8847: CUCM.ntst.local Aug 03 2017 11:26:32 UTC : %UC_CALLMANAGER-6-EndPointUnregistered: %[DeviceName=SEP7081050C0B88][IPAddress=192.168.175.31][Protocol=SCCP][DeviceType=586][Description=Auto 6027][Reason=9][MACAddress=7081050C0B88][IPAddrAttributes=3][ClusterID=StandAloneCluster][NodeID=CUCM]: An endpoint has unregistered
Description: An endpoint has unregistered
Explanation: An endpoint that has previously registered with Cisco Unified Communications Manager has unregistered. In cases of normal unregistration with reason code 'CallManagerReset', 'CallManagerRestart', 'DeviceInitiatedReset', 'EMLoginLogout', or 'EMCCLoginLogout', the severity of this alarm is lowered to INFORMATIONAL. An endpoint can unregister for many reasons, both intentional such as manually resetting the device after a configuration change, or unintentional such as loss of network connectivity. Other causes for this alarm could include a phone being registered to a secondary node and then the primary node coming online, causing the phone to rehome to the primary Unified CM node. Or, lack of a KeepAlive message being returned from the Unified CM node to which this endpoint was registered. Unregistration also occurs if Unified CM receives a duplicate registration request for this same device.
Recommended Action: Actions to take vary depending on the reason specified for the endpoint unregistration. If the reason is ConfigurationMismatch, go to the Device Configuration page in Cisco Unified CM Administration, make a change to the Description field for this device, click Save, then reset the device. In the case of a network connectivity problem or loss of KeepAlives, use network diagnostic tools and the Cisco Unified CM Reporting tool to fix any reported network or Unified CM system errors. In the case of an endpoint rehoming to the primary Unified CM node, watch for a successful registration of the device on the primary node. In the case of a duplicate registration request, it may be a non-malicious occurrence due to timing of an endpoint registering and unregistering; if duplicate registration requests continue or if the same endpoint has different IP addresses, confirm the IP address on the physical device itself by checking the settings on the device (settings button). If unregistration of this device was expected, no action is required. Also, refer to the reason code descriptions in this alarm for additional recommended actions.
Parameters:
DeviceName - Name of device
MACAddress - MAC address of device
IPAddress - IP address of device
Protocol - Native protocol of the registering device (for example, SCCP, SIP, and so on)
DeviceType - Device type
Description - Device description
Reason - Reason for device to unregister
IPV6Address - IPv6 address of device
IPAddrAttributes - Scope of the IPv4 address
IPV6AddrAttributes - Scope of the IPv6 address
LastSignalReceived - This optional parameter contains the name of the signal that was being processed when the endpoint unregistered. This parameter is used by Cisco personnel to assist troubleshooting.
CallState - This optional parameter contains a list of active calls at the time the endpoint unregistered. Each item in the list specifies a DN and the state of the call for that DN. A maximum of 6 calls are listed. This parameter is used by Cisco personnel to assist troubleshooting.
