FreeRADIUS Log Files Format

Interpretation for WebCDR
I.

INTRODUCTION
This document describes the WebCDR interpretation of the fields provided by
the FreeRADIUS Log Files format.

II.

CONVENTIONS
In this document, destination WebCDR values are indicated
by WEBCDR{FIELDNAME}, and source values are indicated
with SOURCE{FIELDNAME}.

III.

WEBCDR FIELDS
In order for WebCDR to create wholesale telecom bills, the data from the
switch must be mapped into the fields that WebCDR uses. Here is a list of the
fields that WebCDR expects to gather from the call data files:
Field

Required

Max Length

Example

ANI

No

50

5104529200

DNIS_INPULSED

Yes

50

357717184345714

DNIS_OUTPULSED

No

50

828617184345714

LRN (Location Routing Number)

No

50

17184365151

NOA (Nature of Address)

No

50

1

ORIG_TG

Yes

40

15XX

ORIG_SPAN

No

40

1

ORIG_CHANNEL

No

40

27

TERM_TG

Yes

40

OAYY

TERM_SPAN

No

40

2

TERM_CHANNEL

No

40

21

START_DATE_TIME

Yes

30

2003-07-27 15:44:04

BILLABLE_DURATION

Yes

13

45

SYSTEM_DURATION

No

13

47

This is a multi-record CDR format. RADIUS records are variable length. FIELD INTERPRETATIONS The CDR files from the FreeRADIUS Log Files format are in the form of FreeRADIUS log files.b. Leng th Comments 1 A ORIGINAL_LINE_NUMBER 12 2 B NAS_IP_ADDRESS 15 3 C CISCO_NAS_PORT 20 4 D NAS_PORT_TYPE 25 5 E USER_NAME 40 6 F CALLED_STATION_ID 40 7 G CALLING_STATION_ID 40 8 H ACCT_STATUS_TYPE 20 start/stop 9 I SERVICE_TYPE 5 login 10 J H323_GW_ID 40 11 K H323_CALL_ORIGIN 26 dotted quad a. A call is considered "completed and billable" if the SOURCE{ACCT_SESSION_TIME} field is non-zero. one call leg per record.TREATMENT_CODE No 40 10 COMPLETION_CODE No 40 4 IB_EXTRA No 40 OB_EXTRA No 40 IV.d ANI answer/originate eg "h323-callorigin=originate" . and some fields will not be present in every record. If the SOURCE{ACCT_SESSION_TIME} field equals zero then the call is considered "incomplete and non-billable".c. Whether a call has completed or not is used when computing the ASR (Answer Seizure Ratio) for a group of calls. The possible fields from the source log files are as follows: Spreads Fiel heet d# Column Field Name Max .

c.d 28 AB DETAIL_TIMESTAMP 24 timestamp added by the radius server 29 AC TIMESTAMP 24 bit int 30 AD REQUEST_AUTHENTICAT OR 10 standard 16-byte RADIUS attribute.b.Spreads Fiel heet d# Column Field Name Max .c. Leng th Comments 12 L H323_CALL_TYPE 24 voip/telephony eg "h323-calltype=Telephony" 13 M H323_SETUP_TIME 49 NTP-formatted strings eg "h323-{setup 14 N H323_CONNECT_TIME 40 15 O H323_DISCONNECT_TIME 40 16 P H323_DISCONNECT_CAUS 4 E TREATMENT_CODE eg "h323disconnect-cause=1F" 17 Q H323_REMOTE_ADDRESS 15 from event graph (a.label + 4 space-separated 8-digit strings .b.d) 18 R H323_VOICE_QUALITY 5 19 S H323_CONF_ID 48 label + 4 space-separated 8-digit strings 20 T ACCT_SESSION_ID 8 bit integer in hexadecimal 21 U ACCT_INPUT_OCTETS 10 bit integer 22 V ACCT_OUTPUT_OCTETS 10 bit integer 23 W ACCT_INPUT_PACKETS 10 bit integer 24 X ACCT_OUTPUT_PACKETS 10 bit integer 25 Y ACCT_SESSION_TIME 10 bit integer 26 Z ACCT_DELAY_TIME 10 bit standard RADIUS attribute 27 AA CLIENT_IP_ADDRESS 15 a. String conversion is generally "None" 31 AE CISCO_AVPAIR_CONNECT 12 _PROGRESS 32 AF CISCO_AVPAIR_H323_IN_C 48 ONF_ID 33 AG CISCO_AVPAIR_NAS_RX_S 12 PEED 34 AH CISCO_AVPAIR_NAS_TX_S 12 PEED 35 AI CISCO_AVPAIR_PRE_BYTE 12 S_IN H323_INCOMING_CONF_ID -.

