Specifying Options for Logging

Specifying Options for Logging

Collapse All

Using the Logging Tool includes specifying the appropriate options, including the following:

Specifying the Log Folder
Specifying Logging Options
Specifying Global Options
Specifying Advanced Options
Generating Log Files
Viewing and Analyzing Log Files

Specify the log folder, logging options, and global options prior to starting logging.

Logging Tool gets common defaults from the OCSLogger.config file. The defaults include the console window parameters to use for TraceFmt windows. When you close Logging Tool, configuration settings are saved to the OCSLogger.State.xml file. The settings are restored the next time you open Logging Tool.

Specifying the Log Folder

The log folder is the folder in which the log files are to be created and saved. The default is %windir%\Tracing.

To change the log folder

Open Office Communications Server 2007 Logging Tool, New Debug Session.
In Log File Folder, type the complete path and name of (or browse to) the folder to be used for logs.

Specifying Logging Options

Logging options includes components, logging level and flags to include in the log file contents. When it starts, Logging Tool detects any installed Office Communications Server components and then searches all their installation directories for executable files. It displays only those components that have an executable file on the computer. While tracing is running, you can select and cancel the use of specific components, levels, or flags and the trace sessions will update accordingly. Changes are applied immediately to the running trace for the selected component. You need to configure how logging is implemented for each of the following:

Level. For components that honor levels, you can specify an appropriate log level:
- Fatal errors
- Errors
- Warnings
- Information
- Verbose
- All
Each level is inclusive of the levels preceding it in the list. For example: if you select warnings, logging includes fatal errors, errors and warnings.
Flags. For each component, you can further specify logging flags. Only the flags available for a component are available in the list. By default, all components honor the TF_COMPONENT flag. Specific components can honor one or more of the following flags:
- TF_Connection: Connection related log entries. These logs include information on connections established to and from a particular component. This may also include significant network-level information (for components without the concept of a connection).
- TF_Security: All events/log entries related to security. For example for SipStack, these are security events such as domain validation failure, and client authentication/authorization failures.
- TF_Diag: Diagnostics events that can be used to diagnose or troubleshoot the component. For example: for SipStack, these are certificate failures, or DNS warnings/errors.
- TF_Protocol: Protocol Messages such as SIP and CCCP messages.
Selecting the All Flags check box enables generation of detailed traces (the former LcsTracer "Trace" option), which can then be used by Microsoft Customer Service and Support to further troubleshoot a problem.
You can change Flags for particular components after logging is enabled.

Components. The available components include the components that belong to the Office Communications Server role on which you are running Logging Tool. You can also enable or disable components after logging is started. Logging Tool collects logs for a component during the time it is enabled. Table 19 describes the logging components that can be selected.

Note:
Additional components with a prefix of MediaStack_ or MediaRelay are available for troubleshooting, but you should use these components only when asked to do so by Microsoft Customer Service and Support. Tier 1: Needs to be enabled for troubleshooting primary end-user scenarios around IM, presence, conferencing, and VoIP Tier 2: Can be enabled to gather advanced information, administration-only scenarios or infrequent scenarios

Note:

Additional components with a prefix of MediaStack_ or MediaRelay are available for troubleshooting, but you should use these components only when asked to do so by Microsoft Customer Service and Support.
Tier 1: Needs to be enabled for troubleshooting primary end-user scenarios around IM, presence, conferencing, and VoIP
Tier 2: Can be enabled to gather advanced information, administration-only scenarios or infrequent scenarios

