This example recipe parse, reassemble and convert Ribbon/Sonus SBC (TRC) logs back into IP/SIP/HEP types, received as Syslog TCP and shipped back to a HEP Capture Server such as HOMER or HEPIC for use cases where encrypted communication is unavailable off-the-wire for monitoring and troubleshooting.

• Sonus SBC (ie: SBC 5400)
• NodeJS and paStash need to be installed before execution

# sudo npm install --unsafe-perm -g @pastash/pastash @pastash/filter_app_sonuslog 

• syslog input on port 9514
• sonus filter to parse TRC events
• hep output to port 9063

Save the following recipe to a readable location, ie: /path/to/pastash_sonus.conf

input { tcp { host => 0.0.0.0 port => 9514 type => syslog } } filter { app_sonus {} } output { stdout{} if [rcinfo] != 'undefined' { hep { host => '127.0.0.1' port => 9063 hep_id => 2222 } } } 

If your SBC emits logs with UTC Timestamps instead of USEC strings, use the following additional setting:

<147> 1 2020-08-18T11:23:55.759395-04:00 kvs1-swe-1-access-b SBC ...

filter { app_sonus { type => 1 } } 

pastash --config_file=/path/to/pastash_sonus.conf 

To configure as a service, please follow this guide

Configure your Ribbon/Sonus SBC to emit TCP Syslog events towards our paStash receiver.

• On the SBC main screen, browse to:
  • All > OAM > Event Log > Platform Rsyslog > Servers
• Edit the parameters for Server1 pointing to the IP:PORT of your paStash instance.

set oam eventLog typeAdmin trace servers server1 syslogRemoteHost 10.0.0.1 syslogRemotePort 9514 syslogRemoteProtocol TCP set oam eventLog typeAdmin trace syslogState enabled