Leng th 36 AJ CISCO_AVPAIR_PRE_BYTE 12 S_OUT 37 AK CISCO_AVPAIR_PRE_PAKS 12 _IN 38 AL CISCO_AVPAIR_PRE_PAKS 12 _OUT 39 AM CISCO_AVPAIR_REMOTE_ MEDIA_ADDR 40 AN CISCO_AVPAIR_SESSION_P 12 ROTOCOL 41 AO CISCO_AVPAIR_SUBSCRIB 20 ER 42 AP CISCO_AVPAIR_TARIFF_T YPE 43 AQ ACCT_TERMINATE_CAUS E 10 44 AR ACCT_AUTHENTIC 60 45 AS CISCO_AVPAIR_ACOM_LE 60 VEL 46 AT CISCO_AVPAIR_ALERT_TI MEPOINT 47 AU CISCO_AVPAIR_CALLING_ 60 PARTY_CAT 48 AV CISCO_AVPAIR_CALL_ID 49 AW CISCO_AVPAIR_CHARGED 60 _UNITS 50 AX CISCO_AVPAIR_CODEC_B YTES 60 51 AY CISCO_AVPAIR_CODER_T YPE_RATE 60 52 AZ CISCO_AVPAIR_DISCONNE 60 CT_TEXT 53 BA CISCO_AVPAIR_EARLY_PA 60 Comments 20 12 60 60 Reports details on why the connection was terminated.Spreads Fiel heet d# Column Field Name Max . Mapped to COMPLETION_CODE .

Leng th CKETS 54 BB CISCO_AVPAIR_FAXRLY_S 60 TART_TIME 55 BC CISCO_AVPAIR_FAXRLY_S 60 TOP_TIME 56 BD CISCO_AVPAIR_GAPFIL_IN 60 TERPOLAT 57 BE CISCO_AVPAIR_GAPFIL_P REDICTION 58 BF CISCO_AVPAIR_GAPFIL_R 60 EDUNDANCY 59 BG CISCO_AVPAIR_GAPFIL_SI 60 LENCE 60 BH CISCO_AVPAIR_GW_FNL_ XLATED_CDN 60 61 BI CISCO_AVPAIR_GW_FNL_ XLATED_CGN 60 62 BJ CISCO_AVPAIR_GW_RXD_ 60 CDN 63 BK CISCO_AVPAIR_GW_RXD_ 60 CGN 64 BL CISCO_AVPAIR_H323_IVR_ 60 OUT 65 BM CISCO_AVPAIR_HIWTR_PL 60 AYOUT_DLY 66 BN CISCO_AVPAIR_INFO_TYP 60 E 67 BO CISCO_AVPAIR_IN_CARRI ER_ID 60 68 BP CISCO_AVPAIR_OUT_CAR RIER_ID 60 69 BQ CISCO_AVPAIR_LATE_PAC 60 KETS 70 BR CISCO_AVPAIR_LOGICAL_ 60 60 Comments .Spreads Fiel heet d# Column Field Name Max .

Spreads Fiel heet d# Column Field Name Max . Leng th Comments IF_INDEX 71 BS CISCO_AVPAIR_LOST_PAC 60 KETS 72 BT CISCO_AVPAIR_LOWTR_P LAYOUT_DLY 73 BU CISCO_AVPAIR_NOISE_LE 60 VEL 74 BV CISCO_AVPAIR_ONTIME_R 60 V_PLAYOUT 75 BW CISCO_AVPAIR_PEER_ADD 60 RESS 76 BX CISCO_AVPAIR_PEER_ID 77 BY CISCO_AVPAIR_PEER_IF_I 60 NDEX 78 BZ CISCO_AVPAIR_RECEIVE_ 60 DELAY 79 CA CISCO_AVPAIR_RELEASE_ 60 SOURCE 80 CB CISCO_AVPAIR_REM_MED 60 IA_UDP_PRT 81 CC CISCO_AVPAIR_REMOTE_ UDP_PORT 82 CD CISCO_AVPAIR_ROUND_T 60 RIP_DELAY 83 CE CISCO_AVPAIR_TRANSMIS 60 S_MED_REQ 84 CF CISCO_AVPAIR_TX_DURA 60 TION 85 CG CISCO_AVPAIR_VAD_ENA BLE 86 CH CISCO_AVPAIR_VOICE_TX 60 _DURATION 87 CI NAS_PORT 88 CJ ACCT_UNIQUE_SESSION_I 16 60 60 60 60 60 An additional 42 fields added on 2010- .

