Export (0) Print
Expand All
1 out of 1 rated this helpful - Rate this topic

FSOCS reporting and statistics

 

Applies to: Forefront Security for Office Communications Server

Topic Last Modified: 2008-09-18

Microsoft Forefront Security for Office Communications Server (FSOCS) provides various mechanisms in order to help administrators analyze the state and performance of the FSOCS services through the Forefront Server Security Administrator. For more information, see FSOCS Forefront Server Security Administrator.

The Incidents database (Incidents.mdb) contains all virus and filter detections for an IM server, regardless of whether they were caught by the scan job or a filter. The Incidents database is configured as a system data source name (DSN), called Forefront Incidents. This database can be viewed and manipulated by using third-party tools.

To view the Incidents database
  • In the Shuttle Navigator, click REPORT, and then click the Incidents icon. The Quarantine pane opens.

This is the information that FSOCS reports for each incident:

 

Item Description

Time

The date and time of the incident.

State

The action taken by FSOCS.

Folder

Not applicable.

File

The name of the virus or name of the file that matched a file filter or content filter.

Incident

The type and name of the incident detected.

Sender Address

The e-mail address of the person who sent the infected or filtered message.

Recipient Addresses

The e-mail addresses of the recipients of the infected or filtered message.

Incidents can also be written to a text file called VirusLog.txt file, located in the Microsoft FSOCS installation path. To enable this feature, in General Options, select the Enable Forefront Virus Log check box (it is disabled by default).

The following is a sample entry from the VirusLog.txt file:

Thu. Feb 28 14:12:51 2008 (3184), “Information: IM scan found virus:

Folder: Inbound

Message: Hello

File: Eicar.com

Incident: VIRUS=EICAR-STANDARD_AV_TEST_FILE

State: Cleaned"

The following table describes the various incidents FSOCS reports. Several of the reported incidents are controlled through settings in General Options.

 

Reported incident General Options setting Description

CorruptedCompressedFile

Delete Corrupted Compressed Files

FSOCS has deleted a corrupted compressed file.

CorruptedCompressedUuencodeFile

Delete Corrupted Uuencode Files

FSOCS has deleted a corrupted compressed Uuencode file

EncryptedCompressedFile

Delete Encrypted Compressed Files

FSOCS has deleted an encrypted compressed file.

EngineLoopingError

Not applicable

FSOCS has deleted a file causing a scan engine to be caught in a read/write loop while scanning or attempting to clean a file.

ExceedinglyInfected

Maximum Container File Infections

FSOCS has deleted a container file because it exceeded the maximum number of infections, as set in the Max Container File Infections setting in General Options.

ExceedinglyNested

Maximum Nested Compressed Files

FSOCS has deleted a container file because it exceeded the maximum nested depth, as set in the Max Nested Compressed Files setting in General Options.

ExceedinglyNested

Maximum Nested Attachments

FSOCS has deleted a file because it exceeded the maximum nested attachment limit, as set in the Max Nested Attachments setting in General Options. The default is 30 attachments. For more information, see "MaxNestedAttachments" in FSOCS registry keys.

LargeInfectedContainerFile

Maximum Container File Size

FSOCS has deleted a file because it exceeded the maximum container size that it attempts to clean or repair. The default is 26 megabytes, but you may change the value with the Max Container File Size setting in General Options.

ScanTimeExceeded

Max Container Scan Time (msec) - IM

FSOCS has deleted a container file because it exceeded the maximum scan time. The default value, in milliseconds, is 120000 msec (two minutes).

UnReadableCompressedFile

Not applicable

FSOCS has deleted a compressed file that it could not read.

UnWriteableCompressedFile

Not applicable

FSOCS has deleted a compressed file to which it cannot write (for example, during a cleaning operation).

FSOCS tracks and maintains several kinds of statistics for messages and file transfers. These statistics are also available as performance counters. For more information about performance counters, see Performance.

These are the statistics that FSOCS keeps for instant messages:

  • Instant Messages Scanned—The number of messages scanned by FSOCS since the last restart of the services.
  • Instant Messages Detected—The number of messages scanned that contained a virus or matched a filter since the last restart of the services.
  • Instant Messages Blocked—The number of messages blocked by FSOCS, because of a virus detection or filter match, since the last restart of the services.
  • Total Instant Messages Scanned—The number of messages scanned by FSOCS since the product was installed.
  • Total Instant Messages Detected—The number of messages scanned that contained a virus or matched a filter since the product was installed.
  • Total Instant Messages Blocked—The number of messages blocked by FSOCS, because of a virus detection or filter match, since the product was installed.

