Export CDR Data for Further Analysis

You can use the export functionality in the SQL Enterprise Manager to create an Excelcompatible file. The exported file can be used for meaningful searching, graphing, or troubleshooting. It then can be transported and used without immediate access to the Publisher. When you export, CDR data is accessible in a flat file without changing the enterprise parameter CDR Format to export a flat file.
WARNING

Exporting data can be a CPU-intensive process, especially when thousands or even millions of records must be manipulated. Use caution when deciding the time of day for CDR exporting. Use tools such as the Real-Time Monitoring Tool or Microsoft Performance to monitor the CallManager load. To export CDR data from the SQL database, follow this procedure on the Publisher or via a remote session: Step 1. Start Enterprise Manager by clicking Start > Programs > Microsoft SQL Server > Enterprise Manager. Step 2. Click the + next to Microsoft SQL Servers. Step 3. Click the + next to SQL Server Group. Step 4. Click the + next to (local) server. Step 5. Click the + next to the Databases folder. Step 6. Click the + next to the CDR database. Click Tables. Step 7. Right-click CallDetailRecord and choose All Tasks > Export Data. Step 8. When the wizard window opens, click Next. Step 9. All source settings have been populated because of the prior steps. Click Next. Step 10. In the Destination box, choose Microsoft Excel, and enter a filename and path of your choosing. Click Next. Step 11. Click the button Copy table(s) and view(s) from the source database. Click Next. Step 12. Choose the CallDetailRecord and CallDetailRecordDiagnostic sources. Click Next. Step 13. Choose a run time for a time period when the system is least used. Click Next. Step 14. Click Finish. The result is a handy Excel file with separate tabs for the CDRs and CMRs.

Convert Epoch Time to HumanReadable Time Using the CDR Time Converter Utility
Time stamps are written in UTC in the CDR, not in a human-readable form. UTC is the number of seconds that have passed since January 1, 1970 GMT, or simply Epoch time. The Cisco Press book Troubleshooting Cisco IP Telephony introduced the CDR Time Converter Utility. Check the book's website on Cisco Press for a free, downloadable file containing this tool (http://www.ciscopress.com/1587050757>Downloads). Check the site regularly, because you might find updates to this tool.
WARNING

This is not an officially supported tool. If you download, install, or use it, you do so at your own risk. Cisco Systems is not responsible for correcting problems that might arise as a result of your using this unsupported tool. Figure 11-3 shows a sample run of the CDR Time Converter Utility with the UTC integer 1056851136 taken from a CDR's dateTimeOrigination field. The multiple time zone output displayed in the utility makes it easy to discern the time of the event in relation to local time.
Figure 11-3. UNIX Epoch Time Converter Utility

Convert a 32-Bit Signed Integer Value to an IP Address

CallManager saves IP address information in the CDR as a 32-bit signed integer value. Converting that signed value can be tricky, but with a scientific calculator it becomes fairly easy to convert the number to the familiar dotted-decimal notation. Change the standard Windows calculator (Start > Programs > Accessories > Calculator) to Scientific (View > Scientific), and follow this procedure: Step 1. Click the Dec button to input a decimal value. Step 2. Enter the signed integer (for example, -1744626772). Step 3. Convert to hexadecimal by clicking the Hex button (FFFFFFFF98031BAC). Step 4. Keep only the last eight values, and dot the pairs (98.03.1B.AC). Step 5. Reverse the hexadecimal bytes by swapping the number pairs front-toback (AC.1B.03.98). Step 6. Enter the pairs one at a time into the calculator while still in hexadecimal mode (AC). Step 7. Click the Dec button to reveal 8 bits of the IP address in decimal (172). Step 8. Click the Hex button to return to hexadecimal mode. Step 9. Repeat Steps 6 through 8 until you achieve full address conversion (172.27.3.152).
TIP

When searching CDR entries for a specific IP address, you can use this method to translate the address in question into a signed integer.

Using Microsoft Excel Formulas to Convert UTC and IP Addresses

After the CDR has been exported from the CDR database into a file compatible with Microsoft Excel (see the earlier section "Export CDR Data for Further Analysis"), changing the display of the time or IP address into a human-readable format can be automated with a formula. After you have exported a CDR into an Excel file, open the spreadsheet and add a row at the top. The following steps show you how to convert the dateTimeOrigination and origIpAddr fields:

Step 1. Set up the cell that will display the value to be of the "date" type. In Excel, select Format > Cells, and chose the date display format you prefer. Step 2. Insert the following formula into the cell. Replace E3 with the field in the spreadsheet that you want to convert to human-readable form: =E3/86400+DATE(1970,1,1) The time is displayed in Greenwich Mean Time (GMT). The following steps show you how to convert an IP address to human-readable format. After you have exported a CDR into an Excel file, open the spreadsheet, add a row at the top, and follow these steps: Step 1. Install or verify that the optional Analysis ToolPak package has been installed (check for the Analysis ToolPak under Tools > Add-Ins). Without the optional ToolPak installed, the formula does not operate. You can install the Analysis ToolPak from the Microsoft Office Suite installations CDs or check the Microsoft Office\Office\ Library\Analysis directory. Step 2. Insert the following long formula into the cell to display the value as an IP address. Replace all four instances of H3 with the field in the spreadsheet that you want to convert to a human-readable form: =CONCATENATE(HEX2DEC(MID((DEC2HEX(ABS(H3),8)), 7,2)),".",HEX2DEC(MID((DEC2HEX(ABS(H3),8)), 5,2)),".",HEX2DEC(MID((DEC2HEX(ABS(H3),8)), 3,2)),".",HEX2DEC(MID((DEC2HEX(ABS(H3),8)),1,2))) The IP address is displayed in dotted-decimal format.