No, 1-Yes]	0/1
27	lai	mcc-mnc-lac

If a particular information is not relevant for the procedure being logged or if particular information isn't available, the corresponding field of that event record will be left blank. For example, if the IMEI is unavailable after the completion of an Attach procedure, the corresponding field of the EDR record becomes blank.

Important

All enumerations will be listed by Cisco for every software release. The external server is designed to be aware of the same listing and to interpret the number accordingly. The event records contain 0-based index value of such enumerations to save space and processing overhead.

The Event IDs that are tracked as part of the EDR logging is shown in the below table:


Events	ENUM Value
Attach Procedures
MME_EDR_EVENT_ID_EPS_ATTACH	1
MME_EDR_EVENT_ID_EMERGENCY_ATTACH	2
MME_EDR_EVENT_ID_COMBINED_ATTACH	3
MME_EDR_EVENT_ID_EPS_HO_ATTACH	4
MME_EDR_EVENT_ID_ATTACH_TYPE_MAX
Detach Procedures
MME_EDR_EVENT_ID_UE_INITIATED_DETACH	51
MME_EDR_EVENT_ID_NW_INITIATED_DETACH	52
MME_EDR_EVENT_ID_HSS_INITIATED_DETACH	53
MME_EDR_EVENT_ID_CSFB_UE_INIT_IMSI_DETACH	54
MME_EDR_EVENT_ID_CSFB_NW_INIT_IMSI_DETACH	55
MME_EDR_EVENT_ID_DETACH_TYPE_MAX
TAU Procedures
MME_EDR_EVENT_ID_TAU_SGW_RELOC	101
MME_EDR_EVENT_ID_TAU_NO_SGW_RELOC	102
MME_EDR_EVENT_ID_TAU_COMBINED_SGW_RELOC	103
MME_EDR_EVENT_ID_TAU_COMBINED_NO_SGW_RELOC	104
MME_EDR_EVENT_ID_TAU_PERIODIC	105
MME_EDR_EVENT_ID_TAU_ATTACH_SGW_RELOC	106
MME_EDR_EVENT_ID_TAU_ATTACH_NO_SGW_RELOC	107
MME_EDR_EVENT_ID_TAU_ATTACH_COMBINED_SGW_RELOC	108
MME_EDR_EVENT_ID_TAU_ATTACH_COMBINED_NO_SGW_RELOC	109
MME_EDR_EVENT_ID_TAU_TYPE_MAX
Handover Procedures
MME_EDR_EVENT_ID_S1_HO_SGW_RELOC	151
MME_EDR_EVENT_ID_S1_HO_NO_SGW_RELOC	152
MME_EDR_EVENT_ID_X2_HO_SGW_RELOC	153
MME_EDR_EVENT_ID_X2_HO_NO_SGW_RELOC	154
MME_EDR_EVENT_ID_INBOUND_S10_HO_SGW_RELOC	155
MME_EDR_EVENT_ID_INBOUND_S10_HO_NO_SGW_RELOC	156
MME_EDR_EVENT_ID_INBOUND_S3_HO_SGW_RELOC	157
MME_EDR_EVENT_ID_INBOUND_S3_HO_NO_SGW_RELOC	158
MME_EDR_EVENT_ID_INBOUND_GNGP_HO	159
MME_EDR_EVENT_ID_OUTBOUND_S10_HO	160
MME_EDR_EVENT_ID_OUTBOUND_S3_HO	161
MME_EDR_EVENT_ID_OUTBOUND_GNGP_HO	162