Leng th D Comments 02-01 as part of SMC #3328 89 CK CISCO_AVPAIR_DISC_CAU 20 SE_EXT 90 CL CISCO_AVPAIR_DSP_ID 91 CM CISCO_AVPAIR_FEATURE_ 140 VSA 92 CN CISCO_AVPAIR_GW_FNL_ XLATED_RDN 93 CO CISCO_AVPAIR_GW_RXD_ 40 RDN 94 CP CISCO_AVPAIR_H323_CAL 40 L_ID 95 CQ CISCO_AVPAIR_H323_GW_ 20 ADDRESS 96 CR CISCO_AVPAIR_H323_INC_ 40 CALL_ID 97 CS CISCO_AVPAIR_H323_REM 60 OTE_ID 98 CT CISCO_AVPAIR_INCOMING 10 _AREA 99 CU CISCO_AVPAIR_INT_ERRO 16 R_CODE 16 40 CISCO_AVPAIR_GW_FINAL_XLATE D_RDN CISCO_AVPAIR_H323_INCOMING_C ALL_ID CISCO_AVPAIR_INTERNAL_ERROR _CODE 100 CV CISCO_AVPAIR_IPHOP 30 101 CW CISCO_AVPAIR_OUT_INTR 40 FC_DESC 102 CX CISCO_AVPAIR_OUT_TG_L 20 ABEL CISCO_AVPAIR_OUT_TRUNKGROU P_LABEL 103 CY CISCO_AVPAIR_REDIR_ST 20 ATION CISCO_AVPAIR_REDIRECTED_STAT ION 104 CZ CISCO_AVPAIR_XPGK_DST 10 _FASTSTRT CISCO_AVPAIR_XPGK_DESTINATIO N_FASTSTART 105 DA CISCO_AVPAIR_XPGK_DST 40 _RTP_ADDR CISCO_AVPAIR_XPGK_DEST_RTP_ ADDRESS 106 DB CISCO_AVPAIR_XPGK_DST 20 .Spreads Fiel heet d# Column Field Name Max .

Leng th Comments _CODEC 107 DC CISCO_AVPAIR_XPGK_DST 40 _NUM_IN CISCO_AVPAIR_XPGK_DST_NUMB ER_IN 108 DD CISCO_AVPAIR_XPGK_DST 40 _NUM_OUT CISCO_AVPAIR_XPGK_DST_NUMB ER_OUT 109 DE CISCO_AVPAIR_XPGK_LAS 10 T_CDR 110 DF CISCO_AVPAIR_XPGK_LO C_DISC_CS 20 111 DG CISCO_AVPAIR_XPGK_PD D_TIME 20 112 DH CISCO_AVPAIR_XPGK_RE CORD_ID 40 113 DI CISCO_AVPAIR_XPGK_RO UTE_RETR 5 114 DJ CISCO_AVPAIR_XPGK_SC D_TIME 20 115 DK CISCO_AVPAIR_XPGK_SRC 5 _FASTSTRT CISCO_AVPAIR_XPGK_SOURCE_FA STSTART 116 DL CISCO_AVPAIR_XPGK_SRC 40 _RTP_ADDR CISCO_AVPAIR_XPGK_SOURCE_RT P_ADDRESS 117 DM CISCO_AVPAIR_XPGK_SRC 20 _CODEC 118 DN CISCO_AVPAIR_XPGK_SRC 40 _NUM_IN CISCO_AVPAIR_XPGK_SRC_NUMB ER_IN 119 DO CISCO_AVPAIR_XPGK_SRC 40 _NUM_OUT CISCO_AVPAIR_XPGK_SRC_NUMB ER_OUT 120 DP IMSI 30 121 DQ TRUNKID_IN 40 122 DR TRUNKID_OUT 40 123 DS X_ASCEND_CONNECT_PR 10 OGRESS 124 DT X_ASCEND_DATA_RATE 10 CISCO_AVPAIR_XPGK_LOCAL_DIS CONNECT_CAUSE CISCO_AVPAIR_XPGK_ROUTE_RET RIES .Spreads Fiel heet d# Column Field Name Max .