Table 19. Logging Components

Component Name	Tier	Flags	Server Role	Description of Logged Contents
ABServer	2	TF_COMPONENT, All Flags	Front End Server	Enables logging for the Address Book service that provides global address list information from Active Directory to the Office Communicator client.
ABServerHttpHandler	2	TF_COMPONENT, All Flags	Web Components Server	Redirects client requests for address book files to the appropriate file path in the output location configured for the Address Book Server.
AcpMcu	1	TF_COMPONENT, All Flags	Front End Server (Telephony Conferencing Server)	Enables logging for the Telephony Conferencing Server that is responsible for ACP (audio conferencing provider) integration.
AggregationScript	2	TF_COMPONENT, TF_PROTOCOL, All Flags	Front End Server	Enables logging for the component that determines the aggregate user state and capabilities across all endpoints.
ApiModule	2	TF_COMPONENT, TF_PROTOCOL, All Flags	Front End Server, Access Edge Server	Enables logging for the component that exposes the Office Communications Server API to MSPL (Microsoft SIP Processing Language) and managed code applications.
ArchivingAgent	1	TF_COMPONENT, TF_DIAG, All Flags	Any Front End Server that you have enabled for archiving and is therefore running the Archiving Agent	Enables logging for the Archiving agent that runs on the Front End Server and writes SIP messages to Message Queuing.
AvMcu	1	TF_COMPONENT, TF_PROTOCOL, All Flags	A/V Conferencing Server	Enables logging for the A/V Conferencing Server.
ClientVersionFilter	2	TF_COMPONENT, TF_PROTOCOL, All Flags	Front End Server, Access Edge Server	Enables logging for the Client Version Filter, an application that can be used to allow/block access from clients that conform to certain versions.
Collaboration	1	TF_COMPONENT, TF_PROTOCOL, TF_CONNECTION, TF_SECURITY, TF_DIAG, All Flags	Communicator Web Access, Administrator Tools	Logs activities of the collaboration object layer pertaining to instant messaging.
CWAAuth	2	TF_COMPONENT, All Flags	Communicator Web Access	CWAAUTH logs activities of user authentication and authorization through Active Directory.
CWAPolicy	2	TF_COMPONENT, All Flags	Communicator Web Access	CWAPOLICY logs activities of CWA WMI settings accessed.
CWASearch	2	TF_COMPONENT, All Flags	Communicator Web Access	CWASEARCH logs activities of user search in Active Directory.
CwaServer	1	TF_COMPONENT, All Flags	Communicator Web Access	Logs all standard activities of the Communicator Web Access server.
CWASnapin	2	TF_COMPONENT, All Flags	Communicator Web Access	Logs administration activities within the Communicator Web Access Management Console.
CwaWebPages	1	TF_COMPONENT, All Flags	Communicator Web Access	Logs activities of ASP.Net access layer.
DataMCU	1	TF_COMPONENT, TF_PROTOCOL, TF_CONNECTION, TF_SECURITY, TF_DIAG, All Flags	Web Conferencing Server	Enables logging for the Web Conferencing Server.
DataProxy	1	TF_COMPONENT, All Flags	Web Conferencing Edge Server	Enables logging for the Web Conferencing Edge Server which provides the functionality for external users to participate in your internal conference meetings.
Dlx	2	TF_COMPONENT, All Flags	Web Components Serve r(IIS)	Enables logging for the Group (DL) Expansion service.
ExumRouting	2	TF_COMPONENT, All Flags	Front End Server	Enables logging for the component that routes calls to Exchange Unified Messaging for voice mail.
IIMFilter	2	TF_COMPONENT, TF_PROTOCOL, All Flags	Front End Server, Access Edge Server	Enables logging for the Intelligent Instant Messaging (IIM) application that filters incoming IM traffic using criteria specified by administrators.
ImMcu	1	TF_COMPONENT, All Flags	Front End Server (IM Conferencing Server)	Enables logging for the IM Conferencing Server, which enables group IM by relaying IM traffic among all participants.
InboundRouting	2	TF_COMPONENT, TF_DIAG, All Flags	Front End Server	Enables logging for the Inbound Routing component that handles incoming calls largely according to preferences that are specified by users on their Enterprise Voice clients.
LCCertHelper	2	TF_COMPONENT, All Flags	Any server running Office Communications Server Setup or the Office Communications Server administrative tools	Enables logging of the component used for certificates-related functionality in SipStack, MMC, WMI, and the Certificates Wizard.
LCDSUIEx	2	TF_COMPONENT, All Flags	Any server running the Office Communications Server administrative tools	Enables logging of the Find Users functionality in the Active Directory Users and Computers snap-in.
LcManagedTaskHandler	2	TF_COMPONENT, All Flags	Any server running Office Communications Server Setup or the Office Communications Server administrative tools	Enables logging of the component used by validation tasks that are invoked either from the Validation Wizard or LcsCmd.
LcsAdUcSnapin	2	TF_COMPONENT, All Flags	Any server running the Office Communications Server administrative tools	Enables logging of the extension for the Active Directory Users and Computers snap-in.
