Showing results for 
Search instead for 
Did you mean: 
Tyler Wilkin
Cisco Employee
Cisco Employee

This article was written because I thought the official documentation at the time was not a great step-by-step resource to send someone you needed to collect SIP traces. The official documentation has since been updated and I recommend you check it out:


This document will focus on collecting traces for CUCM 8.6.2. It should be mostly the same for any recent CUCM release. CUCM traces give us the signalling going across the CUCM as well as give extremely detailed logs of what CUCM is doing when processing calls. It's important to note that traces must be turned on before the problem call/test call is made. If a problem happened once and CUCM traces were not turned on, we cannot go back and get logs.


Configure Traces

First, go to CUCM and log into Unified CM Serviceability.




Navigate to Trace -> Configuration




Select the server processing the calls in question. The parameters we're interested in are under CM Services -> Cisco CallManager (Active)





Check Trace On and set the Debug Trace Level to Detailed. Check all the traces relevant to the problem we are experiencing. The most important to have checked is probably Enable SIP Call Processing Trace. Your TAC engineer might ask for other specific traces depending on the issue you're having.





Recreate the Issue


With the SIP traces enabled, recreate the issue. Note the timestamps when you start and stop the recreate so we can find the problem easily in the traces.


Collect the Traces


CUCM traces cannot be downloaded from the GUI. They are collected with the Real-Time Monitoring Tool (RTMT). You can download this from Unified CM Administration -> Application -> Plugins. You might already have a version of RTMT installed, but it's very particular about which version it is compared to CUCM's version. If you find that your RTMT install doesn't work, try downloading and installing the version on CUCM itself.






Click Find then scroll down to the bottom and download Cisco Unified Real-Time Monitoring Tool - Windows





Install RTMT anywhere and launch it. It will prompt you to enter your CUCM IP address. Click Accept if a certificate error appears. It will then prompt you to log-in. The credentials should be your Unified CM Administration credentials.


Click away the Select Configuration window by selecting Cancel, then go to Trace & Log Central -> Collect Files




In the window that appears check Cisco CallManager under All Servers. In certain cases your engineer may also want other services such as Cisco Tftp. Click Next to bring up the next window.






Unless your TAC engineer specifies, you can just click Next on the System Services/Applications window that appears without selecting anything.


On the next screen choose the range when you recreated the problem. Start 5 minutes before and end 5 minutes late to ensure we capture everything in the downloaded logs.




Below this choose the Download File Directory (this is where the files will be downloaded to) and select Zip Files. When you click Finish, the logs will begin downloading. Depending on how many traces were selected, the activity on the CUCM, and the time range, this could take a very long time. Wait until you see completed downloading:




You should have 2 files per server (so 4 zip files total if you have a pub and sub). Upload these files to your TAC service request and please note the timestamp of the issue along with the directory numbers and IPs of the devices in question.

Michael Wall
Cisco Employee
Cisco Employee

You can upload the files to your TAC case here:

I find browsing to the file works better than drag and drop.


Hi ,

I'm facing a issue with cisco IP phones are restarting randomly on the network . Phones that are working properly also facing the same issue on some time and issue facing phone also works .

We identified that the user logout and try logging in with another user or same user then the phone restarts more than 2 times then logging in and getting the IP from global IPAM server .At the time we checked switch logs and it's aged out for LLDP neighborship and learning neighbor again.

We captured wire shark with SPAN enabled on IP phone port.

Can anybody faced this issue before,please advise to solve this .

what are all I need to check . Quick help would be appreciated.

Thanks in advance.


Great article !

I think you should post an article about reading and understanding the CUCM traces.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Quick Links