First, you want to avoid policing RTP traffic. When that size is exceeded, it will hard drop traffic. Since RTP is UDP, that traffic will never come back and doesn't recover like TCP traffic.
The only times I feel its acceptable to have RTP through a policer are:
* If you need to limit a link speed (parent class) and the device can only police, but can't shape. Shaping is always preferred for the parent class when applicable, though.
* If you are applying a policed limit that exceeds the maximum bandwidth intended for this device to stream for audio, to prevent DoS, flooding, etc via RTP.
Looking at your config, I see you are policing to 64k, which is the max a single endpoint would transmit out (although with overhead on Ethernet, it's more like 80k for g711ulaw). Make sure this policy only goes on links with a single endpoint. You wouldn't want to apply this to a trunk, since if you had two calls over the trunk, you'd see ~50% packet loss for each stream.
Trusting COS only works on trunks. If this is a typical routed interface, you want to trust DSCP. DSCP won't be touched by a L2 switch. A L3 switch (if 'mls qos' is enabled) will overwrite the DSCP value to 0 unless you have a trust configured. If you trust DSCP, the DSCP value will stay maintained. If you trust COS, it will rewrite the DSCP value to whatever the COS value maps to with the COS-to-DSCP map.
The short answer is that since your class map uses DSCP, if you can trust on DSCP at the switch (mls qos trust dscp), do it. If it won't let you do that, or you have some requirements to trust COS instead, then trust COS, and make sure that cos 5 maps to DSCP ef (46).
Great reply, this is a super old post but I'd just like to add that 2960's running LAN Base can rewrite, and match on DSCP. As far as policing goes I like to police access ports to 128k (dscp 46) per port to prevent any flooding. Also, I'm not sure if this is best pratice or not, but since I'm really only concerned with protecting my priority queue my exceed action isn't set to drop, but rath to remark the dscp value to 0. So it looks like this.
These are the paths to get to each CCX logs through CLI. They may be helpful if you are having issues accessing RTMT or downloading logs through it.
If you want to download them you have to prefix "file get " and you can add one of the options (re...