Surprise, surprise, fs_cli is an application that connects via TCP to mod_event_socket, on localhost port 8021. After connecting, fs_cli sends some commands and then enables receiving "logging" events.

Let's see it in action, on port 8021! Disconnect all fs_cli sessions you may have running and any other application that connects to FreeSWITCH (they're probably using this same interface), and then you can start sniffing with ngrep:

ngrep -d lo -q -W single port 8021 

In another terminal, execute fs_cli. Ngrep will display the connection authorization, the "api" commands, and then the "log" command that enable displaying of "logging" events.

Then make a call to 5000 from a registered phone, and see what's displayed by ngrep: