Finding SIP Failover event in 88XX Console Logs

[Randall White]

How can I find a CUCM Failover event in the console logs on 8851 and 8865 phones? What are some key words to search?

I want to find out if a certain group of phones fail over from a primary CUCM subscriber to the secondary subscriber.

I have seen the "Registration state change: SIP_REG_STATE_UNKNOWN" message, but it isn't consistent.

I am getting "NumberOfRegisteredPhonesDropped" messages in the Syslog, but I can't tell which phones are re-registering. This is probably caused by a circuit flapping, and if I knew which phones were re-registering, then I could isolate the problem.

Thanks, Randy

[Gregory Brunn]

Logs on switches would be where I might look depending on how big your environment, easy enough to see.

On phone status messages you should see tcp connection time out and then the secondary cucm server in group become active.

i am sure logging on sip messages on cucm could be turned on and you see the re register process that way as well.

[Randall White]

This is a large, complex LAN/WAN environment and I don't have access to the switches.

I am tracking thousands of phones, and the CUCM log files are huge.

This is why I am looking for specific key words to search on.

There are a few hundred phones in the same building as the problem data center. If I can show that those are failing over, then it's likely a core switch or vSwitch problem, not a WAN problem.

Thanks, Randy

[HARIS_HUSSAIN · Accepted solution]

Just collect the Even Viewer Logs from CUCM. and Look for Unregister and Register Events with Reason COde. YOu can search for Messages
with keyword EndPointUnregistered.

You could see KeepAliveTimeout Reason 13

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/err_msgs/8_x/ccmalarms861.html

UC_CALLMANAGER-3-EndPointUnregistered : An endpoint has unregistered Device name [String] Device MAC address [String] Device IP address [String] Protocol [String] Device type [Enum]Device description [String] Reason Code [Enum]IPV6Address [String] IPAddressAttributes [Enum]IPV6AddressAttributes [Enum]LastSignalReceived [String] CallState [String]

*** Please rate helpful post; Mark "Accept as a Solution" if applicable

Thanks,
Haris

[Randall White]

The Event Viewer logs had what I was looking for. I used Notepad++ to count the phones in a given subnet that were re-registering. All of the problem phones were in one CallManager Group, except the phones that were in the same campus as the primary Subscriber. So it looks like a WAN link issue.