Call Detail Record File Format Reference Guide Page 2 of 26
Introduction
Introduction
Call Detail Records (CDRs) are used by Cisco TelePresence products for auditing and billing
purposes. The following Cisco TelePresence products are able to generate CDRs:
MCUs: MCU 4200 Series, MCU 4500 Series, MCU MSE 8420 and the MCU MSE 8510.
ISDN gateways: ISDN GW 3241, ISDN GW MSE 8310 and ISDN GW MSE 8321.
IP gateways: IP GW 3500 Series and IP GW MSE 8350.
Advanced Media Gateway: AM GW 3610
When logging is enabled on a Cisco device, CDRs are generated as follows:
On an MCU/MCU MSE blade: when a conference starts or finishes, and in response to other
events such as participants joining and leaving the conference.
On an ISDN gateway or IP gateway unit or blade: When a call starts, completes, transfers to a
multisite call, or is disconnected for some other reason.
On an AM gateway: When a call starts, completes, or is disconnected for some other reason.
The CDR log is stored on the unit’s/blade’s CompactFlash card. The CDR log is stored in a
proprietary Cisco format. You can only read this format on a Cisco unit or blade, however, it is
possible to export or download the complete CDR log, or part of it, in XML format using the web
interface. The export ed log includes all stored CDRs, and all available details, regardless of the
current filtering and display settings set in the web interface.
This document explains the format of the log as exported in XML.
Overview of CDR file format s
CDR files begin with the <cdr_events> opening tag and close with the matching </cdr_events>
closing tag.
where number is a unique identifier for the event starting at zero and incremented by one for each
CDR event. The fields that occur between the <event> and </event> tags depend on the event.
Note: When using the timestamp on an event you should be aware that changing the time on the
MCU and NTP’s UTC Offset (go to Settings > Time) affects the CDR log timestamp in the following
ways:
Changing the time either by changing the system time or via an NTP update causes new events
in the CDR log to show the new time but no change will be made to existing logged CDR events.
With NTP enabled, setting a UTC offset changes the displayed time for all the CDR events. The
stored time remains the same because it is stored in UTC and the offset is applied for display
purposes.
Enabling or disabling NTP when an offset is configured causes the display time to change for all
existing events and the UTC time will change for logging future CDR events. This is because
when NTP is disabled, the current time is treated as UTC with an offset of 0.
Call Detail Record File Format Reference Guide Page 3 of 26
How to use this reference guide
For each product type the following information is provided:
Example exported CDR file in XML.
Summary of reported event types.
Details of the parameters for each event type.
The section on MCU CDRs starts on page 5.
The section on ISDN gateway CDRs starts on page 11.
The section on IP gateway CDRs starts on page 17.
The section on AM gateway CDRs starts on page 23.
Introduction
Call Detail Record File Format Reference Guide Page 4 of 26
MCUs
MCUs
Example CDR file: MCU 4200 Series/MCU 4500 Series/MCU
MSE blades
The exported file has the name cdr_log.xml. You can change the filename if necessary. Below is a
short extract showing each event type on the MCU or MCU MSE blade.
<?xml version="1.0" encoding="UTF-8" ?>
<cdr_events>
<event index="0" date="13 April 2010" time="13:09:14"
<gatekeeperregistered_with_gatekeeper="no" /><endduration="10 mins 0 sec" duration_in_minutes="10" />
</event>
</cdr_events>
Call Detail Record File Format Reference Guide Page 5 of 26
MCUs
MCU and MCU MSE bla de CDR event types
Currently the MCU and MCU MSE blade CDRs support the event types listed in the table below. They
are listed in the order that they occur in the CDR.
Event type Description
scheduled_conference_startedA scheduled conference was started. Either a permanent conference or
one with a scheduled end time
ad-hoc_conference_startedAn ad hoc conference was started through the auto attendant
participant_joinedA participant joined the conference
participant_leftA participant disconnected or w as forcibly disconne cted
conference_finishedThe conference finished
The tables in the sections below show the parameters for each event type in the order in which they
appear in the CDR. There is an explanation for each parameter.
scheduled_conference_started
There are two variations for this event. One for permanent conferences and one for conferences with
a scheduled end time. The differences are indicated in the table.