Enum Definitions - Device type:
1 - CISCO_30SP+
2 - CISCO_12SP+
3 - CISCO_12SP
4 - CISCO_12S
5 - CISCO_30VIP
6 - CISCO_7910
7 - CISCO_7960
8 - CISCO_7940
9 - CISCO_7935
12 - CISCO_ATA_186
20 - SCCP_PHONE
61 - H323_PHONE
72 - CTI_PORT
115 - CISCO_7941
119 - CISCO_7971
255 - UNKNOWN
302 - CISCO_7989
307 - CISCO_7911
308 - CISCO_7941G_GE
309 - CISCO_7961G_GE
335 - MOTOROLA_CN622
336 - BASIC_3RD_PARTY_SIP_DEVICE
348 - CISCO_7931
358 - CISCO_UNIFIED_COMMUNICATOR
365 - CISCO_7921
369 - CISCO_7906
374 - ADVANCED_3RD_PARTY_SIP_DEVICE
375 - CISCO_TELEPRESENCE
404 - CISCO_7962
412 - CISCO_3951
431 - CISCO_7937
434 - CISCO_7942
435 - CISCO_7945
436 - CISCO_7965
437 - CISCO_7975
446 - CISCO_3911
468 - CISCO_UNIFIED_MOBILE_COMMUNICATOR
478 - CISCO_TELEPRESENCE_1000
479 - CISCO_TELEPRESENCE_3000
480 - CISCO_TELEPRESENCE_3200
481 - CISCO_TELEPRESENCE_500
484 - CISCO_7925
493 - CISCO_9971
495 - CISCO_6921
496 - CISCO_6941
497 - CISCO_6961
20000 - CISCO_7905
30002 - CISCO_7920
30006 - CISCO_7970
30007 - CISCO_7912
30008 - CISCO_7902
30016 - CISCO_IP_COMMUNICATOR
30018 - CISCO_7961
30019 - CISCO_7936
30035 - IP_STE
Enum Definitions - Reason Code:
1 - Unknown - The device has unregistered for an unknown reason. If the device does not re-register within 5 minutes, verify that it is powered up and verify that network connectivity exists between the device and Unified CM.
6 - ConnectivityError - Network communication between the device and Unified CM has been interrupted. Possible causes include device power outage, network power outage, network configuration error, network delay, packet drops, and packet corruption. It is also possible to get this error if the Unified CM node is experiencing high CPU usage. Verify that the device is powered up and operating, verify that network connectivity exists between the device and Unified CM, and verify that the CPU utilization is in the safe range (you can monitor this via the CPU Pegging Alert in RTMT).
8 - DeviceInitiatedReset - The device has initiated a reset, possibly due to a power cycle or internal error. No action is required; the device will re-register automatically.
9 - CallManagerReset - A device was reset from Cisco Unified CM Administration, either due to an explicit command from an administrator, or due to internal errors encountered. No action is necessary; the device will re-register automatically.
10 - DeviceUnregistered - The device has explicitly unregistered. Possible causes include a change in the IP address or port of the device. No action is necessary; the device will re-register automatically.
11 - MalformedRegisterMsg - (SIP only) A SIP REGISTER message could not be processed because of an illegal format. Possible causes include a missing Call-ID header, a missing AoR in the To header, or an expires value that is too small. Check the REGISTER message for any of these issues and if you find one, correct the issue.
12 - SCCPDeviceThrottling - (SCCP only) The indicated SCCP device exceeded the maximum number of events allowed per-SCCP device. Events can be phone calls, KeepAlive messages, or excessive SCCP or non-SCCP messages. The maximum number of allowed events is controlled by the Cisco CallManager service parameter, Max Events Allowed. When an individual device exceeds the number configured in that service parameter, Unified CM closes the TCP connection to the device; automatic reregistration generally follows. This action is an attempt to stop malicious attacks on Unified CM or to ward off excessive CPU usage. No action is necessary; the device will re-register automatically.
13 - KeepAliveTimeout - A KeepAlive message was not received. Possible causes include device power outage, network power outage, network configuration error, network delay, packet drops, and packet corruption. It is also possible to get this error if the Unified CM node is experiencing high CPU usage. Verify that the device is powered up and operating, verify that network connectivity exists between the device and Unified CM, and verify that the CPU utilization is in the safe range (you can monitor this via the CPU Pegging Alert in RTMT). No action is necessary; the device will re-register automatically.
14 - ConfigurationMismatch (SIP only) The configuration on the device does not match the configuration in Unified CM. This can be caused by database replication errors or other internal Unified CM communication errors. First go to the Cisco Unified Reporting web page, generate a Unified CM Database Status report, and verify "all servers have a good replication status". You can also go to the Real-Time Reporting Tool (RTMT) and check the Replication Status in the Database Summary page. If status shows 2, then replication is working. If this device continues to unregister with this reason code, go to the Device Configuration page in Unified CM Administration for the device identified in this alarm and click Save. This generates a change notification message to the Cisco CallManager and TFTP services and rebuilds a new configuration file. If the problem still persists, restart the TFTP service and Cisco CallManager service.
