Compliance logging (IPDR)
Two streams, one config, separate from operational logging: an always-on low-volume session and NAT-block IPDR, and an optional high-volume per-flow translation log.
The two streams
The block and session stream writes one durable line per session and per CGNAT port-block. The per-flow log writes a record at flow NEW and TCP ESTABLISH with the full inside, public and destination tuple plus subscriber identity — the lawful-intercept requirement. When enabled it also captures IPv6 subscriber-initiated TCP connection starts, since IPv6 has no CGNAT or conntrack.
Configuration
Everything here lives in the system view. The enable and disable of the compliance log, the file path, and the per-flow prefix, dir, disk, remote and DNS knobs all apply live on commit, so a collector can be re-pointed without dropping traffic. Only the per-flow enable itself takes effect on restart. save persists in every case. Disabling the disk sink keeps the directory setting and makes the per-flow log remote-only.
system ipdr enable|disable # session/block log system ipdr file <path> system ipdr flow enable|disable # per-flow log (ON RESTART) system ipdr flow prefix <tag> # collector line tag system ipdr flow dir <dir> # daily per-flow file dir system ipdr flow disk enable|disable # disable = remote-only system ipdr flow skip-dns # omit UDP/53 system ipdr flow log-dns # undo skip-dns system ipdr flow remote <host:port> # UDP collector system ipdr enable system ipdr file /var/log/bng/ipdr.log system ipdr flow remote 198.51.100.20:9995 system ipdr flow skip-dns commit ; save show ipdr # config + v4/v6 drop counters
Whether to log DNS
skip-dns omits UDP port 53 from the per-flow log. On a busy gateway DNS is a large share of flow starts and contributes little to a traceability request, so skipping it is often the difference between a manageable collector and an overwhelmed one. log-dns puts it back. Check what your regulator actually requires before deciding — this is a compliance question, not a capacity one.
Overflow is alarmed, never dropped
The fast path writes only a fixed 32-byte record into a lock-free ring; a pinned logger thread formats and ships it. Ring overflow is counted and alarmed rather than silently discarded — a lost mandated record is a compliance gap, not acceptable backpressure. show ipdr prints the disk state, the IPv6 capture state, and separate v4 and v6 drop counters, and those counters are the ones to alert on.