Section Name Description
<conference> unique_id Unique identifier for the conference in the
format nnnnnnnn. This is generated
automatically by the MCU
name For scheduled conferences, this is the
conference name as allocated by the user.
For ad hoc conferences, it is a name
provided by the MCU
<conference details> numeric_id Numeric id given to the conference by the
creator or <none>. Used either for calling
into a conference via a gatekeeper or
calling in using the MCU as an H.323
gateway
has_pin Whether or not a PIN was used to enter the
conference. This will be one of:
yes
no
Note that PINs are optional for scheduled
conferences
billing_code For future expansion
<owner> name Log in user name of the person who
Call Detail Record File Format Reference Guide Page 6 of 26
Section Name Description
created the conference
MCUs
<end> scheduled_date
scheduled_time
scheduled_duration_in_minutes Scheduled length of the conference in
End date of the conference in the format dd Month yyyy unless this is a permanent
conference in which case the end date is
not included
Either the time in the format hh:mm:ss or
permanent.
minutes. Not included for permanent
conferences
ad-hoc_conference_started
This event is seen when a conference is started from the MCU’s auto attendant with the Create new
conference option.
Section Name Description
<conference> unique_id Unique identifier for the conference in the
format nnnnnnnn. This is generated
automatically by the MCU
name Usually the same as the numeric_id
<conference details> numeric_id The conference ID entered by the creator of
the conference or <none>
has_pin Whether or not a PIN was used to enter the
conference. This will be one of:
yes
no
Note that PINs are optional for ad hoc
conferences
billing_code For future expansion
<creator> participant_id A number corresponding to one of the
participants' "participant_id" values that can
be found in its "participant_joined" record (see
next event)
<end> scheduled_time Not relevant to an ad hoc conference and
therefore always <none>
Call Detail Record File Format Reference Guide Page 7 of 26
MCUs
participant_joined
This event is seen whenever a participant joins a conference.
Section Name Description
<conference> unique_id
name For scheduled conferences, the conference name
<participant> * participant_id
<call> direction
The unique identifier in the format nnnnnnnn for
the conference seen in the
scheduled_conference_started or
ad-hoc_conference_startedevents
as allocated by the user and, for ad hoc
conferences, a name allocated by the unit
Unique number in the format nnnnnnnn for this
participant, automatically generated by the MCU
Either incoming or outgoing
* Within this event you will see both a “particpant_id” and “partic ip ant_ id” with in th e "<part ic ip ant >"
parameter group because of the need to correct a spelling mistake in the code.
participant_left
This event is seen whenever a participant leaves a conference.
Section Name Description
<conference> unique_id
name For scheduled conferences, the conference
<endpoint_details> ip_address IP address of the participant’s endpoint
dn Far end endpoint's E.164 number
h323_alias Far end's configured endpoint name
configured_name Name of MCU-configured endpoint name that
<participant> participant_id
<call> time_in_conference Duration that the participant was connected to
time_in_conference_in_
minutes
disconnect_reason A string explaining the reason why the
The unique identifier in the format nnnnnnnn for
the conference seen in the
scheduled_conference_started or
ad-hoc_conference_startedevents
name as allocated by the user and, for ad hoc
conferences, a name allocated by the unit
is, from the Endpoints tab on the MCU web
interface) if this participant is a pre-configured
one
Unique number (n or nn ) for this participant, as
generated by the MCU when the participant
joined the conference
the conference in minutes and seconds
Duration that the participant was connected to
<media_to_endpoint> resolution The highest resolution sent to or received from
the endpoint during the course of its conference
participation in the format "n x n" for example
"704 x 576”
video_codec As for <media_from_endpoint> above
audio_codec As for <media_from_endpoint> above
bandwidth Bandwidth in bits per second
conference_finished
This event is seen when a conference completes according to its schedule end time or is terminated.
