Actions

Logging (Zenitel Connect)

From Zenitel Wiki

Log Types

Zenitel Connect Pro (ZCP) provides four different log types:

  • Debug Log: Covers a large section of different debug messages meant for developers.
  • System Log: Provides log events for monitoring the health of the ZCP system. The log includes system startup and shutdown, container startup and shutdown, tone and button tests, licenses ok or failed, device status, SIP trunk status and WAMP session status.
  • Call Log: Information about calls in the system
  • Audit Log: Fault Acknowledgements and Maintenance Lock changes. Reports Generate token denied, Refresh token denied, Generate token, Refresh token.

Log Levels

The log system uses the syslog severity values:

  • Emergency: system is unusable
  • Alert: action must be taken immediately
  • Critical: critical conditions
  • Error: error conditions
  • Warning: warning conditions
  • Notice: normal but significant condition
  • Informational: informational messages
  • Debug: debug-level messages

Log Destinations

Logs can either be:

  • Stored in locally in the Zenitel Connect Pro file system, or
  • Sent to a remote Syslog server

The log format is according to RFC-5424.


Logging to Local Filesystem

To configure and download logs, navigate to Applications > Logs. Logging to the Local File System is by default disabled. To enabled logging change the relevant log type to "Log Level" = All.

Logging to Local File System
  • Log Level: In syslog, log levels are categorized into eight severity levels, ranging from the most critical (0 - Emergency) to the least critical (7 - Debug). Set "Log Level" = All to log all log events.
  • Text Match: To filter on a specific text in the log strings, add the required text in the Text Match field. Only log events that contain this text will be sent to the log.

A Log Rotation mechanism prevents the logs from growing out of control. Once a day there is a check if a single log file has exceeded 200kB, or if the total amount of log files have exceeded 5MB. If so the oldest log content will be deleted.


Downloading log files

To retrieve the log files:

  • Click Generate logs
  • Wait a few seconds for the logs to be generated
  • Click Download logs. A zip file containing all logs will be available in the normal download directory of your PC. The file name is connect-logs- extended with the Hostname of the Zenitel Connect Pro, and date and time when the log file was generated. Example: connect-logs-vs-icx510-2025-02-18-11-59-15.zip
  • Unzip the downloaded file. In the folder zcp you will find the log files. These are text files that can be opened in e.g. Notepad or Notepad++.


Logging to Syslog

To enable logging to an external Syslog server select "Log Target" = SysLog, and select the icon to add a new record. Enter the following data:

  • Name: Any descriptive text
  • Server: The IP address of the Syslog server
  • Port: Normally port 514 when using UDP protocol, and 6514 when using TCP protocol
  • Protocol: Select UDP or TCP
  • Auth mode: ZCP does not support mutual authentication, but ZCP will authenticate syslog server.
    • None (UDP or TCP)
    • Anonymous (TLS over TCP): ZCP does not need to authenticate syslog server, so syslog server certificate does not need to be uploaded to ZCP
    • Certificate (TLS over TCP): syslog server certificate must be uploaded to ZCP, authenticate syslog server over its certificate
    • Fingerprint (TLS over TCP): syslog server certificate must be uploaded to ZCP, authenticate syslog server over its certificate fingerprint
      • Note: You first have to create the Syslog record, then you can set the Authentication mode.
  • Log Stream: Let you select which of the 4 log types; Debug, System, Call or Auth
  • Log Level: Select Syslog severity level, or "All"
  • Text Match: Filter on a specific text in the log string. Only log events that contain this text will be sent.
Logging to Syslog server


Logged Events

Audit log

  • Generate token denied (WARNING) - IEC 62443-3-3: SR 2.8 Access Control / failed authentication.
<156>1 2025-03-24T13:08:04.198683+00:00 - - 1742463658 auth [authentication@26122 status="FAILED" username="admin"] Login with wrong username/password for admin


  • Refresh token denied (NOTICE) - IEC 62443-3-3: SR 2.8 Access Control / failed authentication or session renewal.
<156>1 2025-03-24T13:31:46.225731+00:00 - - 1742463658 auth [authentication@26122 status="FAILED"] Invalid attempt to refresh token


  • Generate token (INFO) - IEC 62443-3-3: SR 2.8 Access Control / successful authentication.
<158>1 2025-03-26T08:16:57.626773+00:00 - - 1742898387 auth [authentication@26122 status="OK" username="admin"] Creating token for admin


  • Refresh token (INFO) - IEC 62443-3-3: SR 2.8 Access Control / session renewal.
<158>1 2025-03-24T14:10:29.038450+00:00 - - 1742463658 auth [authentication@26122 status="OK"] Refreshing token for admin