LcsCmd	2	TF_COMPONENT, All Flags	Any server running Office Communications Server Setup or the Office Communications Server administrative tools	Enables logging of the command-line tool that lets you perform all Office Communications Server setup tasks such as activation and pool creation.
LcsServer	2	TF_COMPONENT, All Flags	Front End Server, Access Edge Server	Enables logging of the RtcSrv service. On a Front End Server the RtcSrv service is the Office Communications Server Front End service. On an Access Edge Server, the RtcSrv service is the Office Communications Server Access Edge service.
LcsSnapin	2	TF_COMPONENT, All Flags	Any server running the Office Communications Server administrative tools	Enables logging of the component that provides the management console for SipStack.
LCSWizard	2	TF_COMPONENT, All Flags	Any server running Office Communications Server Setup or the Office Communications Server administrative tools	Component used by Setup and MMC Wizards such as the configuration wizards.
LcsWMI	2	TF_COMPONENT, All Flags	Any server running Office Communications Server Setup or the Office Communications Server administrative tools	Enables logging of the component that is the WMI provider for Office Communications Server.
LcsWMIUserServices	2	TF_COMPONENT, All Flags	Any server running Office Communications Server Setup or the Office Communications Server administrative tools	Enables logging of the component that provides the WMI consumer for UserServices.
LcTaskHandler	2	TF_COMPONENT, All Flags	Any server running Office Communications Server Setup or the Office Communications Server administrative tools	Enables logging of the component used by LcsCmd, Setup wizards and MMC wizards.
LcWmiConsumerManaged	2	TF_COMPONENT, All Flags	Front End Server (IM Conferencing Server, Telephony Conferencing Server), Web Conferencing Server, A/V Conferencing Server, A/V Edge Server	Enables logging of the WMI consumer for services built using managed code.
LDM	2	TF_COMPONENT, All Flags	Web Conferencing Server	Enables logging of Web Conferencing Server Connection Management which manages TLS/MTLS connections from clients and other servers such as the Web Conferencing Edge Server.
MCUFactory	2	TF_COMPONENT, All Flags	Front End Server (IM Conferencing Server, Telephony Conferencing Server), A/V Conferencing Server, Web Conferencing Server	Enables logging for the Focus Factory which determines which conferencing server is available to service the conference scheduling request.
MCUInfra	1	TF_COMPONENT, TF_CONNECTION, All Flags	Front End Server (IM Conferencing Server, Telephony Conferencing Server), A/V Conferencing Server, Web Conferencing Server	Enables logging for the component that provides communication between the Focus and the conferencing servers.
MediationServer	1	TF_COMPONENT, TF_PROTOCOL, TF_CONNECTION, All Flags	Mediation Server	Enables logging for the Mediation Server that translates between the Office Communications Servers and the media gateway.
MRAS	1	TF_COMPONENT, TF_CONNECTION, TF_DIAG, All Flags	A/V Edge Server	Enables logging for the Office Communications Server Audio/Video Authentication service, which provides authentication services for the A/V Edge Server, the component that provides the functionality to share audio and video with external users.
OutboundRouting	2	TF_COMPONENT, All Flags	Front End Server	Enables logging for the Outbound Routing component that routes calls to PBX or PSTN destinations, applies call authorization rules to callers, and determines the optimal media gateway for routing each call.
QueueDLL	2	TF_COMPONENT, All Flags	Front End Server, Access Edge Server	Enables logging for the component that facilitates inter-process communication between the server and applications.
RtcHost	2	TF_COMPONENT, All Flags	Front End Server, Access Edge Server	Enables logging for the component that is the host for all server API applications.
RTCSPL	2	TF_COMPONENT, All Flags	Front End Server	Enables logging for the component that is the host for running MSPL (Microsoft SIP Processing Language) script based applications.
S4	1	TF_COMPONENT, TF_PROTOCOL All Flags	Communicator Web Access	Logs all SIP messages sent to/from the Communicator Web Access server.
SIPStack	1	TF_COMPONENT, TF_PROTOCOL, TF_CONNECTION, TF_SECURITY, TF_DIAG, All Flags	Front End Server, Access Edge Server	Enables logging for the SipStack component that handles TLS/MTLS connection management and SIP call flows.
TranslationApplication	2	TF_COMPONENT, All Flags	Front End Server	Enables logging for the Translation Service which is the server component that is responsible for translating a dialed number into E.164 format based on the normalization rules defined by the administrator.
UserServices	1	TF_COMPONENT, TF_PROTOCOL, All Flags	Front End Server	Enables logging for the UserServices component that provides closely integrated IM, presence, and conferencing features built on top of the SIP proxy. Includes the Focus and Focus Factory.