Section Name Description
<conference> unique_id Unique identifier for the conference in the
format nnnnnnnn as seen in the
scheduled_conference_started or
ad-hoc_conference_startedevents
name For scheduled conferences, the conference
name as allocated by the user and, for ad hoc
conferences, a name allocated by the unit
<limits> audio_video_participants The maximum number of video plus audio
participants that were allowed on this
conference. This limit can either be explicitly
set by the conference owner or will be the
maximum number of participants that the
MCU supports
Call Detail Record File Format Reference Guide Page 9 of 26
Section Name Description
audio_only_participants The maximum number of audio-only
participants that were allowed on this
conference. This limit can either be explicitly
set by the conference owner or will be the
maximum number of participants that the
MCU supports
<end> duration How long the conference lasted in minutes
duration_in_minutes How long the conference lasted rounded up
Either 1 (allowed) or 0 (not allowed)
The highest number of a ty pe of part ic ipan t
present at any one time during the lifetime of
the conference
The total number of a type of participant who
joined the conference during its lifetime
Either yes or no: “yes" if at any point during its
lifetime the conference was registered with a
gatekeeper
and seconds
to the next whole number of minutes
MCUs
Call Detail Record File Format Reference Guide Page 10 of 26
ISDN gateways
ISDN gateways
Example CDR file: ISDN GW 3241/ ISDN GW MSE 8310 and
8321 blades
The exported file has the name cdr_log.xml. This can be changed if required. The following is an
extract showing each event type on the ISDN gateway unit or blade.
<event index="11" date="31 March 2010" time="10:26:42" type="connection_finished">
<connectionunique_id="381010" /><callduration="1 mins 16 sec" duration_in_minutes="2" disconnect_reason="participant
ended call" />
<bandwidthmax_bandwidth="384 kbit/s" downspeeded="no" /><h323_endpoint_detailsip_address="10.2.135.150" dn="Codian ISDN GW Auto Attendant"
h323_alias="endpoint10.2.135.150" />
<media_from_isdnresolution="1280 x 768" video_codec="H.264" audio_codec="G.722"
bandwidth="440000 bit/s" />
<media_to_isdnresolution="704 x 576" video_codec="H.263" audio_codec="G.722"
bandwidth="384000 bit/s" />
</event> </cdr_events>
Call Detail Record File Format Reference Guide Page 12 of 26
ISDN gateways
ISDN gateway event types
Currently the ISDN gateway CDRs support the event types listed in the table below. They are listed in
the order that they occur in the CDR.
Event type Description
new_connectionA new connection is initiated
connection_proceedingAppears whenever:
- the call has been connected
- a downspeeding event occurs. (Downspeding is a technique that limits
the bandwidth used by a video conferencing unit to the maximum
specified by the gatekeeper)
- a channel is added in an aggregation call
multiway_call_transferAn H.323 call leg is transferred to a multiway conference
connection_finishedA connection is closed. The reason is provided within the event detail
The tables in the sections below show the parameters for each event type in the order in which they
appear in the CDR. There is an explanation for each parameter.
new_connection
This event is seen when a call starts.
Section Name Description
<connection> unique_id Unique identifier for the connection in the format
nnnnnnnn. This is generated automatically by the
ISDN gateway
<call> direction
calling_number For IP to ISDN calls, the H.323 alias or E.164 number
original_called_number The E.164 number that was originally dialed by the
<isdn> call_type One of:
max_call_duration
Either ip to isdn or isdn to ip
of the IP endpoint. For ISDN to IP calls, the E.164
number of the ISDN endpoint or ISDN if number is
unknown
calling endpoint, or <none> if an IP endpoint calls the
ISDN gateway by its IP address
bonding (Video using bonding)
voice (Telephone)
h221 aggregation (Video using N x 64 kbps)
Either <no time limit> or a number of seconds
Call Detail Record File Format Reference Guide Page 13 of 26
ISDN gateways
connection_proceeding
This event is seen during a call.