. Leng th 125 DU X_ASCEND_PRE_INPUT_O 10 CTETS 126 DV X_ASCEND_PRE_INPUT_P ACKETS 127 DW X_ASCEND_PRE_OUTPUT_ 10 OCTETS 128 DX X_ASCEND_PRE_OUTPUT_ 10 PACKETS 129 DY X_ASCEND_XMIT_RATE V.Spreads Fiel heet d# Column Field Name Max . o Any record where the billable duration is less than zero. Since a call-in-progress is not a completed call. Some possible sources of bad records are: o Any record where the starting date and time of the call cannot be determined. These records are considered "bad" records. Comments 10 10 LONG DURATION CALLS The FreeRADIUS Log Files can report call-in-progress information for long duration calls. There should never be any discarded records. VII. WebCDR's Data Collection Status screen shows a count of the number of discarded records per CDR file. SOURCES OF BAD RECORDS Occasionally WebCDR will encounter a record within a CDR file that it cannot process. SOURCES OF DISCARDED RECORDS All records from FreeRADIUS Log Files contain information for billable calls. records containing call-in-progress information are loaded but are not used to mediate call records. VI.

These records are flagged with "warning" messages. o Any record where the system duration is less than zero. but which can be processed for billing purposes. VIII.WebCDR's Data Collection Status screen shows a count of the number of bad records per CDR file. o Any record with billable duration that is missing one or both trunk groups. WebCDR's Data Collection Status screen shows a count of the number of warnings per CDR file. IX. A duplicate call record happens when there are two CDRs that: o Occurred on the exact same date AND o Occurred at the exact same time (down to the second) AND o Had the exact same originating trunk group AND o Had the exact same originating span AND o Had the exact same originating channel AND o Had the exact same terminating trunk group AND o Had the exact same terminating span AND . SOURCES OF DUPLICATE RECORDS WebCDR automatically discards duplicate records. SOURCES OF WARNINGS Occasionally WebCDR will encounter a record within a CDR file that is not quite what we expected. the dialed number is set to "NO DIGITS #999" and the rated digits are "999". In these cases. Possible sources of warnings are: o Any record where the dialed number cannot be determined. o Any record where the system duration is less than the billable duration.

When we find duplicate records like this. It is derived from WEBCDR{DNIS_INPULSED}. . we're pretty confident that the same call record appeared twice in the CDR file by mistake. FIELD MAPPING Fields from the original CDR file are mapped to WebCDR fields as follows: o WEBCDR{ANI} WEBCDR{ANI} o is set to SOURCE{CALLING_STATION_ID} WEBCDR{DNIS_INPULSED} WEBCDR{DNIS_INPULSED} is set to SOURCE{CALLED_STATION_ID} of the inbound call leg. X. o WEBCDR{IB_RATED_DIGITS} is used to rate the call in the inbound direction. WEBCDR{IB_RATED_DIGITS} is derived from WEBCDR{DNIS_OUTPULSED}. we delete them from WebCDR and show the total number of duplicates found on the Data Collection Status screen.o Had the exact same terminating channel AND o Had the exact same inpulsed digits AND o Had the exact same outpulsed digits AND o Had the exact same billable duration AND o Had the exact same system duration In other words. or that we've processed the same call in an earlier file. o WEBCDR{DNIS_OUTPULSED} WEBCDR{DNIS_OUTPULSED} is set to SOURCE{CALLED_STATION_ID} of the outbound call leg. WEBCDR{IB_RATED_DIGITS} If WEBCDR{DNIS_INPULSED} is blank.

