Hello
my company has 3 offices in different cities , only one city main office has CUCM and other 2 subsidiary offices IP phone users connect to cucm via the WAN.
Recently one subsidiary office ip phone all users get ip phone ''intermittent unregistering'' several times each day (screenshot 1 ), at the same time the main office and another sub office users don't meet the same issue.
I have installed RTMT , how I can use it to find root cause of the ''intermittent unregistering'' ?
screenshot 1
screenshot 2 , it just happen 'unregistering' again and one ip phone logs as below (Time Zone is UTC +08:00)
[13:10:09 02/17/25] DeviceName=SEPF8A5C5A178F4 DeviceIPv4Address=10.86.18.15/24 IPv4DefaultGateway=10.86.18.1 DeviceIPv6Address= IPv6DefaultGateway= ModelNumber=CP-8841 NeighborIPv4Address=10.86.17.1 NeighborIPv6Address= NeighborDeviceID=gc86sha-csw01.corp.geze.com NeighborPortID=GigabitEthernet1/0/28 DHCPv4Status=1 DHCPv6Status=3 TFTPCfgStatus=1 DNSStatusUnifiedCM1=0 DNSStatusUnifiedCM2=0 DNSStatusUnifiedCM3=0 DNSv6StatusUnifiedCM1=0 DNSv6StatusUnifiedCM2=0 DNSv6StatusUnifiedCM3=0 VoiceVLAN=4 UnifiedCMIPAddress=gc86cucm1.corp.geze.com LocalPort=51378 TimeStamp=1739769009457 ReasonForOutOfService=10 LastProtocolEventSent=Sent:REGISTER sip:gc86cucm1.corp.geze.com SIP/2.0 Cseq:9144 REGISTER CallId:f8a5c5a1-78f410f0-4e98ce4b-36b7f424@10.86.18.15 LastProtocolEventReceived=Rcvd:SIP/2.0 200 OK Cseq:154139 REGISTER CallId:f8a5c5a1-78f4291f-7731a18b-24c7b721@192.168.183.2 ReasonForOutOfServiceText=LastTimeTCPtimeout ActiveInterface=Wired
[13:11:51 02/17/25] DeviceTLInfo DeviceName=SEPF8A5C5A178F4 IPv4Address=10.86.18.15 IPv6Address=CTL_Signature=Not InstalledCTL_TFTP_Server=N/AITL_Signature=BC ED B9 46 C2 B7 7F 82 9C 1B F3 6F F7 B7 15 D8 7C 0A 9A A1 ITL_TFTP_Server=gc86cucm1.corp.geze.comStatusCode=6
[13:30:36 02/17/25] DeviceName=SEPF8A5C5A178F4 DeviceIPv4Address=10.86.18.15/24 IPv4DefaultGateway=10.86.18.1 DeviceIPv6Address= IPv6DefaultGateway= ModelNumber=CP-8841 NeighborIPv4Address=10.86.17.1 NeighborIPv6Address= NeighborDeviceID=gc86sha-csw01.corp.geze.com NeighborPortID=GigabitEthernet1/0/28 DHCPv4Status=1 DHCPv6Status=3 TFTPCfgStatus=1 DNSStatusUnifiedCM1=0 DNSStatusUnifiedCM2=0 DNSStatusUnifiedCM3=0 DNSv6StatusUnifiedCM1=0 DNSv6StatusUnifiedCM2=0 DNSv6StatusUnifiedCM3=0 VoiceVLAN=4 UnifiedCMIPAddress=gc86cucm1.corp.geze.com LocalPort=50757 TimeStamp=1739770236554 ReasonForOutOfService=10 LastProtocolEventSent=Sent:REGISTER sip:gc86cucm1.corp.geze.com SIP/2.0 Cseq:9155 REGISTER CallId:f8a5c5a1-78f41170-18aecf62-318b12b2@10.86.18.15 LastProtocolEventReceived=Rcvd:SIP/2.0 200 OK Cseq:154139 REGISTER CallId:f8a5c5a1-78f4291f-7731a18b-24c7b721@192.168.183.2 ReasonForOutOfServiceText=LastTimeTCPtimeout ActiveInterface=Wired
[13:30:54 02/17/25] DeviceTLInfo DeviceName=SEPF8A5C5A178F4 IPv4Address=10.86.18.15 IPv6Address=CTL_Signature=Not InstalledCTL_TFTP_Server=N/AITL_Signature=BC ED B9 46 C2 B7 7F 82 9C 1B F3 6F F7 B7 15 D8 7C 0A 9A A1 ITL_TFTP_Server=gc86cucm1.corp.geze.comStatusCode=3
[13:31:17 02/17/25] DeviceName=SEPF8A5C5A178F4 DeviceIPv4Address=10.86.18.15/24 IPv4DefaultGateway=10.86.18.1 DeviceIPv6Address= IPv6DefaultGateway= ModelNumber=CP-8841 NeighborIPv4Address=10.86.17.1 NeighborIPv6Address= NeighborDeviceID=gc86sha-csw01.corp.geze.com NeighborPortID=GigabitEthernet1/0/28 DHCPv4Status=1 DHCPv6Status=3 TFTPCfgStatus=1 DNSStatusUnifiedCM1=0 DNSStatusUnifiedCM2=0 DNSStatusUnifiedCM3=0 DNSv6StatusUnifiedCM1=0 DNSv6StatusUnifiedCM2=0 DNSv6StatusUnifiedCM3=0 VoiceVLAN=4 UnifiedCMIPAddress=gc86cucm1.corp.geze.com LocalPort=50757 TimeStamp=1739770236554 ReasonForOutOfService=10 LastProtocolEventSent=Sent:REGISTER sip:gc86cucm1.corp.geze.com SIP/2.0 Cseq:9155 REGISTER CallId:f8a5c5a1-78f41170-18aecf62-318b12b2@10.86.18.15 LastProtocolEventReceived=Rcvd:SIP/2.0 200 OK Cseq:154139 REGISTER CallId:f8a5c5a1-78f4291f-7731a18b-24c7b721@192.168.183.2 ReasonForOutOfServiceText=LastTimeTCPtimeout ActiveInterface=Wired
Accepted Solutions
This is what I can see in the message you shared: ReasonForOutOfServiceText=LastTimeTCPtimeout.
I would suggest collecting the following information to gain more insights:
From Phone:
On IP phone web page:
- Phone Problem Report (PRT) or Console logs
On Wireshark (no always needed):
- Pcap from Phone
From CUCM:
From RTMT (Real Time Monitor Tool):
- Cisco CallManager Traces
- Event Viewer Application Log
- Event Viewer System Log
- Cisco TFTP
From CUCM CLI session (no always needed):
- Pcap from primary CUCM (where the phone registers)
This is what I can see in the message you shared: ReasonForOutOfServiceText=LastTimeTCPtimeout.
I would suggest collecting the following information to gain more insights:
From Phone:
On IP phone web page:
- Phone Problem Report (PRT) or Console logs
On Wireshark (no always needed):
- Pcap from Phone
From CUCM:
From RTMT (Real Time Monitor Tool):
- Cisco CallManager Traces
- Event Viewer Application Log
- Event Viewer System Log
- Cisco TFTP
From CUCM CLI session (no always needed):
- Pcap from primary CUCM (where the phone registers)