These are the statistics that FSOCS keeps for file transfers:

  • File Transfers Scanned—The number of file transfers scanned by FSOCS since the last restart of the services.
  • File Transfers Detected—The number of file transfers scanned that contained a virus or matched a filter since the last restart of the services.
  • File Transfers Cleaned—The number of files cleaned since the last restart of the services.
  • File Transfers Removed—The number of files removed by FSOCS due to a virus detection or filter match since the last restart of the services.
  • File Transfers Blocked—The number of file transfers blocked by FSOCS, because of a virus detection or filter match, since the last restart of the services.
  • Total File Transfers Scanned—The number of file transfers scanned by FSOCS since the product was installed.
  • Total File Transfers Detected—The number of file transfers scanned that contained a virus or matched a filter since the product was installed.
  • Total File Transfers Cleaned—The number of files cleaned since the product was installed.
  • Total File Transfers Removed—The number of files removed by FSOCS due to a virus detection or filter match since the product was installed.
  • Total File Transfers Blocked—The number of file transfers blocked by FSOCS, because of a virus detection or filter match, since the product was installed.

In addition to these statistics, there are four additional rate counters that can only be viewed from perfmon. For more information about performance counters, see Performance. The additional counters are:

  • File Transfers Scanned Rate—The average number of file transfers scanned by FSOCS within a one-second time interval.
  • File Transfers Detected Rate—The average number of file transfers containing a virus or matching a file filter detected by FSOCS within a one-second time interval.
  • File Transfers Cleaned Rate—The average number of file transfers cleaned by FSOCS within a one-second time interval.
  • File Transfers Removed Rate—The average number of file transfers removed by FSOCS within a one-second time interval.

You can reset all statistics for the IM Scan Job.

To reset all statistics for the IM Scan Job
  • In the Incidents pane, in the Statistics section, click the x next to the scan job's name. When you are asked to confirm the reset, click Yes to reset all the statistics for the IM Scan Job.

You can save the report and statistics in a text format.

To save the report and the statistics in a text format
  1. On the Incidents pane, click the Export button.

  2. A Windows Explorer window opens. Use it to navigate to the location at which you want to save the report.

  3. Enter a name for the exported report and statistics file. The default is incidents.txt.

  4. Click Save.

FSOCS, by default, creates a copy of every detected file in its original form (that is, before a Clean, Delete, or Skip action occurs). These files are stored in an encoded format within the designated installation folder, in the Forefront Data Folder, in the Quarantine subfolder.

To view the Incidents database, in the Shuttle Navigator, click REPORT, and then click the Quarantine icon. The Quarantine pane opens.

  • the actual file name of the detected attachment
  • the name of the infecting virus or the file filter name
  • other bookkeeping information
  • The Quarantine database is configured as a system DSN with the name Forefront Quarantine. This database can be viewed and manipulated by using third-party tools.

An administrator can access the Quarantine pane in order to delete or extract quarantined items.

To view the Quarantine log
  • In the Shuttle Navigator, click REPORT, and then click the Quarantine icon. The Quarantine pane opens.

This is the information that FSOCS reports for each quarantined item:

 

Item

Description

Date

The date the file was quarantined.

File

The name of the file that was quarantined.

Incident

The type of incident that triggered the quarantine (such as virus or filter match).

Sender Address

The e-mail address of the person who sent the infected or filtered message.

Recipient Addresses

The e-mail addresses of the recipients of the infected or filtered message.

You can save quarantined items as separate files.

To save quarantined items as separate files
  1. On the Quarantine pane, select one or more files to be saved, and then click the Save As button. If you select multiple items, each is saved as a separate file.

  2. A Windows Explorer window opens. Use it to navigate to the location where you want to save the quarantined files.

  3. In Windows Explorer, in the File name box, you may enter a different name for the file before saving it. By default, the original name of the file appears in the box.

  4. Click Save. The item is decoded before being saved.

  5. If you selected more than one file, the next one now appears in Windows Explorer. Repeat steps 2 through 4.

The Deliver button on the Quarantine pane enables administrators to deliver quarantined messages to the intended recipients or any other designated recipients.

To deliver quarantined messages
  1. On the Quarantine pane, select one or more files to be delivered, and then click the Deliver button.

