Call Manager logs/Trace -capture method - please make life easy :(

[Laura Fernando]

Hello friends,

I need some help to understand the backend process when it come to capture cucm logs/traces. Apologies for long synopsis, hope you all can help. 

When I try to capture the logs from RTMT what are the things which needed to be carefully checked? Before executing any request in RTMT collect files?

As I understand if we are having huge cluster with say 20K + Phones even if we pull 10 min detailed CUCM logs it gives a huge data, more then MB's some time which can hamper the processor/Memory of the server ( Danger !! ) I mean I have got error -warning saying it will slow down process.

I would like to know what is the best way to capture only limited logs which are related to the issue which we are working on. without capturing any other unwanted data.

As you all know When we do test there are chances we may be doing many test scenarios which some times can go up to 15-20 min of time window, Hence We are left with pulling 15-20 min time window log that will be huge:(

How is the Time zone should be considered? while pulling logs? Let Us say I am troubleshooting a Phone in UK and My Cluster is in US, when trying to collect the files  should I make sure the time period is converted to time zone of the located cluster?

When we pull the logs we get huge data with multiple folders related to each node which will have the zipped file inside it which needs to be unzipped  in single folder then open notepad ++ and do find all to search our test call numbers etc (very hard for a admin like me who is not an expert like TAC). I found it very hard to unzip it by going into each folder :( any easy method to extract it ?

Overall just wanted to know the best way to capture logs, wanted to make it simple.

Laura,

[gc9731]

Laura,

I feel for you.  This is a segment has Cisco does not tend to put enough resources into.  I have finally resigned to the fact that Solarwinds NPM with the VNQM add on is the best answer to my reporting issues.

Wish I could really help, but the interface is not user-friendly and the documentation is lacking, never mind trying to find any training or youtube videos worth anything in this regard.

GC

[Dennis Mink]

Laura,

if you need for instance SIP traces to find out why a certain call has a certain issue, i suggest you get an exact timestamp of when the call takes place,

For this, use RTMT >  Realtime data, then  select the call in question >  Trace,    this will limit your trace output to only cover the time when the call was being process, also, choose only the SUBscriber on which the call is being processed.

For SIP traces you might want to look into Translator X; a very good tool for voice analysis

remember to turn detailed debugging on / off when you are not testing.

Please rate if helpful.

[Laura Fernando]

Hey Dennis,

Thanks for your reply. I liked the SIP Suggestion, However I do have some other queries on collecting trace/logs

Could you help me with my above query which I is mentioned. - I am not an expert as you all. hope you can help

Laura... 

[Rajan]

Hi Laura,

I agree with you. Few things that solves some of the mentioned issues:

1. For the timezone issue, I always select the relative range below the absolute range option and select the last 10 mins or 15 mins depending on the requirement instead of selwcting the exact time.

2. For the unzipping issue, it is always advisable to select the below 2 options while collecting the logs.

- donot zip files

- uncompress log files

After collecting the logs, ZIP that folder as a whole to reduce the size. This will avoid unzipping and uncompressing each files.

My 2 cents :)

HTH

Rajan

Pls rate all useful posts

[Laura Fernando]

Hello Rajan,

Thanks for your advice. to my understanding we have to perform the test activity with in 10 min to ( any failure scenario/issue ) which will  avoid huge bunch of data.? that's what you mean?

Is there any good document on how to capture logs? I mean I am well verse with CUCM logs why it is required but there are many other logs which gives different information can some one give me the doc?  Also any document which is simple to understand the  on how to read traces/logs? for sip,mgcp,h323,sccp?

Many Thanks,

[Rajan · Accepted solution]

The below 2 links provides all info you need to collect the logs and which logs to go for different scenarios:

http://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200787-How-to-Collect-Traces-for-CUCM-9-x-10-x.html

https://supportforums.cisco.com/document/126941/cucm-trace-lookup-different-scenarios

HTH

Rajan

[Rajan]

There are no clear cut docs available on how to read CUCM traces. You could refer the great document from Deji in this forum which will provide you with the basics to read the traces as the traces are read manually.

https://supportforums.cisco.com/document/12724111/understanding-cucm-traces-end-end

You could also use tools like translatorX which will be helpful to get the call flow and see messages by filtering the call though it cannot go that deep.

HTH

Rajan

[Rajan]

Yes. Always try to recreate the issue and collect the logs for the last few minutes instead of selecting the from and to time and the timezone as the timezone of RTMT and the actual CUCM varies sometimes.