15 - CallManagerRestart - A device restart was initiated from Unified CM, either due to an explicit command from an administrator, or due to a configuration change such as adding, deleting or changing a directory number associated with the device. No action is necessary; the device will re-register automatically.
16 - DuplicateRegistration - Unified CM detected that the device attempted to register to two nodes at the same time. Unified CM initiated a restart to the phone to force it to re-home to a single node. No action is necessary; the device will re-register automatically.
17 - CallManagerApplyConfig - An ApplyConfig action was performed in Unified CM Administration resulting in an unregistration. No action is necessary; the device will re-register automatically.
18 - DeviceNoResponse - The device did not respond to a reset or restart notification, so it is being forcefully reset. If the device does not re-register within 5 minutes, confirm that the device is powered-up and confirm that network connectivity exists between the device and Unified CM.
19 - EMLoginLogout - The device has been unregistered due to an Extension Mobility login or logout
20 - EMCCLoginLogout - The device has been unregistered due to an Extension Mobility Cross Cluster login or logout
21 - PowerSavePlus - The device powered off as a result of the Power Save Plus feature that is enabled for this device. When the device powers off, it remains unregistered from Unified CM until the Phone On Time defined in the Product Specific Configuration for this device.
22 - CallManagerForcedRestart - (SIP Only) The device did not respond to an Apply Config request and as a result, Unified CM sent a restart request to the device. The device may be offline due to a power outage or network problem. Confirm that the device is powered-up and that network connectivity exists between the device and Unified CM.
23 - SourceIPAddrChanged - (SIP Only) The device has been unregistered because the IP address in the Contact header of the REGISTER message has changed. The device will be automatically re-registered. No action is necessary.
24 - SourcePortChanged - (SIP Only) The device has been unregistered because the port number in the Contact header of the REGISTER message has changed. The device will be automatically re-registered. No action is necessary.
25 - RegistrationSequenceError - (SCCP only) A device requested configuration information from Unified CM at an unexpected time and Unified CM no longer had the requested information in memory. The device will automatically attempt to register again. If this alarm occurs again, manually reset the device. If this alarm continues to occur after the manual reset, there may be an internal firmware error. Collect existing SDI and SDL traces and contact the Cisco Technical Assistance Center (TAC).
26 - InvalidCapabilities - (SCCP only) Unified CM detected an error in the updated media capabilities reported in one of the StationUpdateCapabilities messages sent by the device. The device will automatically attempt to register again. If this alarm occurs again, manually reset the device. If this alarm continues to occur after the manual reset, there may be a protocol error. Collect existing SDI and SDL traces and contact the Cisco Technical Assistance Center (TAC).
28 - FallbackInitiated - The device has initiated a fallback and will automatically re-register to a higher-priority Unified CM. No action is necessary.
29 - DeviceSwitch - A second instance of an endpoint with the same device name has registered and assumed control. No action is necessary.
Enum Definitions - IPAddressAttributes:
0 - Unknown - The device has not indicated what this IPv4 address is used for
1 - Administrative only - The device has indicated that this IPv4 address is used for administrative communication (web interface) only
2 - Signal only - The device has indicated that this IPv4 address is used for control signaling only
3 - Administrative and signal - The device has indicated that this IPv4 address is used for administrative communication (web interface) and control signaling
Enum Definitions - IPV6AddressAttributes:
0 - Unknown - The device has not indicated what this IPv6 address is used for
1 - Administrative only - The device has indicated that this IPv6 address is used for administrative communication (web interface) only
2 - Signal only - The device has indicated that this IPv6 address is used for control signaling only
3 - Administrative and signal - The device has indicated that this IPv6 address is used for administrative communication (web interface) and control signaling