  2. In the Confirm Delivery dialog box, in the Delivery Action section, select one of the following:

    • Original Recipients—The files will be sent to the their intended recipients, and the recipients fields are disabled.
    • Above Recipients—The selected files will be delivered to the named recipients. The recipients fields are enabled, and the administrator can change them.
    • Original and Above Recipients—The selected files will be delivered to both the original recipients and any additional ones entered. The recipients fields are enabled, and the administrator can change them.
  3. When you are finished editing the recipients, click OK. The selected files are sent to the specified recipients.

If a single file is selected for delivery, the original recipients populate the To field. If multiple files are selected, the recipients fields are initially empty.

When quarantined messages are delivered to the user's mailbox, the original message is included as an attachment. When the user opens the attachment, the original message launches within Microsoft Office Outlook® as a separate message.

When a message file is delivered from the Quarantine database, a text file named DeliverLog.txt is created and saved in the folder where FSOCS is installed. This file provides a log of messages and attachments that have been delivered from quarantine.

Files that were quarantined by the virus scanner or the file filter can be forwarded.

noteNote:
When files are forwarded from quarantine, they are sent as e-mails to your regular mail stream. If your mail servers are protected by Forefront Security for Exchange Server (FSE) and FSE has filter rules that are similar to the ones you set up for FSOCS, then the file will be quarantined by FSE.

FSOCS includes a console tool, ExtractFiles, that enables you to extract all, or a subset, of the quarantined files to a specified directory.

This is the syntax of ExtractFiles:

extractfiles <path> <type>

where path is the absolute path of the folder in which to save the extracted quarantined files, and type is the type of quarantined files to extract. This can be the specific name of a virus, a specific extension, or all quarantined files. For example:

  • Jerusalem.Standard—Extracts files that were infected with the virus named Jerusalem.Standard.
  • *.doc—Extracts quarantined files having a .doc extension.
  • *.*—Extracts all quarantined files.

Examples:

extractfiles C:\temp\quarantine Jerusalem.Standard

extractfiles C:\extract\ *.doc

There are several other tasks you can perform with the Incidents or Quarantine databases. You can clear the databases, export database items, purge database items, filter database views, move the databases, and change the database compaction time.

Over time, you might find that your Incidents and Quarantine databases are becoming very large. Each database (Incidents.mdb and Quarantine.mdb) has a 2 GB limit. When a database is larger than 1.5 GB after being compacted, a notification is sent to all those having a notification role of Virus Administrators, warning that the database is nearing its limit. An administrator can then clear the database in order to ensure that future incidents and quarantined items will be saved.

The following is the subject line of the message:

Microsoft Forefront Security for Office Communications Server Database Warning

The following is the body of the message:

The Microsoft FSOCS <<database name>> database is greater than 1.5 GB (with a maximum size of 2 GB). Its current size is x GB.

If this database grows to 2 GB, updates to the <<database name>> will not occur. Please see the user guide for information about database maintenance.

If for some reason the notification cannot be sent, the failure is ignored and is noted in the program log. One attempt to send the message is made during each compaction cycle for the specific database.

The Incidents database can be cleared when it becomes too large.

To clear the Incidents database
  1. In the Shuttle Navigator, in the REPORT section, in the Incidents pane, click Clear Log. You are asked to confirm your decision before all the items are cleared from the Incidents pane.

  2. In the Shuttle Navigator, in the OPERATE section, select Run Job. Select IM Scan Job, and then click Clear Log. Once again, you are asked to confirm your decision before all the items are cleared from the job in the Incidents pane.

    You must individually clear all scan jobs in order to have all items flagged for deletion from the database.

After you have cleared the entries in both places, they no longer appear in the panes. However, they are actually deleted from the Incidents.mdb database only when it is compacted, which automatically occurs every day at 02:00 (2:00 in the morning).

You can also delete a subset of the results by selecting one or more entries (using the SHIFT and CTRL keys), and then pressing the DELETE key in order to remove them from both locations, as indicated above.

noteNote:
If a large number of entries is selected, the deletion process can take a long time. In this case, you are asked to confirm the deletion request.

The Quarantine database can be cleared when it becomes too large.

To clear the Quarantine database
  • In the Shuttle Navigator, in the REPORT section, in the Quarantine pane, click Clear Log. This clears all the items from the Quarantine pane. You will be asked to confirm your decision.

    noteNote:
    You can also delete a subset of the results by selecting one or more entries (using the SHIFT and CTRL keys), and then pressing the DELETE key to remove them from the Quarantine listing.