Section Name Description
<connection> unique_id The same unique identifier for the connection as
provided in the previous
format nnnnnnnn
<call> via_auto_attendant Whether or not the connection was set up via the auto
attendant. Either yes or no
final_called_number
isdn_numbers
The final called number in the format <ip address:port no> or a number as generated by the dial plan
The subcall number in the format subcall_n where n is
between 1 and 5. The full number is shown for
aggregation calls. For bonding calls, only the final
digits of the number are shown (that is, those numbers
that are different from the master call). There should be
n subcall attributes where n is the number of Bchannels used by the call minus 1. The contents of the
subcall attribute for aggregation calls should be the
subcall number, and for bonding calls should only be
those digits that differ from the main number as
described here.
new_connection event in the
multiway_call_transfer
This event appears when an H.323 call leg is transferred to a multiway conference.
Section Name Description
<connection> unique_id
<call> duration How long the transferred connection lasted in
duration_in_minutes How long the transferred connection lasted rounded
disconnect_reason A string specifying the reason why the call was
<bandwidth> max_bandwidth The highest bandwidth seen during the lifetime of the
downspeeded Whether or not the connection was downspeeded.
<h323_endpoint_details> ip_address The endpoint’s IP address
dn
h323_alias The IP endpoint’s configured e ndpoi nt name
The same unique identifier in the format nnnnnnnn
for the connection as provided in the previous
new_connection event
minutes and seconds
up to the nearest minute
transferred. Can only be:
call_transferred_to_multiway_destination
transferred connection in kbit/s
Either yes or no
Either <none> or the IP endpoint's E.164 number
Call Detail Record File Format Reference Guide Page 14 of 26
ISDN gateways
Section Name Description
<media_from_isdn>
and/or
<media_to_isdn>
resolution This is the highest resolution sent to or received from
that endpoint during the course of the connection in
the format "n x n" (e.g. "704 x 576")
video_codec One of:
Null
H.261
H.263
H.264
audio_codec One of:
Null
G.711
G.722
G.728
G.722.1 Annex C
bandwidth Bandwidth in bits per second
connection_finished
This event is seen when a call completes or is terminated.
Section Name Description
<connection> unique_id
<call> duration How long the connection lasted in minutes and
duration_in_minutes How long the connection lasted rounded up to the
disconnect_reason A string specifying the reason why the participant
<bandwidth> max_bandwidth The highest bandwidth seen during the lifetime of
downspeeded Whether or not the connection was downspeeded.
The same unique identifier in the format nnnnnnnn
for the connection as provided in the previous
new_connectionevent
seconds
nearest minute
was disconnected. One of:
unspecified
no answer
rejected
rejected immediately
busy
gatekeeper error
protocol error
destination unreachable
participan t ended call
participant dropped
gatekeeper ended call
all participants dropped
destination out of order
incompatible destination
auto attendant idle
ip encryption required
unknown reason
the connection in kbit/s
Either yes or no
Call Detail Record File Format Reference Guide Page 15 of 26
Section Name Description
<h323_endpoint_details> ip_address The endpoint’s IP address
Either <none> or the IP endpoint's E.164 number
from that endpoint during the course of the
connection in the format "n x n" (e.g. "704 x 576")
Null
H.261
H.263
H.264
Null
G.711
G.722
G.728
G.722.1 Annex C
<media_from_isdn>
and/or
<media_to_isdn>
dn
h323_alias The IP endpoint’s config ur ed e ndpoi nt name
resolution This is the highest resolution sent to or received
video_codec One of:
audio_codec One of:
bandwidth Bandwidth in bits per second
ISDN gateways
Call Detail Record File Format Reference Guide Page 16 of 26
IP gateways
IP gateways
Example CDR file: IP GW 3500 Series and IP GW MSE 8350
The exported file has the name cdr_log.xml. You can change this if necessary. The following is an
extract showing each event type on the IP gateway unit or blade.