To specify logging options

Open Office Communications Server 2007 Logging Tool, New Debug Session.
In Logging Options, select the components, level, and flags to be used for logging.

Specifying Global Options

Global options includes log file options and real-time options:

Log File Options are used to manage the size of the log file and how logs are maintained:
- Maximum size. This is the maximum size for all individual log files.
- Circular logging. After the log file reaches the maximum file size, Logging Tool resumes writing entries at the beginning of the file.
- Sequential logging. After the log file reaches the maximum file size, Logging Tool stops logging operations.
- New file. Use this option to specify that logging is to roll over the log file and start over when the file reaches the maximum size. This generates a new log file.
Real Time Options are used to specify how logging performs in real-time monitoring and filtering.
- Real Time Monitoring. Choosing this option enables you to see traces in the console window as they accumulate. You can also use the Display only, no log file option with real-time monitoring, which enables you to see traces in the console window, but does not generate a log file.
- Filter Options. You can use the Enable Filters option to enable filtering on log files so that only traffic to and from the addresses you specify are displayed. You can specify URI addresses, which will include only traffic to and from the specified SIP URI in the log file, and FQDN addresses, which will include only traffic to and from the specified computer FQDN in the log file. Trace filtering for URI/FQDN is available only for the SipStack and UserServices components; for all other components, the traces cannot be filtered at run time.

Note:
Although it can be useful to continue logging for a day or more to help troubleshoot an intermittent problem, we recommend that you not run real-time monitoring for more than an hour at a time. We also recommend that you not use OCS Logger for ongoing monitoring. Turning on logging for an extended time for servers in a production environment can affect server performance. For monitoring and troubleshooting, use the Microsoft Office Communications Server 2007 Management Pack for MOM 2005 or the Office Communications Server 2007 troubleshooting tools. For more information about Office Communications Server troubleshooting tools, see the Microsoft Office Communications Server 2007 Technical Reference.

Note:

Although it can be useful to continue logging for a day or more to help troubleshoot an intermittent problem, we recommend that you not run real-time monitoring for more than an hour at a time.
We also recommend that you not use OCS Logger for ongoing monitoring. Turning on logging for an extended time for servers in a production environment can affect server performance.
For monitoring and troubleshooting, use the Microsoft Office Communications Server 2007 Management Pack for MOM 2005 or the Office Communications Server 2007 troubleshooting tools. For more information about Office Communications Server troubleshooting tools, see the Microsoft Office Communications Server 2007 Technical Reference.

To specify global options

Open Office Communications Server 2007 Logging Tool, New Debug Session.
Under Global Options, do the following:
- Under Log File, in Type, click the type of log file you want to use.
- To enable real-time monitoring, select the Real Time Monitoring check box and, if appropriate, the Display only, no log file check box.
- To configure filters for real-time monitoring, under Filter Options, select the Enable Filters check box, and then specify URI and FQDN addresses to and from which you want to enable filters.

Specifying Advanced Options

Advanced options are specified using the Advanced Options menu. With the exception of the Display Times in UTC option for formatting, you should not change any of the Advanced Options settings unless advised to do so by Microsoft Customer Service and Support. Advanced Options include the following:

Formatting options are used to specify advanced options for controlling log formats. Formatting does not impact how you capture logs, just how you view them on your computer. Formatting options include the following:
- Log file prefix. Specifies the prefix to be used to format log files for components that support levels. We recommend that you do not configure this option unless advised to do so by Microsoft Customer Service and Support.
- Real time prefix. Specifies the prefix used to format log files for the real-time monitoring window. We recommend that you do not configure this option unless advised to do so by Microsoft Customer Service and Support.
- Display times in UTC. By default, log timestamps are displayed in UTC (also known as Greenwich Mean Time or GMT). To display timestamps in the local server time, clear this check-box.
- Format file search path. Logging Tool has all the information necessary to capture log information for log levels and flags previously described. If you have access to trace information files that contain more tracing information, you can use this setting to specify the path to those trace information files. We recommend that you do not configure this option unless advised to do so by Microsoft Customer Service and Support.