After you have cleared the entries, they no longer appear in the pane. However, they are actually deleted from the Quarantine.mdb database only when it is compacted, which automatically occurs every day at 02:00 (2:00 in the morning).

noteNote:
If a large number of entries is selected, the deletion process can take a long time. In this case, you are asked to confirm the deletion request.

You can save a list of all the Incidents or Quarantine database items into a text file. This is the same list of items that appears in the Incidents or the Quarantine pane of the Forefront Server Security Administrator.

To save a list of all the results from the Incidents or Quarantine databases as a text file
  1. In either the Incidents or Quarantine panes, click Export.

  2. In the Save dialog box, select a location for the Incidents.txt or Quarantine.txt file, and then click Save.

In addition to the Export button, the Quarantine pane has a Save As button, used to detach and decode a selected file to disk. You can select multiple items from the Quarantine list. Each is saved as a separate file. For more information about saving files, see Saving quarantine database items.

You can instruct FSOCS to remove items from the databases after they are a certain number of days old. If the purge function is enabled for a database, all files older than the specified number of days are flagged for removal from that database.

To purge database items after a certain number of days
  1. In the Shuttle Navigator, in the REPORT section, on either the Incidents or the Quarantine pane, select the Purge check box. This causes the Days field to become available.

    noteNote:
    Each database can have a separate purge value (or none at all).
  2. In the Days field, indicate the number of days after which items will be purged. All items older than that number of days will be deleted from the database. The default is 30 days.

  3. Click Save. Setting or changing the purge value takes effect only after being saved.

To suspend purging, clear the Purge check box. The value in the Days field will remain, but no purging will take place until Purge is selected again.

You can filter the Incidents or Quarantine views in order to see only certain items. The filter has no effect on the database itself, just on which records are displayed.

To filter the database view
  1. In the Shuttle Navigator, in the REPORT section, on either the Incidents or Quarantine pane, select the Filtering check box.

  2. In the Field drop-down, select the items you want to see. Each choice in Field corresponds to one of the columns in the display. (For example, you can show only those Incidents whose State is "Purged".)

    If you select Time or Date, you get entry fields for beginning date and time, and ending date and time.

    If you select anything other than Time (on the Incidents pane) or Date (on the Quarantine pane), the Value field appears. Enter a string in the Value field. Wildcard characters can be used. They are those used by the Microsoft Jet database OLE DB driver. The following are the wildcard characters:

    • _ (underscore)—Matches any single character. (The * and ? characters, which are common wildcard characters, are literals in this instance.)
    • [ ]—Denotes a set or a range. Matches any single character within the specified set (for example, [abcdef]) or range (for example, [a-f]).
    • [!]—Denotes a negative set or range. Matches any single character not within the specified set (for example, [!abcdef]) or range (for example, [!a-f]).
  3. Click Save. The only items you now see are those that match your parameters.

  4. To see all the items again, remove the filter by clearing the Filtering check box, and then click Save.

You can move the Quarantine and Incidents databases. However, for FSOCS to function properly, you must move both databases, as well as all related databases and support files.

To move the databases and all related files
  1. Create a new folder in a new location (for example: C:\Moved Databases).

  2. To set the permissions for the new folder, do the following:

    1. Right-click the new folder, and then click Properties.
    2. On the Properties dialog box, on the Security tab, add Network Service with Full Control privileges.
    3. Enable all permissions for Administrators and System.
  3. Stop Office Communications Server Front-End Service (RtcSrv).

  4. Copy the entire contents of the Data folder, including the subfolders, from
    the following location:
    Microsoft Forefront Security\Office Communications Server
    into the folder created in step 1. (This results in a folder called, for example, C:\Moved Databases\Data.)

  5. Change the path in the DatabasePath registry key in order to point to the new Data folder location:

    For 32-bit systems:

    HKLM\Software\Microsoft\Forefront Server Security\Office Communications Server\DatabasePath

    For 64-bit systems:

    HKLM\Software\Wow6432Node\Microsoft\Forefront Server Security\Office Communications Server\DatabasePath

  6. Restart the Office Communications Server Front-End Service (RtcSrv).

Typically, FSOCS runs daily database-management functions on the Incident.mdb and Quarantine.mdb databases. The CompactIncidentDB function and the CompactQuarantineDB function are run to delete old database records and to delete stale quarantine items.