MME_EDR_EVENT_ID_HO_TYPE_MAX
Service Request Procedures
MME_EDR_EVENT_ID_SERV_REQ_UE_INITIATED	201
MME_EDR_EVENT_ID_SERV_REQ_NW_INIT_PROC	202
MME_EDR_EVENT_ID_SERV_REQ_EXTENDED	203
MME_EDR_EVENT_ID_SERV_REQ_TYPE_MAX
Paging Procedures
MME_EDR_EVENT_ID_PAGING_DDN_TRIGGER	251
MME_EDR_EVENT_ID_PAGING_DETACH_TRIGGER	252
MME_EDR_EVENT_ID_PAGING_BRR_TRIGGER	253
MME_EDR_EVENT_ID_PAGING_IDR_QUERY_TRIGGER	254
MME_EDR_EVENT_ID_PAGING_PCSCF_RESTORATION	255
MME_EDR_EVENT_ID_PAGING_UE_OFFLOAD_TRIGGER	256
MME_EDR_EVENT_ID_PAGING_SGS_TRIGGER	257
MME_EDR_EVENT_ID_PAGING_GMLC_TRIGGER	258
MME_EDR_EVENT_ID_PAGING_PGW_NODE_RESTORATION	259
MME_EDR_EVENT_ID_PAGING_S102_TRIGGER	260
MME_EDR_EVENT_ID_PAGING_IPNE_QUERY_TRIGGER	261
MME_EDR_EVENT_ID_PAGING_TYPE_MAX
PDN Connectivity Requests
MME_EDR_EVENT_ID_PDN_CONN_REQ	301
MME_EDR_EVENT_ID_PDN_EMERGENCY_CONN_REQ	302
MME_EDR_EVENT_ID_PDN_CONN_TYPE_MAX
UE and Network Initiated PDN Detach
MME_EDR_EVENT_ID_UE_PDN_DISCONN_REQ	351
MME_EDR_EVENT_ID_MME_PDN_DISCONN_REQ	352
MME_EDR_EVENT_ID_HSS_PDN_DISCONN_REQ	353
MME_EDR_EVENT_ID_NW_PDN_DISCONN_REQ	354
MME_EDR_EVENT_ID_PDN_DISCONN_TYPE_MAX
Dedicated Bearer Activation Requests
MME_EDR_EVENT_ID_DED_BEARER_ACT_REQ	401
MME_EDR_EVENT_ID_DED_BEARER_ACT_MAX
Dedicated Bearer Deactivation Requests
MME_EDR_EVENT_ID_UE_DED_BEARER_DEACT_REQ	451
MME_EDR_EVENT_ID_MME_DED_BEARER_DEACT_REQ	452
MME_EDR_EVENT_ID_PGW_DED_BEARER_DEACT_REQ	453
MME_EDR_EVENT_ID_DED_BEARER_DEACT_MAX
Bearer Modification Requests
MME_EDR_EVENT_ID_NW_BEARER_MODIF	501
MME_EDR_EVENT_ID_HSS_BEARER_MODIF	502
MME_EDR_EVENT_ID_BEARER_MODIF_TYPE_MAX
CSFB Prodecures
MME_EDR_EVENT_ID_CSFB_MO_CALL	551
MME_EDR_EVENT_ID_CSFB_MT_CALL	552
MME_EDR_EVENT_ID_CSFB_MO_PRIORITY_CALL	553
MME_EDR_EVENT_ID_CSFB_MT_PRIORITY_CALL	554
MME_EDR_EVENT_ID_CSFB_MO_EMERGENCY_CALL	555
MME_EDR_EVENT_ID_CSFB_MO_SMS	556
MME_EDR_EVENT_ID_CSFB_MT_SMS	557
MME_EDR_EVENT_ID_ECSFB_MO_CALL	561
MME_EDR_EVENT_ID_ECSFB_MT_CALL	562
MME_EDR_EVENT_ID_ECSFB_EMERGENCY	563
SRVCC Procedures
MME_EDR_EVENT_ID_SRVCC_SV_CSPS	601
MME_EDR_EVENT_ID_SRVCC_SV_CS	602
MME_EDR_EVENT_ID_SRVCC_SV_NO_DTM	603
MME_EDR_EVENT_ID_SRVCC_1XRTT	604
MME_EDR_EVENT_ID_SRVCC_MAX