  • Access Denied (WARNING) - IEC 62443-3-3: SR 2.8 Access Control and Request Errors / authorization failure.
<156>1 2025-04-07T07:15:08.031032+00:00 - - 1743772026 auth [authorization@26122 status="FAILED"] Access denied for /api/info


  • RMS operator actions (INFO) - IEC 62443-3-3: SR 2.8 Access Control and Control System Events / operator authorization and auditable operator actions for fault acknowledgement and device lock or unlock operations.
<158>1 2026-09-11T11:13:07.112913Z - pulse-rms 1 auth [operator@26122 realm="connect" resource="device/dirno_id/38" fault_code="line.down" occurrence="5" action="ack" authorized="true"] line.down on device: dirno_id=38, dirno=100, model=ZDCF8-TCIV-6 was acknowledged by an operator
<158>1 2026-09-11T11:15:45.997607Z - pulse-rms 1 auth [operator@26122 realm="connect" resource="device/dirno_id/38" fault_code="" occurrence="0" action="lock" authorized="true"] device: dirno_id=38, dirno=100, model=ZDCF8-TCIV-6 was locked by an operator
<158>1 2026-09-11T11:15:45.997607Z - pulse-rms 1 auth [operator@26122 realm="connect" resource="device/dirno_id/38" fault_code="" occurrence="0" action="unlock" authorized="true"] device: dirno_id=38, dirno=100, model=ZDCF8-TCIV-6 was unlocked by an operator


System log

  • System startup (INFO) - IEC 62443-3-3: SR 2.8 Operating System Events
<142>1 2025-03-25T08:15:51.555884+00:00 vs-icx510 root - system [system_startup@26122 state="starting"] System starting


  • System shutdown (INFO) - IEC 62443-3-3: SR 2.8 Operating System Events.
<142>1 2025-03-25T08:13:41.595983+00:00 vs-icx510 root - system [system_shutdown@26122 state="stopped"] System stopped


  • Container startup (INFO) - IEC 62443-3-3: SR 2.8 Operating System Events.
<142>1 2025-04-04T10:09:06.537007+00:00 vs-icx510 root - system [podman@26122 container="ze-hiatus-ami" state="starting"] ze-hiatus-ami starting


  • Container shutdown (INFO) - IEC 62443-3-3: SR 2.8 Operating System Events.
<142>1 2025-04-04T10:09:06.537007+00:00 vs-icx510 root - system [podman@26122 container="ze-hiatus-ami" state="stopping"] ze-hiatus-ami stopping


  • Tone Test (INFO) - IEC 62443-3-3: SR 2.8 Control System Events / device health and diagnostics.
<142>1 2025-04-04T12:11:14.793731+00:00 - - 1743761361 system [device_status@26122 current_status="passed" device_id="9" dirno="123" error_message="Test PASSED, silence: -75 tone: -122" last_fail="" last_pass="2025-04-04T12:11:14.788979+00:00" last_queued="2025-04-04T12:11:12.32216+00:00" pending_test="0" status_type="tonetest"] Device status: tonetest for 123 passed

<142>1 2025-04-04T12:11:08.117542+00:00 - - 1743761361 system [device_status@26122 current_status="failed" device_id="2" dirno="104" error_message="Test FAILED, silence: -53 tone: -155" last_fail="2025-04-04T12:11:08.113084+00:00" last_pass="" last_queued="2025-04-04T12:11:03.20302+00:00" pending_test="0" status_type="tonetest"] Device status: tonetest for 104 failed


  • Button Test (INFO) - IEC 62443-3-3: SR 2.8 Control System Events / device health and diagnostics.
<142>1 2025-04-04T12:13:45.977128+00:00 - - 1743761361 system [device_status@26122 current_status="failed" device_id="10" dirno="124" error_message="Test failed on button(s) connected to: gpio1" last_fail="2025-04-04T12:13:45.97238+00:00" last_pass="" last_queued="2025-04-04T12:13:41.829212+00:00" pending_test="0" status_type="buttontest"] Device status: buttontest for 124 failed


  • License OK (INFO) - IEC 62443-3-3: SR 2.8 Control System Events / licensing state.
<142>1 2025-03-25T08:07:39.577919+00:00 - - 1742843359 system [licensing@26122 status="License OK"] License OK


  • License Failed (INFO) - IEC 62443-3-3: SR 2.8 Control System Events / licensing state failure.
<142>1 2025-03-25T08:08:14.430236+00:00 - - 1742843359 system [licensing@26122 status="ZCL-IC1: configured: 12, licensed: 10. Please remove excess configuration before uploading the license file.#012ZCL-PBX: configured: 2, licensed: 1. Please remove excess configuration before uploading the license file.#012"] ZCL-IC1: configured: 12, licensed: 10. Please remove excess configuration before uploading the license file.#012ZCL-PBX: configured: 2, licensed: 1. Please remove excess configuration before uploading the license file.


