CUCM unregistered count increases quickly on secondary nodes.

[catkins101]

My environment has 329 registered devices with all of them set for registration first to a "main" subscriber and then the remaining subscribers and lastly the Publisher. I am seeing reports where the unregistered phone count will increase in a short burst, but when I check the devices they are showing registered to the main subscriber. I was thinking there may be a network problem causing some phones to drop registration with the main subscriber, but if that is happening it is very quick and very scattered about. Is there something I can look for in RTMT or any way to nail down why these devices would show up as unregistered in the other servers? I have read the device MUST have registered with the server at some point to show up as unregistered.

[arielroza]

In RTMT, if you open the Syslog of the subscriber  you must have a Device Unregistered event for each of the affected phones. In that event there is a Reason field, with a number that tells you why that particular phone unregistered. 
Lookup the System Error messages guide for your particular CUCM version here:
https://www.cisco.com/c/en/us/support/unified-communications/unified-communications-manager-callmanager/products-system-message-guides-list.html

And serch for the error message and you will find a table listing the possible reasons

[catkins101]

I have done this and found a device usually shows:

ReasonForOutOfService=10 -- TCPtimedOut - The TCP connection to the Cisco Unified Communication Manager experienced a timeout error

--- OR ---

ReasonForOutOfService=18 -- TCPclosedConnectHighPriorityUcm - The device closed the TCP connection in order to reconnect to a higher priority Cisco Unified CM

The interesting part about reason code 18 is that I see this on the main subscriber in some cases. Since it is the highest priority in the CUCM group, I am not sure what would cause the device to go searching for a higher node.

[silvervoip]

How many TFTP nodes do you have? if all nodes working as TFTP then make sure firmware images, device packs & locale (language) files are installed on each node properly. 

[catkins101]

I checked OS Administration and Software Packages are showing all the same cop file and version.

[AnoopKrishnan123]

On the RTMT > Double click on the Trace and log central and look up for the event viewer - Application log and Event viewer-System log. you can troubleshoot the IP Phones which are getting unregistered.

If you need a detailed troubleshooting and suspecting on your network, you can use Wireshark and do the Packet Sniffig.

[dp215]

Are you using power bricks or PoE?

[catkins101]

PoE

[dp215]

Try checking the CPU utilization on the switch.