Finally WebCDR strips any leading 011 or 00 from WEBCDR{IB_RATED_DIGITS}. o WEBCDR{ORIG_CHANNEL} If SOURCE{H323_CALL_TYPE} = TELEPHONY then WEBCDR{ORIG_CHANNEL} is set to the channel number extracted fromSOURCE{CISCO_NAS_PORT} of the inbound call leg. o WEBCDR{ORIG_SPAN} If SOURCE{H323_CALL_TYPE} = TELEPHONY then WEBCDR{ORIG_SPAN} is set to the span number extracted fromSOURCE{CISCO_NAS_PORT} of the inbound call leg. o in the outbound WEBCDR{ORIG_TG} WEBCDR{ORIG_TG} is set to SOURCE{CISCO_AVPAIR_IN_CARRIER_ID} long as SOURCE{CISCO_AVPAIR_IN_CARRIER_ID} is populated. the tech prefix is stripped from the WEBCDR{IB_RATED_DIGITS}. o WEBCDR{TERM_TG} .If a per-carrier tech prefix is assigned to the IB carrier for this call. o WEBCDR{OB_RATED_DIGITS} WEBCDR{OB_RATED_DIGITS} is used to rate the call direction. WebCDR then removes any non-digits from WEBCDR{IB_RATED_DIGITS}. as Otherwise: If SOURCE{H323_CALL_TYPE} = TELEPHONY then WEBCDR{ORIG_TG} is set to SOURCE{CLIENT_IP_ADDRESS} of the inbound call leg. If SOURCE{H323_CALL_TYPE} = VOIP then WEBCDR{ORIG_TG} is set to SOURCE{H323_REMOTE_ADDRESS} of the inbound call leg. WEBCDR{OB_RATED_DIGITS} is set equal toWEBCDR{IB_RATED_DIGITS}.

then WEBCDR{START_DATE_TIME} is set to SOURCE{H323_CONNECT_TIME}. If SOURCE{H323_SETUP_TIME} is not available. Timestamps sent by this format are supposed to be in "NTP format" according to Cisco docs. o WEBCDR{START_DATE_TIME} WEBCDR{START_DATE_TIME} is set to SOURCE{H323_SETUP_TIME}. o WEBCDR{TERM_CHANNEL} If SOURCE{H323_CALL_TYPE} = TELEPHONY then WEBCDR{TERM_CHANNEL} is set to the channel number extracted fromSOURCE{CISCO_NAS_PORT} of the outbound call leg.532 UTC SEP 21 2011" .WEBCDR{TERM_TG} is set to SOURCE{CISCO_AVPAIR_OUT_CARRIER_ID} long as SOURCE{CISCO_AVPAIR_OUT_CARRIER_ID} is populated.089 GMT7 Fri Feb 1 2002  h323-disconnect-time=01:00:40. but there is a fair amount of variation in this timestamp format. o WEBCDR{TERM_SPAN} If SOURCE{H323_CALL_TYPE} = TELEPHONY then WEBCDR{TERM_SPAN} is set to the span number extracted fromSOURCE{CISCO_NAS_PORT} of the outbound call leg. WebCDR will accept dates that appear as:  h323-setup-time=01:00:33. as Otherwise: If SOURCE{H323_CALL_TYPE} = TELEPHONY then WEBCDR{IB_EXTRA} is set to SOURCE{CLIENT_IP_ADDRESS} of the inbound call leg.849 GMT7 Fri Feb 1 2002  h323-connect-time=01:00:40. If SOURCE{H323_CALL_TYPE} = VOIP then WEBCDR{IB_EXTRA} is set to SOURCE{H323_REMOTE_ADDRESS} of the inbound call leg.089 GMT7 Fri Feb 1 2002  h323-setup-time = "20:35:04.

