CUCM 7.x detailed logging

[i.va]

currently our cucm 7.1.3.30000-1 logs transient connections, e.g.:

Date: Jan 30 14:26:03

Machine Name: XXXX-CM1

Severity: Error

App ID: Cisco CallManager

Message: : 1093: Jan 30 13:26:03.562 UTC : %CCM_CALLMANAGER-CALLMANAGER-3-DeviceTransientConnection: Transient connection attempt. Connecting Port:44307 Device name [Optional].: Device IP address [Optional].:XXX.XXX.XXX.XXX Device type. [Optional]:255 Reason Code [Optional].:6 Protocol.:SCCP IPAddressAttributes [Optional].:0 Cluster ID:XXXX-CM Node ID:XXXX-CM1

I want to know exactly which device was affected. In this case only the IP is displayed (masked XXX.XXX.XXX.XXX), which is is not really helpful, since the phones are set to DHCP.

Fields such as "Device name" and "Device type" are blank. Is it possible to set the CUCM to log the device name as well? How can I find out which device was affected?

[Adam Thompson]

Since your phones get their IP addresses from DHCP, can't to look there to see what MAC address was assigned that IP?

In the past, I have utilized the arp cache tables of the switches to find where the IP address is located, then I would look at the mac-address table of that switch to find which port it is connected to. Then I would have to trace out the cables, or if I was organized look up what location that switch port was assigned.

HTH

Adam

[i.va]

Thank you both fo the feedback! I got a about 6 of these log messages while a problem was being reported by a user (phone restart during a call). I was actually hoping that the missing information could be "enabled" somewhere. That would be the most comfortable way to find te device name. ;-)

We are running our IP phone DHCP servers on the Cisco IOS Voice Gateways without an DHCP agent. Currently the IP assignments are not being logged. I will do a "debug ip dhcp server events" and set the logging level to debug. Or is there a better way to log the events? Once I have this set up I should be able to find the IP to MAC mapping in the future.

Ingo

[William Bell]

It isn't uncommon to not see a device name or other description in a transient connection message. Especially if the issue is a rogue device on the network that is not provisioned in CUCM. You could use RTMT to search for the device by IP address to see if it has registered or is known by any node in your cluster. This is possible using device search.

You may also want to look at the application log on subscriber nodes in the cluster to see if this host is generating unregistered messages there. Most likely those messages will have more identification info.

And, of course, Adam's approach (+5 A.)is a good way to hunt down the device, get the mac address, and possibly disable the port. You can also use "show cdp nei" when you find the port to get more information about the device.

If you find this transient message flooding your logs then it is very likely you have a device attemption to register that isn't configured. If you use Adam's method then you may be able to configure the device in CUCM. Alternately, you can temporarily enable auto-registration to get the device registered and stop the incessant noise (if it can be classified as such). NOTE: there isn't enough info available to guarantee this is what is happening, it is just a hypothesis at this point.

HTH.

Regards,

Bill