The status of each event is as shown in the table given below:

Table 2. Event Status
Sl No.	Format Information	ENUM Value
1	MME_EDR_EVENT_RESULT_SUCCESS	0
2	MME_EDR_EVENT_RESULT_FAILURE	1
3	MME_EDR_EVENT_RESULT_ABORT	2
4	MME_EDR_EVENT_RESULT_EPS_ONLY	3

Support to Add Two Additional Attributes in EDR

In the existing Event Data Record (EDR) fields, there are a total of 27 fields and currently, 2 more fields are added to the event-data-record and they are mme-ue-s1ap-id and procedure-start-time.

The event report includes the information in CSV format as shown in the table given below:

Table 3. Information Fields in the EDR
SI.No	Description	Format Information	Range
28	mme-ue-s1ap-id	Number	0 to 4294967295
29	procedure-start-time	YYYY-MMM-DD+HH:MM:SS

Customization of Attributes and Events in EDR Profile

Feature Description

The Event Data Record (EDR) captures and provides information of each subscriber irrespective of successful or unsuccessful completion of the procedure. The output summary provides the complete details of the events and issues.

There are totally 29 attributes available in the existing EDR fields, and currently there is no option to either customize or choose the number of attributes and EDR events based on the requirement. In this feature, a new EDR-Profile is introduced to enable or disable the events and attributes. Based on the profile configuration, the generated EDR has the events configured and includes the attributes that are enabled and skips the disabled attributes.

This customization of the attributes does not alter the order sequence of the attributes that is already being followed to write into the EDR. In case, if any of the attributes are not configured or not valid/NULL during the particular procedure execution, then it can be included by using just a comma. Maximum of 32 EDR profiles can be configured and only 1 of the EDR profile could be associated per call control profile.

Previously EDR gets generated with event-id as 0 for those procedures for which EDR-Event is not mapped. Currently, EDR does not get generated for those procedures for which EDR-Event is not mapped.

In any condition, if the IMSI is not available since call-control-profile is chosen based on the IMSI, EDR customization is not applicable for such scenarios. If the EDR handle is available, EDR is generated for a list of events/attributes else EDR will not be generated.

Note

The top four attributes (smgr_instance, sequence_no, edr-time, event-Id) cannot be customized and all the remaining attributes can be enabled and disabled based on the requirement,

Configuring EDR Profile for Set of Attributes and Events

Use the following configuration commands to configure EDR Profile for set of attributes and events:

configure 
    edr-profile edr_profile_name 
        [ no ] attribute attribute-name 
        [ no ] event-group event-name 
 end

Notes:

edr-profile: Configures an EDR profile. edr_profile_name : Specifies an EDR Profile name. Enter a string of size 1–63.
attribute : Configures the attribute to be customized.
event-group : Configures the event-group to be customized.
no : Enables or Disables options such as edr-profile, attribute, and event-group.

Associating EDR-Profile with Call-Control-Profile

Use the following configuration commands to associate edr-profile with call-control-profile:


configure 
    call-control-profile profile_name   
        [ remove ][ { reporting-action } { mme-event-record }[edr-profile edr_profile_name  ) ] ]  
      end

Show Command and Output

show edr-profile all | full | name

The output of this command displays the configuration of edr profile for all the attributes and event-groups:

Attributes-The output displays the following list of attributes enabled or disabled under edr-profile:
Event-group-The output displays the following list of events enabled or disabled under edr-profile:

Note

By default, all attributes and event-groups are enabled. It can be enabled and disabled based on the requirement.

