This article was written because I thought the official documentation at the time was not a great step-by-step resource to send someone you needed to collect SIP traces. The official documentation has since been updated and I recommend you check it out: https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200787-How-to-Collect-Traces-for-CUCM-9-x-10-x.html
This document will focus on collecting traces for CUCM 8.6.2. It should be mostly the same for any recent CUCM release. CUCM traces give us the signalling going across the CUCM as well as give extremely detailed logs of what CUCM is doing when processing calls. It's important to note that traces must be turned on before the problem call/test call is made. If a problem happened once and CUCM traces were not turned on, we cannot go back and get logs.
Configure Traces
First, go to CUCM and log into Unified CM Serviceability.
Navigate to Trace -> Configuration
Select the server processing the calls in question. The parameters we're interested in are under CM Services -> Cisco CallManager (Active)
Check Trace On and set the Debug Trace Level to Detailed. Check all the traces relevant to the problem we are experiencing. The most important to have checked is probably Enable SIP Call Processing Trace. Your TAC engineer might ask for other specific traces depending on the issue you're having.
Recreate the Issue
With the SIP traces enabled, recreate the issue. Note the timestamps when you start and stop the recreate so we can find the problem easily in the traces.
Collect the Traces
CUCM traces cannot be downloaded from the GUI. They are collected with the Real-Time Monitoring Tool (RTMT). You can download this from Unified CM Administration -> Application -> Plugins. You might already have a version of RTMT installed, but it's very particular about which version it is compared to CUCM's version. If you find that your RTMT install doesn't work, try downloading and installing the version on CUCM itself.
Click Find then scroll down to the bottom and download Cisco Unified Real-Time Monitoring Tool - Windows
Install RTMT anywhere and launch it. It will prompt you to enter your CUCM IP address. Click Accept if a certificate error appears. It will then prompt you to log-in. The credentials should be your Unified CM Administration credentials.
Click away the Select Configuration window by selecting Cancel, then go to Trace & Log Central -> Collect Files
In the window that appears check Cisco CallManager under All Servers. In certain cases your engineer may also want other services such as Cisco Tftp. Click Next to bring up the next window.
Unless your TAC engineer specifies, you can just click Next on the System Services/Applications window that appears without selecting anything.
On the next screen choose the range when you recreated the problem. Start 5 minutes before and end 5 minutes late to ensure we capture everything in the downloaded logs.
Below this choose the Download File Directory (this is where the files will be downloaded to) and select Zip Files. When you click Finish, the logs will begin downloading. Depending on how many traces were selected, the activity on the CUCM, and the time range, this could take a very long time. Wait until you see completed downloading:
You should have 2 files per server (so 4 zip files total if you have a pub and sub). Upload these files to your TAC service request and please note the timestamp of the issue along with the directory numbers and IPs of the devices in question.
