AS5300 - Tracing a user through the router - assistance needed

[jimmiejoe]

I have had a couple of tickets from remote users who have experienced problems with being either dropped from our 5300, or slow response. Using the "show user" command, I see two groups of users. One is a Line TTY list, and the other is Interface Vi. Some users that show up on the Line TTY list don't show up in the Interface Vi list. All should be coming into the RAS using 2 PRI's.

The question is two fold. One, what is the difference between these two groups of users? Our Syslog is set up to log at the debug level, but it doesn't give AAA or user/Async relationship information. Second, how can I syslog activity on the 5300 so I can see when a user (by name) dialed in, and their activity? Right now a few lines from the syslog will only give me this type of information:

Mar 7 23:46:38 cmi5300 430265: Mar 7 23:46:37: %LINK-3-UPDOWN: Interface Async18, changed state to up

Mar 7 23:46:44 cmi5300 430266: Mar 7 23:46:43: %LINK-3-UPDOWN: Interface Virtual-Access11, changed state to up

Mar 7 23:46:45 cmi5300 430267: Mar 7 23:46:44: %LINEPROTO-5-UPDOWN: Line protocol on Interface Async18, changed state to up

Mar 7 23:46:45 cmi5300 430268: Mar 7 23:46:44: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access11, changed state to up

Mar 7 23:47:30 cmi5300 430269: Mar 7 23:47:30: %ISDN-6-DISCONNECT: Interface Serial1:1 disconnected from [phone number] , call lasted 12269 seconds

Mar 7 23:47:31 cmi5300 430270: Mar 7 23:47:30: %LINEPROTO-5-UPDOWN: Line protocol on Interface Async3, changed state to down

Mar 7 23:47:34 cmi5300 430271: Mar 7 23:47:33: %LINK-5-CHANGED: Interface Async3, changed state to reset

Mar 7 23:47:39 cmi5300 430272: Mar 7 23:47:38: %LINK-3-UPDOWN: Interface Async3, changed state to down

I don't want to turn too many debugs on 24X7 if not necessary for troubleshooting.

Thanks

Jim

[makchitale]

For an async dialup call if ppp multilink is negotiated between the as5300 & dialup client then we see an virtual access interface created (Vi) or else it will show up as TTY,

Router-02#show users

Line User Host(s) Idle Location

* 0 con 0 idle 00:00:00

97 tty 97 async_user Async interface 00:06:36 PPP: 172.22.60.2 <==no multilink negotiated.

Interface User Mode Idle Peer Address

Vi1 xxx Virtual PPP (Bundle) 00:03:35 172.22.61.2

We can send debug outputs to a syslog server that will give us info of user logged in, time remained online (based on when user disconnects etc)...not sure what you mean by "their activity", an AAA server can do better accounting than an syslog server where you will need to parser out the required info.

For info on logging to a syslog server: (endure we have no logging console)

http://cisco.com/en/US/products/sw/iosswrel/ps1828/products_command_reference_chapter09186a008007ff5a.html

Thanks, Mak.

[dbellazetin]

Jim,

For logging user information depending on your IOS you can turn on "modem call-record terse" or "calltracker call-record verbose quiet". If you are on a T release after 12.1(3)T or on 12.2 or 12.3 mainline it will have calltracker and that is the more recommended option.

This information will display call duration, username, etc.

Daniel

[jimmiejoe]

Daniel,

This is what we have running:

IOS (tm) 5300 Software (C5300-J-M), Version 12.1(7), RELEASE SOFTWARE (fc1)

I tried the calltracker command, but it came up with % unrecognized command. However the modem call-record terse command is there. How much of a CPU impact or syslog impact will this have? I'm guessing that it won't have much of an impact with 20-30 users.

Thanks for the tip!

[dbellazetin · Accepted solution]

Jim,

I don't know if there is a doc on CPU impact on using call records. I've always enabled these on every Access Server I have worked with and have never had a problem with CPU because of it.

I hope it helps out.

Daniel