Compliance logging (IPDR)
Two streams, one config, separate from operational logging: an always-on low-volume session and NAT-block IPDR, and an optional high-volume per-flow translation log.
The two streams
The block and session stream writes one durable line per session and per CGNAT port-block. The per-flow log writes a record at flow NEW and TCP ESTABLISH with the full inside, public and destination tuple plus subscriber identity — the lawful-intercept requirement. When enabled it also captures IPv6 subscriber-initiated TCP connection starts, since IPv6 has no CGNAT or conntrack.
Configuration
The enable and disable of the compliance log, the file path, and the per-flow prefix, dir, disk, remote and DNS knobs all apply live on commit, so a collector can be re-pointed without dropping traffic. Only the per-flow enable itself takes effect on restart.
system ipdr enable system ipdr file /var/log/bng/ipdr.log system ipdr flow enable system ipdr flow remote 198.51.100.20:9995 system ipdr flow skip-dns commit ; save show ipdr
Overflow is alarmed, never dropped
The fast path writes only a fixed 32-byte record into a lock-free ring; a pinned logger thread formats and ships it. Ring overflow is counted and alarmed rather than silently discarded — a lost mandated record is a compliance gap, not acceptable backpressure.