Active Calls displays whether call is secure, direct media or relayed, whether SRTP is done by VCM or CPU on IP500 V2. Linux servers always use CPU.
SysMonitor
For capturing SRTP traces, set filters to default trace options plus:
SIP > Sip + Verbose
Media > Media Events > Media handlers
Media > VoIP Events > VoIP + Verbose
Media > VoIP Events > Primitive + Verbose
During calls, in Status > [S]RTP Sessions window, column secure describes whether SRTP is used in that call and whether it is done by VCM or CPU on IP500 V2. Use the Show SRTP button to display further details on SRTP sessions.