The following variables are supported for each prefix:

%!COMP! for the component name.
%!LEVEL! for the level name.
%!FLAGS! for the flag name.
%!FUNC! for the name of the function or method that generated the log record.
%2 for the source file and line number that generated the record.
%3 for the ID of the thread that generated the record.
%4 for the time the event record was generated.
%5 for the cumulative processor time.
%7 for the local sequence number for the component.
%8 for the ID of the process that generated the record.
%9 for the number of the CPU that generated the record.
%1 and %6 are not allowed.
%3, %7, %8, and %9 are integers that should be followed by a printf-style numeric format specifier enclosed in exclamation marks. For example %3!04X! displays the thread ID as a four-digit hexadecimal number.
%2, %4, and %5 are always strings, so they can only be followed by a string format specifier (!s!). Additionally, the real time prefix can contain the following escape characters: \n, \t, \s, or \\ that will be replaced with a new line sequence, a tab, a space and a single backslash, respectively.
Buffering options are advanced options for modifying the default buffer values for real-time monitoring. We recommend that you do not adjust these values unless advised to do so by Microsoft Customer Service and Support.
Clock Resolution options are values that control resolution for the time stamp. We recommend that you do not adjust these values unless advised to do so by Microsoft Customer Service and Support.
Additional Components options are values that we recommend that you do not adjust unless advised to do so by Microsoft Customer Service and Support.

To specify advanced options

Open Office Communications Server 2007 Logging Tool, New Debug Session.
Click Advanced Options.
Click one of the following tabs:
- Formatting
- Buffering
- Clock Resolution
- Additional Components

Specify the appropriate options.

Important:
We recommend that you not adjust the Buffering, Clock Resolution, or Additional Components options, or the Format file search path option of Formatting unless advised to do so by Microsoft Customer Service and Support.

Generating Log Files

After specifying logging options and global options, and any advanced option (if appropriate), you can start logging and create the log file.

To generate a log file

In Office Communications Server 2007 Logging Tool, New Debug Session, click Options.
Verify that the options you want to use are configured.
When you are ready to start logging click Start Logging.
Reproduce the issue you want to debug, and then click Stop Logging. The .ETL log file is written to the Log File Folder that you specified during logging configuration.

Viewing and Analyzing Log Files

The log file that is generated by Logging Tool can be viewed by using a text editor. Additionally, protocol messages in the log file can be analyzed by using the Snooper tool, if the Microsoft Office Server 2007 Resource Kit Tools is installed on the computer. The log file that Logging Tool generates can also be sent to Microsoft Customer Service and Support for analysis.

To view log files in a text editor

In Logging Tool, when you have ended the debug session, click View Log Files to view the log files using a text editor. Opening a log file converts the log file contents to text. Each component you select opens in a separate instance of the editor you have associated with the .txt extension (which is by default Microsoft Notepad.exe).

Using the Package feature requires that cabarc.exe be installed on the computer. This file is available as part of the Windows Support Tools. To install Windows Support Tools, do one of the following:
- If you are using OCS Logger on a computer running Windows Server 2003, you can install Windows Support Tools by running the suptools.msi in the \Support\Tools folder of the Windows Server 2003 installation media.
- If you are using OCS Logger on a computer running Windows XP, you can download the Windows XP Service Pack 2 Support Tools at http://r.office.microsoft.com/r/rlidOCS?clid=1033&p1=XPSupTool.
You can also obtain the required file by installing the Microsoft Cabinet Software Development Kit, which is available for download at http://r.office.microsoft.com/r/rlidOCS?clid=1033&p1=CabSDK. However, this download does not include all of the tools available in Widows Support Tool (such as TraceLog.exe).

To view and analyze protocol messages

In Logging Tool, when you have ended the debug session, click Analyze Log Files to view the log files using the Snooper tool. You can analyze protocol logs for the following components:

Office Communications Server SipStack (SIP)
Office Communications Server S4 (SIP)
Office Communications Server Conferencing signaling traffic (C3P), including MCU Infra C3P and Focus C3P
Office Communications Server Web conferencing traffic (PSOM)
Office Communications Server Unified Communications Client Platform client (UCCP)
Error reports from the archiving database

To view protocol traffic, the TF_Protocol flag must have been selected when you captured the log.

Note:
To view and analyze protocol messages, you must install Microsoft Office Communications Server 2007 Resource Kit Tools, which includes the Snooper tool that provides this functionality. The Resource Kit includes documentation for using the tool.