Edr Profile Name : test
Attribute :
result : Enabled
mme-address : Enabled
msisdn : Enabled
imsi : Enabled
imei (sv) : Enabled
old-guti : Enabled
old-guti-type : Enabled
guti : Enabled
ecgi : Enabled
current-tac : Enabled
enodeb-id : Enabled
disc-reason : Enabled
ebi : Enabled
linked-ebi : Enabled
apn : Enabled
pdn-type : Enabled
ipv4-address : Enabled
ipv6-address : Enabled
pti : Enabled
qci : Enabled
arp : Enabled
qos-change : Enabled
lai : Enabled
proc-start-time : Enabled
mme-ue-s1ap-id : Enabled
all : Enabled

Event-group :
attach : Enabled
detach : Enabled
tau : Enabled
handover : Enabled
service-request : Enabled
paging : Enabled
pdn-connect : Enabled
pdn-disconnect : Enabled
bearer-act-request : Enabled
bearer-deact-request : Enabled
bearer-mod-request : Enabled
csfb : Enabled
srvcc : Enabled
all : Enabled

show call-control-profile full name

The output of this command displays the configuration of call-controle-profile for the newly introduced attributes:

Note

Ensure that the EDR profile is created before associating it to the call-control-profile. If a non-existent edr-profile is associated to the call-control-profile then edr customization is not applicable.

Edr Profile: Displays configuration for Edr Profile.
edr-profile-name/Not Defined: The output of this command displays the associated edr-profile name if configured else it will display as Not Defined.

Limitations

The reliability of event generation is limited by the CDRMOD framework – particularly in the following ways:

Any reboot of the chassis, will result in loss of records that are not yet flushed to the hard-disk or an external server
In case of overload of the CDRMOD, the SESSMGR ignores event records if the queue is full.
EDR sequence numbers are within the scope of the Session Manager. If a different Session Manager is selected, the EDR sequence number may reset or continue from the last sequence number allocated in that Session Manager.
The statistics are key parameters for logging EDRs, if the statistics have any discrepancies the EDRs are not generated. Listed below are some scenarios where the EDRs are not generated due to discrepancies in statistics:
- Network or MME initiated dedicated bearer de-activation during SRVCC procedures.
- HSS initiated modification failures.
- HSS initiated PDN disconnect failures.
Currently, MME does not support the event record generation based on the call-control-profile. You can enable the event record generation similarly as enabling at mme-service. You can enable for all subscribers at mme-service or at call control profile. However, the call control profile allows you to enable for all subscribers and not for specific subscribers.

Relationship with Other Products

The SGSN has a similar function, GMM-SM Event Logging. For information about this functionality refer to the SGSN Administration Guide.

Configuring Event Logging

The following configurations are discussed in this section for Event Data Records (EDRs):

Enabling Event Logging

The following CLI configuration is executed in the Call Control Profile mode to enable Event Logging on the MME.

config 
 call-control-profile profile_name  
 reporting-action mme-event-record  edr-profile  edr-profile-name 
            exit

Notes:

The call-control-profile configuration enables Event Logging for MME, provided this profile is associated to the mme-service through operator policy and subscriber map.
reporting-action enables procedure reports.
mme-event-record reports MME procedures in the form of event records using CDRMOD.
reporting-action mme-event-record edr-profile edr-profile-name : Associates an edr-profile in a call-control-profile.
.

Enabling EDR Logs

The CDRMOD proclet writes the individual records into a single file received from several session managers. The CDRMOD proclet is enabled with the configuration below.

config 
 context context_name  
 edr-module active-charging-service reporting 
                  cdr { push-interval interval_time | remove-file-transfer | use-harddisk | transfer-mode { pull | push primary { encrypted-url | url } url [ secondary { encrypted-secondary | secondary-url } url_ ]  } [ module-only ] }   
                   end

Configuring File Parameters

File parameters can be configured using the configuration given below.

config 
 context context_name  
 session-event-module  
                  file name file_name current-prefix current_file_prefix rotation volume file_rotation_size rotation time file_rotation_time  field-separator underscore sequence-number padded charging-service-name include compression gzip }  
                  end

