Introduction
This document describes how to collect the Cisco Unified Communications Manager (CUCM) event viewer logs, through the Real Time Monitoring Tool (RTMT).
Contributed by Christian Nuche (cnuche), Cisco TAC Engineer.
NOTE: This document assumes that you are familiar with RTMT if you are unsure on how to open RTMT and use it see the following doc first:
How to install and use RTMT for CUCM.
Also check and bookmark the main page of these 'how to' series which is continuously updated with Unified Collaboration Resources.
cnuche's One Stop, Unified Collaboration Tech Resources - Continuously updated.
Now, back to the event viewer.
Background Information
What is it?
The event viewer logs are comma separated values (csv) files that contain a collection of alarms and events that CUCM generates about the system and endpoints.
What is it helpful for?
These are helpful to troubleshoot a variety of issues on the system, like phones that un-registers, DB out of sync, phones on preservation mode, and many others.
Prerequisites
Components
- RTMT Basic knowledge.
- Linux Based CUCM
Collect the files
Step 1. Open RTMT and double click on Trace & Log Central
Step 2. Double click on Collect Files
Step 3. A window with multiple services opens, do not click on any, (unless something else was required by the TAC engineer), and click on the Next button.
Step 4. Once you are on the second set of services, scroll down until you see Event Viewer Application Log and Event Viewer System Log you usually want to enable the first checkbox to get the logs from all servers, then click the Next button.
Step 5. Click the Next button so you get the Collect File Options window, (you can see another set of services if you have IM&P servers on this cluster), on which you can select an specific time-range and date you want to collect the logs from, or you may select Relative Range and pick the last few minutes, hours, days, weeks or months.
If the TAC engineer was specific about the date and time-range, select that, if the TAC engineer was not specific about this, then get the last X number of days from which this start to happen or think on when you first notice the issue.
As a best practice click on the Browse button and select an easy-to-get destination, like your desktop, once you select this, create a folder to store the files in there, use a name that makes sense and reflects the type of data and date you are collecting the files for, like TAC-eventviewer-12-12-16, if you end up collecting multiple files it will be helpful and will also help the TAC engineer to get an idea of what is in that folder.
You want to get the files from the Active Partition unless you are investigating an issue on a previous CUCM version on your system.
Once you are done, click on Finish.
Step 6. When the RTMT finishes to collect the files on all servers you selected you should see a window like the following image.
Step 7. Zip the entire folder that you created to compress all the logs in a single file.
Step 8. Once you have the zip file, upload it to the case notes using the Case File Uploader tool: https://cway.cisco.com/csc
This tool asks you to log in with your cisco.com credentials and your case number, you can find your case number on the subject of the emails your TAC engineer has been sending you about your case.