which is equivalent to UTC-4.123 second call is 1 minute. Note that EST is not the same thing as "EDT". o WEBCDR{IB_DURATION} is the number of seconds that your customers are billed for.241 second call is 1 minute. WEBCDR{OB_DURATION} o WEBCDR{SYSTEM_DURATION} WEBCDR{SYSTEM_DURATION} is set to SOURCE{H323_DISCONNECT_TIME} . The format of SOURCE{ACCT_SESSION_TIME} is in seconds. Eastern Daylight Time.The timezone is taken from this timestamp. . If the rate uses 60/60 rounding the WEBCDR{IB_DURATION} for a 23. which is equivalent to UTC-5.241 seconds and the rounding is 1/1. o WEBCDR{BILLABLE_DURATION} WEBCDR{BILLABLE_DURATION} is set to SOURCE{ACCT_SESSION_TIME}. For instance. If SOURCE{H323_SETUP_TIME} is not available. WebCDR recommends that you set your gateways to use UTC for all call timestamps. If the rate uses 60/60 rounding the WEBCDR{IB_DURATION} for a 13. if theWEBCDR{BILLABLE_DURATION} is 13. WEBCDR{IB_DURATION} o WEBCDR{OB_DURATION} is the number of seconds that your vendors will bill you for a call. then WEBCDR{SYSTEM_DURATION} is set to SOURCE{H323_DISCONNECT_TIME} -SOURCE{H323_CONNECT_TIME}.SOURCE{H323_SETUP_TIME}.123 seconds and the rounding is 1/1. If the switch or gateway says that the time is "EST" then WebCDR interprets that as Eastern Standard Time. the WEBCDR{IB_DURATION} is 24 seconds. For instance. if the WEBCDR{BILLABLE_DURATION}is 23. the WEBCDR{OB_DURATION} is 14 seconds. To avoid confusion. It is computed by rounding theWEBCDR{BILLABLE_DURATION} using the rounding value of the IB rate applied to the call. It is computed by rounding theWEBCDR{BILLABLE_DURATION} using the rounding value of the OB rate applied to the call.

It is not used for billing purposes. If SOURCE{H323_CALL_TYPE} = VOIP then WEBCDR{OB_EXTRA} is set to SOURCE{H323_REMOTE_ADDRESS} of the outbound call leg. o WEBCDR{OB_EXTRA} If SOURCE{CISCO_AVPAIR_OUT_CARRIER_ID} is populated then: If SOURCE{H323_CALL_TYPE} = TELEPHONY then WEBCDR{OB_EXTRA} is set to SOURCE{CLIENT_IP_ADDRESS} of the outbound call leg. WEBCDR{COMPLETION_CODE} WEBCDR{COMPLETION_CODE} o is set to SOURCE{ACCT_TERMINATE_CAUSE}. If the WEBCDR{SYSTEM_DURATION} is less than the WEBCDR{BILLABLE_DURATION} then the WEBCDR{SYSTEM_DURATION} is set equal toWEBCDR{BILLABLE_DURATION} and a warning is generated. If SOURCE{H323_CALL_TYPE} = VOIP then WEBCDR{IB_EXTRA} is set to SOURCE{H323_REMOTE_ADDRESS} of the inbound call leg. is used for quality of service (QOS) reporting ONLY. ALIASED GATEWAYS . WEBCDR{IB_EXTRA} If SOURCE{CISCO_AVPAIR_IN_CARRIER_ID} is populated then: If SOURCE{H323_CALL_TYPE} = TELEPHONY then WEBCDR{IB_EXTRA} is set to SOURCE{CLIENT_IP_ADDRESS} of the inbound call leg. WEBCDR{SYSTEM_DURATION} o WEBCDR{TREATMENT_CODE} WEBCDR{TREATMENT_CODE} o is set to SOURCE{H323_DISCONNECT_CAUSE}.If the WEBCDR{SYSTEM_DURATION} is less than zero then the WEBCDR{SYSTEM_DURATION} is set to zero and a warning is generated. 2.

34 84.233.212.168.233.233.12 192.233.26 41.212.34 84.11 84.212.12 84.11 84. making the ingress and egress events appear to be coming from two different gateways.33 84.212.233.233.212.10 192.212.225.35 84.212.77.200.77.212.77.233.77.233.200.225.212.233.12 192.212. Host alias records are required to handle this situation.168.11 41.10 84.200.212.26 84.When a customer has a gateway that has multiple IP addresses or multiple ports with multiple IP addresses.225.168.212.33 84.233.212.233.225.11 84.233.27 41.212.10 84.233.212.10 84.225.225.233.168.212.10 192. it's possible for a packet to go in one port and out another.200.11 192.77.233.233.30 41.77.212.77.12 41.200.14 41.27 84.12 84.10 41.11 192.233.12 84.212.233.168.200.30 .225.233.212. The following records have been defined: Host Alias Description 84.168.35 84.14 84.