  • SIP device status (INFO) - IEC 62443-3-3: SR 2.8 Control System Events / device communication status.
<142>1 2025-03-24T17:39:56.389502+00:00 - - 1742837988 system [device_account@26122 dirno="3001" status="reachable"] Device status: 3001 SIP reachable


  • SIP trunk status (INFO) - IEC 62443-3-3: SR 2.8 Control System Events / trunk communication status.
<142>1 2025-03-24T17:39:56.389502+00:00 - - 1742837988 system [device_account@26122 dirno="3001" status="reachable"] Trunk status: 54 SIP reachable


  • WAMP session status (INFO) - IEC 62443-3-3: SR 2.8 Access Control and Control System Events / user session connectivity.
<142>1 2025-03-24T17:57:09.146376+00:00 - - 1742837987 system [wamp_session@26122 session="18" state="connected" authid="admin" authrole="web-super-admin"] WAMP connection for web-super-admin admin connected


  • System upgrade (INFO) - IEC 62443-3-3: SR 2.8 Configuration Changes / system software change; SR 2.11 timestamped event.
<142>1 2025-08-12T07:39:35.482910+00:00 vs-icx510 root - system [system_update@26122 from_version="1.6.0" to_version="1.6.1"] System upgrading from version 1.6.0 to 1.6.0


  • Device upgrade (INFO) - IEC 62443-3-3: SR 2.8 Configuration Changes / device software change.
<142>1 2025-07-31T06:34:09.659127+00:00 - - 1753942187 system [device_upgrade@26122 mac_address="00:13:cb:30:01:34" from_version="1.6.0" to_version="1.6.1" status="started"] Started upgrade of device with MAC 00:13:cb:30:01:34 from 1.6.0 to 1.6.1


  • User change (INFO) - IEC 62443-3-3: SR 2.8 Access Control and Configuration Changes / user account administration.
<142>1 2025-07-31T06:13:13.808808+00:00 - - 1753942184 system [device_status@26122 event_type="Created new user" event="test2"] Created new user: test2


  • Fault management (RMS) (INFO) - IEC 62443-3-3: SR 2.8 Control System Events / fault lifecycle for raised, cleared and flapping fault states.
<142>1 2026-09-08T14:40:27.188876Z host pulse-rms 1 system [fault@26122 realm="connect" resource="device/dirno_id/36" fault_code="<fault_code>" occurrence="9" transition="raised" severity="Critical" condition="Active" suppressed="false" operator_state="Unacknowledged" flap_count="0" source="device/dirno_id/36/comms/-/wamp"] <fault> was raised on device: dirno_id=36, dirno=200, model=ZDCT-TCIS-3
<142>1 2026-09-08T14:37:45.61229Z host pulse-rms 1 system [fault@26122 realm="connect" resource="device/dirno_id/34" fault_code="<fault_code>" occurrence="2" transition="cleared" severity="Critical" condition="Cleared" suppressed="false" operator_state="Unacknowledged" flap_count="0" source=""] <fault> cleared on device: dirno_id=34, dirno=600, model=ZDET-ECPIR-3P
<142>1 2026-09-08T14:40:57.645811Z host pulse-rms 1 system [fault@26122 realm="connect" resource="device/dirno_id/35" fault_code="<fault_code>" occurrence="10" transition="raised" severity="Critical" condition="Active" suppressed="false" operator_state="Unacknowledged" flap_count="1" source="device/dirno_id/35/comms/-/wamp"] Fault flapping detected. The fault returned again before being closed


Call log

  • Call state as given in Zenitel Link com.zenitel.call (INFO) - IEC 62443-3-3: SR 2.8 Control System Events / call lifecycle
<150>1 2025-08-20T06:52:00.312847+00:00 - - 1755090183 call [call@26122 call_id="4975218" state="init" reason="incoming" call_type="normal_call" from_dirno="102" from_leg_id="" to_dirno="109" to_dirno_current="109" groups="" priority="70" start_time="2025-08-20 06:52:00.3+00:00" queue_pos="1"] Call from 102 to 109 init


  • Door Open (INFO) - IEC 62443-3-3: SR 2.8 Control System Events and Access Control / physical access command
<150>1 2026-04-15T07:56:50.225992+00:00 - - 1775646559 call [door_open@26122 from="102" mac_address="00:13:cb:28:03:89" gpo_id="relay1"] Opening door on device 00:13:cb:28:03:89



Debug log

Covers a large section of different debug messages meant for developers.

Retrieved from "https://wiki.zenitel.com/w/index.php?title=Logging_(Zenitel_Connect)&oldid=255675"