EDR Profile Association

The Call Control Profile configuration enables event Logging for MME, provided the EDR profile is associated to the MME-Service through Operator Policy and Subscriber Map (LTE-Policy).

config 
   operator-policy name  policy_name  
      associate call-control-profile call_control_profile_name 
          exit 
lte-policy  
    subscriber-map map_name  
      precedence precedence_value match-criteria all operator-policy-name policy_name  
           exit 
        exit 
context context_name  
   mme-service service_name  
      associate subscriber-map map_name  
         end

Verifying the Event Logging Configuration

The following commands are used to verify the parameters for Event Logging.

show call-control-profile full all
show operator-policy full all
show lte-policy subscriber-map name sub1
show mme-service all

Monitoring and Troubleshooting Event Logging

This section provides information on how to monitor Event Logging.

Event Logging Show Command(s) and/or Outputs

This section provides information regarding show commands and/or their outputs in support of Event Logging.

The show commands in this section are available in support of the Event Logging.

show call-control-profile full all

Call Control Profile Name = TEST 
SAMOG Home PLMN                        : Not configured 
Accounting Mode (SGW/SaMOG)            : None 
Accounting stop-trigger (SGW)          : Not configured 
Accounting Policy (SaMOG)              : Not configured 
Event Data Records (MME)               : Enabled

show edr-profile full all

Following example is the show output of edr-profile.

Tuesday April 27 02:06:11 EDT 2021

Edr Profile Name : edr1
***** Attribute *****
result : Enabled
mme-address : Enabled
msisdn : Enabled
imsi : Enabled
imei (sv) : Enabled
old-guti : Enabled
old-guti-type : Enabled
guti : Enabled
ecgi : Enabled
current-tac : Enabled
enodeb-id : Enabled
disc-reason : Enabled
ebi : Enabled
linked-ebi : Enabled
apn : Enabled
pdn-type : Enabled
ipv4-address : Enabled
ipv6-address : Enabled
pti : Enabled
qci : Enabled
arp : Enabled
qos-change : Enabled
lai : Enabled
procedure-start-time : Enabled
mme-ue-s1ap-id : Enabled
all : Enabled

***** Event-group *****
attach : Enabled
detach : Enabled
tau : Enabled
handover : Enabled
service-request : Enabled
paging : Enabled
pdn-connect : Enabled
pdn-disconnect : Enabled
bearer-act-request : Enabled
bearer-deact-request : Enabled
bearer-mod-request : Enabled
csfb : Enabled
srvcc : Enabled
all : Enabled
[ingress]asr5500#

show cdr statistics

On running the above command , the following statistics are displayed:

EDR-UDR file Statistics: 
CDRMOD Instance Id: 2 
    Overall Statistics: 
      Files rotated:                                                                                30 
      Files rotated due to volume limit:                                          0 
      Files rotated due to time limit:                                              3 
      Files rotated due to tariff-time:                                            0 
      Files rotated due to records limit:                                    11 
      File rotation failures:                                                                0 
      Files deleted:                                                                                  7 
      Records deleted:                                                                              0 
      Records received:                                                                    23754 
      Current open files:                                                                        0 
 
Time of last file deletion:                              Sunday November 08 23:32:53 EST 2015 
Session-Event Record Specific Statistics: 
Session-Event files rotated:                                                        30 
Session-Event files rotated due to volume limit:                  0 
Session-Event files rotated due to time limit:                      3 
Session-Event files rotated due to tariff-time:                    0 
Session-Event files rotated due to records limit:              11 
    Session-Event file rotation failures:                                    0 
    Session-Event files deleted:                                                      7 
    Session-Event records deleted:                                                  0 
    Session-Event records received:                                        23754 
    Current open Session-Event files:                                            0 
Time of last Event file deletion:                Sunday November 08 23:32:53 EST 2015

MME Administration Guide, StarOS Release 21.27

Bias-Free Language

Book Title

MME Administration Guide, StarOS Release 21.27

Chapter Title