<?xml version="1.0" encoding="UTF-8" ?>
<cdr_events>
<event index="102403" date="17 September 2010" time="11:23:17" type="incoming_connection">
<call duration="2 mins 29 sec" duration_in_minutes="3">
</call>
</event>
</cdr_events>
Call Detail Record File Format Reference Guide Page 18 of 26
IP gateways
IP gateway event types
Currently the IP gateway CDRs support the event types listed in the table below. They are listed in the
order that they occur in the CDR.
Event type Description
incoming_connectionAn endpoint has dialed in to the IP gateway and a connection is initiated
call_operatorAn endpoint has dialed in to the IP gateway and the call is connected to
the operator
outgoing_connectionThe IP gateway connects to the far end
call_rejectedThe IP gateway’s call to the far end is rejected. The far end may be busy,
may not answer or rejects the call from the operator
call_acceptedThe far end accepts the call either directly or via the operator
enter_menuThe caller enters the menu system for the first time
video_startThe IP gateway plays a video (not a video prompt) to the endpoint
video_endThe playback of a recording is terminated
connection_finishedA call completes or is terminated
The tables in the sections below show the parameters for each event type in the order in which they
appear in the CDR. There is an explanation for each parameter.
incoming_connection
This event is seen when a call starts.
Section Name Description
<connection> unique_id Unique identifier for the connection in the format
nnnnnnnn. This is generated automatically by the
ISDN gateway
calling_number The H.323 alias or E.164 number of the endpoint
original_called_number The E.164 number that was originally dialed by the
calling endpoint, or <none> if an endpoint calls the IP
gateway by its IP address
call_operator
This event is seen when an operator has been called.
Section Name Description
<connection> unique_id Unique identifier for the connection in the format
nnnnnnnn
<operator> user_name The user name of the operator being called
outgoing_connection
The IP gateway is connecting through to the far end.
Section Name Description
<connection> unique_id Unique identifier for the connection in the format
nnnnnnnn
Call Detail Record File Format Reference Guide Page 19 of 26
IP gateways
Section Name Description
<target> called_number The number, URI, or IP address of the endpoint being
called
protocol The protocol used on the connection. Either SIP or
H.323
gateway Gateway address. Only present if the protocol is H.323
gatekeeper Name of the gatekeepers used to m ake the call. Only
present if the protocol is H.323
registrar Name of the registrar used to make the call. Only
present if the protocol is SIP
<screening> screened
Either yes or no, depending on whether this outgoing
connection is made through the operator
call_rejected
The far end did not accept the call either by not answering, being busy, or by not accepting the call
from the operator.
Section Name Description
<connection> unique_id Unique identifier for the connection in the format
nnnnnnnn
<target> disconnect_reason A string explaining the reason why the participant was
disconnected. Currently one of:
unspecified
no answer
rejected
rejected immediately
busy
gatekeeper error
protocol error
destination unreachable
participant ended call
participant dropped
gatekeeper ended call
all participants dropped
destination out of order
incompatible destination
auto attendant idle
ip encryption required
unknown reason
Call Detail Record File Format Reference Guide Page 20 of 26
IP gateways
call_accepted
The far end accepted the call either through the operator or directly. After this event, the caller is
talking to the far end.
Section Name Description
<connection> unique_id Unique identifier for the connection in the format
nnnnnnnn
<target> name Holds the name of the endpoint which accepted the
call. If no name is available, it holds the IP address or
E.164 number of the endpoint.
enter_menu
The participant was sent into the menu system. This event is only seen when first entering the menu
system, not when loading additional menus.
Section Name Description
<connection> unique_id Unique identifier for the connection in the format
nnnnnnnn
<menu> name The name of the menu that was loaded
video_start
The IP gateway is playing a video (not a video prompt) to the endpoint.
