Trace collection is no longer required or the operator wants to terminate an active UE-associated trace session.
Main purpose
Deactivates an active trace session, identifies the trace session to stop, prevents unnecessary trace load, closes the trace lifecycle after troubleshooting or monitoring, and separates trace stop control from trace failure reporting.
Main specification
3GPP TS 38.413, Trace procedures and Deactivate Trace message
Release added
Release 15
Procedures where used
Deactivate Trace, UE trace deactivation, Trace lifecycle cleanup, Network troubleshooting, Radio and signalling diagnostics
What is Deactivate Trace in simple terms?
Deactivate Trace is the NGAP trace message sent by the AMF to the NG-RAN node to stop an active trace session for a UE.
Deactivates an active trace session, identifies the trace session to stop, prevents unnecessary trace load, closes the trace lifecycle after troubleshooting or monitoring, and separates trace stop control from trace failure reporting.
Why this message matters
Deactivate Trace is the AMF telling the gNB to stop collecting trace data for a UE. Trace ID says which active trace session should be stopped.
Where this message appears in the call flow
Deactivate Trace
Deactivate Trace is the clean stop message for an active UE trace session.
Call flow position: AMF sends this UE-associated initiatingMessage to stop an active trace session at NG-RAN.
Typical state: NG-RAN identifies the trace session and stops trace collection for the UE.
Preconditions:
A trace session was previously activated.
AMF UE NGAP ID and RAN UE NGAP ID identify the correct UE context.
Trace ID identifies the active trace session to deactivate.
Next likely message: Trace collection stops
Trace ID correlation
Trace ID and the UE identity pair must match the active trace context.
Call flow position: Trace ID links Deactivate Trace to the active trace session created by Trace Start.
Typical state: Trace analysis verifies that the stop message applies to the intended trace session.
Preconditions:
Original Trace Start or trace context is visible or known.
Trace ID is decoded correctly.
Next likely message: Closed trace lifecycle
Trace lifecycle cleanup
Deactivate Trace stops collection; Trace Failure Indication reports a problem; Cell Traffic Trace is output related.
Call flow position: Deactivate Trace is the clean stop branch, while Trace Failure Indication is the failure branch.
Typical state: AMF and NG-RAN should no longer collect or report data for the deactivated trace.
Preconditions:
Trace was active and not already failed or released.
Next likely message: No further trace output for that Trace ID
Call flow position
Previous message(s):Trace Start, NG-RAN started trace collection, Trace collection is no longer needed
Next message(s): NG-RAN stops trace collection, No further trace data should be collected for that trace session
Transport / encapsulation: NGAP over SCTP/IP between AMF and NG-RAN
Security context: Deactivate Trace stops collection for a UE-specific trace session. It should be correlated with the original Trace Start and handled according to operator trace policy and privacy controls.
Message Structure Overview
Deactivate Trace is an AMF-to-NG-RAN UE-associated initiatingMessage.
AMF UE NGAP ID and RAN UE NGAP ID bind the stop request to the correct UE context.
Trace ID is the key payload and identifies the active trace session to deactivate.
The message intentionally stops trace collection; it is not a trace failure report.
After successful handling, further trace output for that trace session should stop.
ASN.1 for 5G NGAP - Deactivate Trace
DeactivateTrace ::= SEQUENCE {
protocolIEs ProtocolIE-Container { {DeactivateTrace-IEs} },
...
}
DeactivateTrace-IEs NGAP-PROTOCOL-IES ::= {
{ ID id-AMF-UE-NGAP-ID CRITICALITY reject TYPE AMF-UE-NGAP-ID PRESENCE mandatory } |
{ ID id-RAN-UE-NGAP-ID CRITICALITY reject TYPE RAN-UE-NGAP-ID PRESENCE mandatory } |
{ ID id-TraceID CRITICALITY ignore TYPE TraceID PRESENCE mandatory },
...
}
How to read this ASN.1
Decode the UE identity pair first, then Trace ID. The Trace ID must match the trace session that should be stopped.
Treat this as a teaching example based on the expected message structure, not as a captured network trace.
Trace ID must be matched to the active trace session.
After deactivation, expected trace output for that Trace ID should stop.
Important Information Elements
IE
Required
Description
Message Type
Yes
Identifies the NGAP PDU as DEACTIVATE TRACE.
AMF UE NGAP ID
Yes
Mandatory UE identity at the AMF.
RAN UE NGAP ID
Yes
Mandatory UE identity at the NG-RAN node.