By default, these functions are run at 02:00 local time. However, you may want to compact the databases at a different time. To run the compaction functions at a different time, you must add a registry entry.

To change the database compaction time
  1. Click Start, click Run, type regedit, and then click OK.

  2. In the Registry Editor, expand the following registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Forefront Server Security\Office Communications Server

  3. On the Edit menu, point to New, and then click String Value.

  4. Type CompactDatabaseTime, and then press ENTER.

  5. Right-click CompactDatabaseTime, and then click Modify.

  6. In the Value data box, type a new value, for example 21:00, and then click OK.

    noteNote:
    Enter the time value using the 24-hour (hh:mm) format. The value should be based on the local time during which you want the compaction functions to run.
  7. Exit the Registry Editor.

  8. Click Start, point to Settings, and then click Control Panel.

  9. Double-click Administrative Tools, and then click Services.

  10. Right-click FSCController, and then click Restart.

  11. Close Services and Control Panel.

FSOCS stores virus detections, stop codes, system information, and other general application events in the Windows application log. Use Windows Event Viewer to access the log.

Additionally, these events are stored in ProgramLog.txt located in the Data subdirectory of the following location:
<Drive>:Program Files\Microsoft Forefront Security\Office Communications Server

All FSOCS statistics can be displayed by using the Performance snap-in (Perfmon.exe) provided by Windows and usually found in Administrative Tools. The performance object is called Microsoft Forefront Server Security.

All of the items listed in Statistics are performance counters that can be displayed in Perfmon under the "Microsoft Forefront Server Security" category.

In addition, there are four categories of performance counters in the Microsoft Forefront Server Security performance object:

  • Microsoft FSOCS Categorizer
  • Microsoft FSOCS Health
  • Microsoft FSOCS Scan Filter
  • Microsoft FSOCS SIP Traffic

Microsoft FSOCS Categorizer statistics

 

Performance counter

Definition

Microsoft FSOCS Categorizer\FileTransferMessagesAccepts

The total number of file transfer ACCEPT requests processed by the RTC Proxy component.

Microsoft FSOCS Categorizer\FileTransferMessagesAcceptsPerSecond

The number of file transfer ACCEPT requests handled each second by the RTC Proxy component.

Microsoft FSOCS Categorizer\FileTransferMessagesCancels

The total number of file transfer CANCEL requests processed by the RTC Proxy component.

Microsoft FSOCS Categorizer\FileTransferMessagesCancelsPerSecond

The number of file transfer CANCEL requests handled each second by the RTC Proxy component.

Microsoft FSOCS Categorizer\FileTransferMessagesInvites

The total number of file transfer INVITE requests processed by the RTC Proxy component.

Microsoft FSOCS Categorizer\FileTransferMessagesInvitesPerSecond

The number of file transfer INVITE requests handled each second by the RTC Proxy component.

Microsoft FSOCS Categorizer\FileTransferMessagesTotal

The total number of file transfer requests processed by the RTC Proxy component.

Microsoft FSOCS Categorizer\FileTransferMessagesTotalPerSecond

The number of file transfer requests handled each second by the RTC Proxy component.

Microsoft FSOCS Categorizer\IMConversationRtfFormats

The total number of instant message conversations with a MIME type of "text/rtf" processed by the RTC Proxy component.

Microsoft FSOCS Categorizer\IMConversationRtfFormatsPerSecond

The number of instant message conversations with a MIME type of "text/rtf" processed each second by the RTC Proxy component.

Microsoft FSOCS Categorizer\IMConversationAlternativeFormats

The total number of instant message conversations with a MIME type of "multipart/alternative" processed by the RTC Proxy component.

Microsoft FSOCS Categorizer\IMConversationAlternativeFormatsPerSecond

The number of instant message conversations with a MIME type of "multipart/alternative" processed each second by the RTC Proxy component.

Microsoft FSOCS Categorizer\IMConversationTxtFormats

The total number of instant message conversations with a MIME type of "text/plain" processed by the RTC Proxy component.

Microsoft FSOCS Categorizer\IMConversationTxtFormatsPerSecond

The number of instant message conversations with a MIME type of "text/plain" processed each second by the RTC Proxy component.

Microsoft FSOCS Categorizer\IMConversationTotal

The total number of instant message conversations processed by the RTC Proxy component.

Microsoft FSOCS Categorizer\IMConversationTotalPerSecond

The number of instant message conversations handled each second by the RTC Proxy component.