Section Name Description
<connection> unique_id Unique identifier for the connection in the format
nnnnnnnn
<video> vcr The name of the VCR connected to
numeric_id The numeric ID of the recording
video_end
Playback of a recording has terminated.
Section Name Description
<connection> unique_id Unique identifier for the connection in the format
nnnnnnnn
<video> complete Whether or not the video playback was run to the end.
Yes - the video ran to completion
No - the participant terminated the video
Call Detail Record File Format Reference Guide Page 21 of 26
IP gateways
connection_finished
A call completes or is terminated.
Section Name Description
<connection> unique_id Unique identifier for the connection in the format
nnnnnnnn..
duration How long the connection lasted in minutes and
seconds
duration_in_minutes How long the connection lasted rounded up to the
nearest minute
disconnect_reason A string explaining the reason why the participant was
disconnected. One of:
unspecified
no answer
rejected
rejected immediately
busy
gatekeeper
error
protocol error
destination unreachable
participant ended call
participant dropped
gatekeeper ended call
all participants dropped
destination out of order
incompatible destination
auto attendant idle
ip encryption required
unknown reason.
disconnector The party that caused the disconnection. One of:
caller
callee
ipgw
<call> duration How long the caller was connected to the callee
(called party) for
duration_in_minutes How long the connection lasted rounded up to the
nearest minute
Call Detail Record File Format Reference Guide Page 22 of 26
Advanced Media Gateway
Advanced Media Gateway
Example CDR file: AM GW 3610
The exported file has the name cdr_log.xml. You can change the filename if necessary. Below is a
short extract showing each event type on the AM gateway.
<?xml version="1.0" encoding="UTF-8" ?>
<cdr_events><event index="219151" date="26 April 2010" time="10:38:58" type="connection_started">
<media_from_endpointresolution="640 x 480" video_codec="RTVC1" audio_codec="Polycom(R)
Siren7(TM)" bandwidth="2016000 bit/s" />
<media_to_endpointresolution="1280 x 720" video_codec="RTVC1" audio_codec="G.722.1"
bandwidth="1524000 bit/s" />
</event></cdr_events>
Call Detail Record File Format Reference Guide Page 23 of 26
Advanced Media Gateway
Reason the participant was disconn ec ted. One
AM gateway event types
Currently the AM gateway CDRs support the event types listed in the table below. They are listed in
the order that they occur in the CDR.
Event type Description
<connection_started>A new connection is initiated
<connection_finished>A connection is terminated
<participant_disconnected>A participant has or has been disconnected. Note that there will be two
participant disconnected events per call
The tables in the sections below show the parameters for each event type in the order in which they
appear in the CDR. There is an explanation for each parameter.
connection_started
A new connection is initiated on the AM gateway.
Section Name Description
<connection> unique_id Unique identifier for the connection
<call> source Name of the calling participant
destination Name of the called participant
connection_finished
A connection is terminated on the AM gateway.
Section Name Description
<connection> unique_id Unique identifier for the connection
<call> duration Duration in minutes and seconds
duration_in_minutes Duration rounded up to nearest minute
disconnect_reason
Call Detail Record File Format Reference Guide Page 25 of 26
Advanced Media Gateway
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO
CHANGE WITHOUT NOTICE. ALL STATEMENTS, INF ORMA T IO N, AND RECOMMENDATIONS IN THIS MANUAL ARE
BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED.
USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE
INFORMATION PACKET THAT SHIPPED WIT H THE PRODUCT AND ARE INCO RPORATED HEREIN BY THIS
REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR
CISCO REPRESENTATIVE FOR A COPY.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE
SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL
WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING,
USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR
INCIDENTAL DAMAGES, INCLUDING, WITHO UT LI MITA TI ON, LO ST PROFITS OR LOSS OR DAMAGE TO DATA ARISING
OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF
THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of
Cisco's trademarks can be found at
respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other
company. (1005R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and
phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the
document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is
unintentional and coincidental.