Robertja,
I hope someone has answered your question by now, but this was a good question so I'll break it down a bit here to help out anyone else who may have the same or similar questions in the future.
As indicated previously, yes, you can see a user logging in and out of Extension Mobility / Extension Mobility Cross Cluster. To do so, follow this process:
I. Enable detailed traces on the cluster and gather the following logs / traces via the Real Time Monitoring Tool (RTMT) during the time period the user supposedly logged in / out: (1) Call Manager / CCM (for registration) (2) Tomcat and Tomcat Security (3) Extension Mobility (4) Extension Mobility Application. Make sure to download uncompressed logs or de-compress all the files after download them. You will need them for the next step.
II. Use "Notepad++" or something similar to search through the trace files for the User ID you are interested in. If the user has done anything related to extension mobility during the timeframe in question, it will show up in the traces. Example:
III. Here we see part of a request user "91934942" so we can infer that the user has initiated an EM / EMCC login request. Take note of "12347" as it is tracking this particular request along several lines of the log file. If you are interested in EMCC, take note of the "US-CUCM-CL4-SDC" as it the visiting cluster involved in this request and "253739" is also tracking this request.
2012-07-20 08:10:47,835 INFO [http-8443-33] EMServiceServlet - 124347 : 253739 : US-CUCM-CL4-SDC: processEmccRequest: Received EMCC Home Cluster Login Request for :91934942
IV. A few lines down in the trace file we see the message below. We determined that "124347" is tracking this request, so we know that this message is relevant to our user. More importantly, we see the phone the user is trying to log in with "deviceName: SEPAA187AA9F919" which will give us information like device pool, device profile, SURL subscription status, etc. Also note "2012-07-20 08:10:47,871" which gives us the time this event occurred, down to the thousandth of a second. This is very useful when tracking issues across multiple nodes, or in the case of EMCC, multiple nodes.
2012-07-20 08:10:47,871 DEBUG [http-8443-33] EMServiceServlet - 124347: 253739: UC-EU-CL4-RBS: performHomeDeviceLogin for deviceName: SEPA4187529F204
V. If you are troubleshooting, watch out for the tracking number changing at different steps in the process. The line below identifies all of the tracking numbers (counters) that have been used thus far for this request. Notepad++ can highlight text, it is recommended that you highlight counters as they will easily allow you to identify portions what output is relevant to the issue you are working on. It is recommended that you highlight anything that is UNIQUE to the issue you are working on, such as the User ID and Phone name. Tracing what is happening, whether it is an extension mobility login or a phone call requires patience and experience, but if you follow the steps laid out here you will eventually navigate through traces very quickly and gain a much better understanding of what is happening. If you find this too easy and want something more advanced, try looking through some SDL traces using the same process and you will gain an even better understanding of what is happening.
2012-07-20 08:10:48,661 INFO [http-8443-33] Counters - 124347: Counters -->124347,67277,9220,7707,33,0,0,40298,1419,0,1313,348,4019,-405,672
VI. So, using the logs in CUCM, you have not only confirmed that the user has attempted login but seen that you can follow process in the logs to pinpoint a failure very easily. The exceptional logging in Cisco's Collaboration suite is one of the things that really make it straightforward to troubleshoot. I hope this has helped you.
VII. Notes: (1) the term trace and log are used interchangeably. (2) While the examples I provided below are for Extension Mobility Cross Cluster (only trace examples I had on hand at the moment) the process will be very similar or identical for regular Extension Mobility as well (and for other CUCM traces). (3) I would also recommend reading up on the call flow of extension mobility if you are troubleshooting an issue, between the call flow and the traces you should be able to troubleshoot 90% of the issues you face. (4) If your employer or customer has a Cisco SMARTnet contract you can always open a low-priority case with Cisco TAC and asking them to assist you in identifying this information. If you get them the logs they ask you for you will not be disappointed, the engineers working for Cisco TAC are very skilled at what they do.
