Purpose
This guide explains how to send Ribbon SBC Core (GSX) system event logs and call detail records (CDR) to Logsign over syslog, so they are parsed and normalized automatically.
Logsign supports two Ribbon GSX log types, each with its own event prefix:
| Log type | Content |
|---|---|
| GSX SYS | System/event log (alarms, subsystem trace messages) |
| GSX CDR (ACT) | Call detail records (call accounting data) |
Prerequisites
- A Ribbon SBC Core (GSX) device with syslog export capability.
- Network reachability from the Ribbon device to the Logsign collector on the syslog port you configure.
Step 1: Configure Syslog Export on the Ribbon Device
Unverified: the exact CLI/GUI steps to enable syslog forwarding of system events and CDR on Ribbon SBC Core were not independently verified against a live device during this research. Consult Ribbon's own SBC Core administration guide for your software version to configure the syslog/accounting destination pointing at your Logsign collector's IP and port.
Step 2: Add the Source in Logsign
Add a syslog source for the Ribbon device in Logsign SIEM as you would for any syslog-based source, using the IP/hostname of the Ribbon device. Logsign matches incoming lines against the GSX SYS and GSX CDR formats automatically based on their structure; no separate device-type selection is required beyond a standard syslog source.
Supported Formats
GSX SYS
Space/dot-delimited system event lines, for example:
206 05022023 131215.414913:1.01.00.00004.MAJOR .SM: ...
169 07282026 072114.00074:1.10.11517.MAJOR .PRM : ...Fields captured include record size, date/time, shelf, slot, instance (optional), sequence number, severity, subsystem, and message text. Severity is mapped from the textual level (CRITICAL, MAJOR, MINOR, WARNING, INFO/INFORMATION) to Logsign's numeric severity scale.
GSX CDR (ACT)
Comma-separated call accounting records, one record type per line (START, STOP, etc.), each with its own column layout per Ribbon's official "CDR Field Descriptions" documentation for SBC Core 12.1. Column-to-field mapping is generated directly from that reference and does not need to be adjusted per customer.
Notes and Limits
- This is a syslog-based, parser-only integration. There is no API poller or credential to configure on the Logsign side.
- Ribbon device-side syslog/CDR export configuration is outside Logsign's code and was not verified in this research; refer to Ribbon's own documentation.