Microsoft FSOCS Categorizer\IMConversationUnsupportedContentTypes

The total number of instant message conversations with an unsupported MIME type processed by the RTC Proxy component.

Microsoft FSOCS Categorizer\IMConversationUnsupportedContentTypesPerSecond

The number of instant message conversations with an unsupported MIME type processed each second by the RTC Proxy component.

Microsoft FSOCS Categorizer\RequestsReceivedInvites

The total number of INVITE SIP message requests processed by the RTC Proxy component.

Microsoft FSOCS Categorizer\RequestsReceivedInvitesPerSecond

The number of INVITE SIP message requests handled each second by the RTC Proxy component.

Microsoft FSOCS Categorizer\RequestsReceivedMessages

The total number of MESSAGE SIP message requests handled by the RTC Proxy component.

Microsoft FSOCS Categorizer\RequestsReceivedMessagesPerSecond

The number of MESSAGE SIP message requests handled each second by the RTC Proxy component.

Microsoft FSOCS Categorizer\RequestsReceivedTotal

The total number of SIP message requests processed by the RTC Proxy component.

Microsoft FSOCS Categorizer\RequestsReceivedTotalPerSecond

The number of SIP message requests handled each second by the RTC Proxy component.

Microsoft FSOCS Health

 

Performance counter

Definition

Microsoft FSOCS Health\\ActiveSIPMessageObjects

The number of message objects in use by the RTC Proxy.

Microsoft FSOCS Health\\ActiveWorkerThreads

The number of worker threads currently active in the agent.

Microsoft FSOCS Health\\ManagedMemoryUse

The amount of memory used by the .NET runtime.

Microsoft FSOCS Health\\QueuedFileTransfersToScan

The number of file transfer messages in the queue waiting to be scanned.

Microsoft FSOCS Health\\QueuedIMConversationsToScan

The number of IM conversations in the queue waiting to be scanned.

Microsoft FSOCS Health\\ScanDeferredSIPMessages

The number of IM messages that were not scanned because of the depth of the server agent queue.

Microsoft FSOCS Health\\ThrottleModeEvents

The number of events triggered for low CLR memory conditions.

Microsoft FSOCS Health\\TimeoutsHandled

The number of messages that timed out and were handled by the RTC Proxy.

Microsoft FSOCS Health\\TransactionsCanceledHandled

The number of requests and response transactions that were canceled before completion.

Microsoft FSOCS Scan Filter

 

Performance counter

Definition

Microsoft FSOCS Scan Filter\AverageProcessingTimeFileTransfer

The average length of time it takes to scan a file transfer.

Microsoft FSOCS Scan Filter\AverageProcessingTimeIMConversation

The average length of time it takes to scan an IM conversation message.

Microsoft FSOCS Scan Filter\AverageSizeScanPayloadFileTransfer

The average size of a scanned file.

Microsoft FSOCS Scan Filter\AverageSizeScanPayloadIMConversation

The average size of a scanned IM conversation message.

Microsoft FSOCS Scan Filter\FileTransfersBlocked

The number of times a file transfer was prevented.

Microsoft FSOCS Scan Filter\IMConversationsBlocked

The number of times an IM conversation was prevented from being delivered.

Microsoft FSOCS Scan Filter\NotificationsSent

The number of IM messages sent that were notifications.

Microsoft FSOCS Scan Filter\SIPTransfersRejected

The number of times a SIP message was rejected.

Microsoft FSOCS SIP Traffic

 

Performance counter

Definition

Microsoft FSOCS SIP Traffic\LocallyGenerated182

The number of SIP messages waiting to be processed by the RTC Proxy.

Microsoft FSOCS SIP Traffic\LocallyGenerated400

The number of invalid SIP requests received by the server.

Microsoft FSOCS SIP Traffic\LocallyGenerated406

The number of SIP requests rejected by the server due to unacceptable content.

Microsoft FSOCS SIP Traffic\LocallyGenerated415

The number of messages rejected by the RTC Proxy because of unknown or unsupported content types.

Microsoft FSOCS SIP Traffic\LocallyGenerated503

The number of incoming SIP requests that were rejected because the server was overloaded with messages.

Microsoft FSOCS SIP Traffic\ProxyRequestsFailed

The number of SIP messages that the RTC Proxy failed to forward to the server.

Microsoft FSOCS SIP Traffic\ProxyRequestsSucceeded

The number of SIP messages that were successfully forwarded from the RTC Proxy to the server.

 
Did you find this helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft. All rights reserved.