RTMT Alert after phone unregisters

[Matthias Salchner]

Hi, 

is it possible to receive an RTMT alert after a phone unregisters? We only found the alert "NumberOfRegisteredPhonesDropped" - but this alert is only triggered once a percentage of phones is dropped and we do not see which phones dropped. We need Macaddress and IP-Address of the phone in the alert. 

Thanks for your help in advance. 

Best regards, 

Matthias

[Mohammed al Baqari · Accepted solution]

Hi,

When a phone unregister, a syslog message will be generated with the following syntax

Error Message

CCM_CALLMANAGER-CALLMANAGER-3-DeviceUnregistered : Device unregistered.  Device name. [String] Device MAC address [Optional]. [String] Device IP address [Optional]. [String] Protocol. [String] Device type. [Optional] [Enum]Device description [Optional]. [String] Reason Code [Optional]. [Enum]IPV6Address [Optional]. [String] IPAddressAttributes [Optional]. [Enum]IPV6AddressAttributes [Optional]. [Enum]

In RTMT under Alert Central > System you will see an Alert Named as "SyslogStringMatchFound". If you right-click and select Set Alert/Properties, you can define match string as "CCM_CALLMANAGER-CALLMANAGER-3-DeviceUnregistered".

Then enable Email settings for this alert and configure mail server. My understanding this will send the syslog message in the email once the match found.

*** Keep an eye on the performance

[Matthias Salchner]

Hi Mohammed, 

this was exactly what I am looking for. Thanks for your help :-). 

Best regards, 

Matthias

[tanan.ead1]

must Run The RTMT All the time Right ?

[vijendra Saravanamuthu]

Hi,

is this really working for you guys? I tried it didnt.  Also opened a case with cisco and they tried with no luck.  The tac eng says there is no way to send alert when a phone goes unregistered. There is NumberOfRegisteredPhonesDropped Alert but thats not what i am looking for.

thanks 

vijay

[cdevkota-sc]

I tired this but did not work for me. It would be great if anyone has this resolution. Thanks

[Maren Mahoney]

It is possible that your CallManager Service trace does not collect this level. In the string "CCM_CALLMANAGER-CALLMANAGER-3" the 3 refers to the logging level which is the "State Transition". If your logging level is set to "Error" (which is a 1) then your logs would not collect the unregister message. The default "our of the box" logging level for the CallManager Service for many years was "Error". So check the logging level for your service.

Maren

[cdevkota-sc]

Thanks. I found the article, this is bug due to the change in code which has changed the behavior done as part of the defect (CSCvb41393) is the way it was written.

CallManager Endpoint related alarms are not always written to AlternateSyslog : https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvb41393
SyslogStringMatchFound Missing Some Events in CUCM 12.5 : https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvv92412

This works fine once if we change string with “EndpointUnregistered”
Please rate me if this is helpful.
Thanks!