CUCM Trace file sizes

[JamesHawkins]

Hello,

I have a customer with CUCM 12.5(1)SU7a. The cluster has two CUCM servers and supports approximately 1500 endpoints.

The servers have 2 x vCPU, 6GB vRAM and 80GB vHDD.

I need to enable CUCM traces to troubleshoot an issue that occurs intermittently. I have set up the CUCM traces as detailed in the Troubleshooting Technote below.

https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/200787-How-to-Collect-Traces-for-CUCM-9-x-10-x.html 

My issue is that the system can only collect traces for approximately 20 hours before files start to be overwritten. This is not long enough to capture the issue.

The file size for trace files is set to 10MB and approximately 440 are created before they start to be overwritten. During working hours a trace file fills up in less than two minutes. During non-working hours the trace file fills up in around five minutes - no calls are active during that time.

Is this rate of log file creation normal for a system of this size or is it unusual?

[Maren Mahoney · Accepted solution]

If that is how fast they fill up in your system, that is how fast they fill up. It depends on call volume and trace detail level. My current customer starts overwriting files in about 4 hours, so what you are experiencing is not unusual.

We have trace files sent over to a syslog server as they are generated, and keep our trace files for a week. We set up the push via RTMT. You'll need to arrange something like that to keep your trace files longer.

Maren

[JamesHawkins]

Hi Maren,

Thanks for the response. I tested on another CUCM and that generated similar size logs so I guess that it is normal. It does seem very disk size intensive even if exported to an external location. Can failed calls be troubleshooted using trace levels other than detailed? - I am going to experiment with that and see how I get on.

[Maren Mahoney]

Detailed is about where you want it so you can see what is going on in the background like codec selection (via Regions negotiation) and Route List/MRGL selection.

To keep file volume down on our syslog server, we delete trace files after a week. We keep our CDRs long-term, though. Hope this helps.

Maren