Trace ID
Yes
Mandatory trace session identifier used to identify which active trace session should be stopped.
Detailed field explanation
Message Type
Identifies the NGAP PDU as DEACTIVATE TRACE.
Presence: Required
In practice: In practice, compare this field with the original request and with any later release-dependent optional fields so you can see whether the network accepted the same service model the UE asked for.
AMF UE NGAP ID
Mandatory UE identity at the AMF.
Presence: Required
In practice: In practice, compare this field with the original request and with any later release-dependent optional fields so you can see whether the network accepted the same service model the UE asked for.
RAN UE NGAP ID
Mandatory UE identity at the NG-RAN node.
Presence: Required
In practice: In practice, compare this field with the original request and with any later release-dependent optional fields so you can see whether the network accepted the same service model the UE asked for.
Trace ID
Mandatory trace session identifier used to identify which active trace session should be stopped.
Presence: Required
In practice: In practice, compare this field with the original request and with any later release-dependent optional fields so you can see whether the network accepted the same service model the UE asked for.
What to check in logs and traces
Confirm Deactivate Trace follows a matching Trace Start.
Match AMF UE NGAP ID and RAN UE NGAP ID to the UE context.
Verify Trace ID matches the active trace session.
Check that trace data stops after deactivation.
Confirm no unexpected Cell Traffic Trace appears afterward for the same Trace ID.
Check whether Trace Failure Indication occurred before deactivation.
Confirm the message was sent to the correct NG-RAN node.
Common Issues and Troubleshooting
Trace output continues after Deactivate Trace.
Likely cause: Trace ID may not match the active trace session, or NG-RAN did not apply the deactivation.
What to inspect: Compare Trace ID, UE identifiers, and original Trace Start details.
Next step: Correct trace correlation and verify NG-RAN trace handling.
Deactivate Trace appears but trace was never active.
Likely cause: Trace Start may have failed or the UE context may have been released before activation.
What to inspect: Search for Trace Start, Trace Failure Indication, and UE Context Release messages.
Next step: Treat the stop message as cleanup and verify whether any active trace remains.
Deactivate Trace is sent to the wrong NG-RAN node.
Likely cause: UE mobility or stale context correlation may have changed the serving node.
What to inspect: Check handover, path switch, context release, and current RAN UE NGAP ID mapping.
Next step: Send trace cleanup to the node that owns the active trace context if required.
Trace Failure Indication appears before Deactivate Trace.
Likely cause: Trace handling already failed before the intentional stop request.
What to inspect: Decode Cause in Trace Failure Indication and compare Trace ID.
Next step: Fix the failure cause before expecting trace output or clean deactivation.
Wrong UE trace is stopped.
Likely cause: UE ID or Trace ID correlation may be wrong in the analysis or signalling.
What to inspect: Match AMF UE NGAP ID, RAN UE NGAP ID, and Trace ID against the original trace context.
Next step: Rebuild the trace lifecycle by UE identity pair and Trace ID.
Deactivate Trace is intentional stop control from AMF. Trace Failure Indication is NG-RAN reporting trace activation or handling failure.
Compared with Cell Traffic Trace
Cell Traffic Trace is trace output or reporting related. Deactivate Trace stops further collection for the trace session.
FAQ
What is Deactivate Trace in NGAP?
Deactivate Trace is the AMF-to-NG-RAN message used to stop an active trace session for a UE.
Who sends Deactivate Trace?
The AMF sends Deactivate Trace to the NG-RAN node.
What message usually comes before Deactivate Trace?
Trace Start usually comes before Deactivate Trace because Trace Start activates the trace session that later needs to be stopped.
What does Trace ID identify?
Trace ID identifies the active trace session that NG-RAN should deactivate.
Is Deactivate Trace a failure message?
No. Deactivate Trace is an intentional stop message. Trace Failure Indication is used when trace activation or handling fails.
How is Deactivate Trace different from Trace Failure Indication?
Deactivate Trace is AMF-controlled trace stop. Trace Failure Indication is NG-RAN-to-AMF failure reporting.
What happens if the wrong Trace ID is used?
NG-RAN may not stop the intended trace session, and trace output may continue for the active trace.
How do you troubleshoot Deactivate Trace?
Match UE IDs and Trace ID to the original Trace Start, confirm trace output stops, check for earlier Trace Failure Indication, and verify the message reached the correct NG-RAN node.
Decode this message with the 3GPP Decoder, inspect the related message database, or open the matching call flow to see where this signaling step fits in the full procedure.
