The event log can assist you in troubleshooting Unified Messaging. First, you have to enable diagnostics logging. Then, you can use the event log to:
-
Generate events for successful UM calls
-
Generate events for successful UM startup
You can use the Exchange Management Shell or the registry to turn on diagnostics logging. You can use the following procedures, or see How to Enable Diagnostic Logging on a Unified Messaging Server in the Exchange Server 2007 Help documentation.
To use the Exchange Management Shell to enable diagnostics logging:
-
On the Unified Messaging server, launch the Exchange Management Shell.
-
Type get-eventloglevel *um* | set-eventloglevel –level Expert.
-
Reproduce the event, and collect the application log from the customer.
-
To revert, type get-eventloglevel *um* | set-eventloglevel –level Lowest.
[PS] C:\>get-eventloglevel *um* | set-eventloglevel -level expert
[PS] C:\>get-eventloglevel *um*
Identity EventLevel
-------- ----------
MSExchange Unified Messaging\UMWorkerProcess Expert
MSExchange Unified Messaging\UMCore Expert
MSExchange Unified Messaging\UMManagement Expert
MSExchange Unified Messaging\UMService Expert
MSExchange Unified Messaging\UMClientAccess Expert
MSExchange Unified Messaging\UMCallData Expert
You can also set the logging level from the registry. Be careful when using the registry, and as a best practice, export the registry before making any changes. Instead of using the registry, consider using the Exchange Management Shell commands.
Caution: |
|---|
|
Incorrectly editing the registry can cause serious problems that may require you to reinstall your operating system. Problems resulting from editing the registry incorrectly may not be able to be resolved. Before editing the registry, back up any valuable data.
|
The following table shows the logging level and the corresponding values.
Logging level for event logging
|
Logging level
|
Value
|
|---|
|
Expert
|
7
|
|
High
|
5
|
|
Medium
|
3
|
|
Low
|
1
|
|
Lowest
|
0
|
Set the following categories to a value of 7 to indicate Expert level logging:
-
UMWorkerProcess
-
UMCore
-
UMManagement
-
UMService
-
UMClientAccess
-
UMCallData
Start Registry Editor (regedit). Scroll to the following keys and then set the value of each key to 7:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchange Unified Messaging\Diagnostics
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchange Unified Messaging\UMWorkerProcess
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchange Unified Messaging\UMCore
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchange Unified Messaging\UMManagement
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchange Unified Messaging\UMService
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchange Unified Messaging\UMClientAccess
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchange Unified Messaging\UMCallData
Value: Lowest – 0x00000000 (0), Expert – 0x00000007 (7)
The following figure shows the Registry Editor.
Setting diagnostics logging from the registry.gif)
Generating Events for Successful UM Calls
When a call is accepted, Unified Messaging generates events in an application log that indicates the call is accepted. The following shows the sequence of events that's logged while diagnostics logging is set to Expert level. Note that you can cross-reference information like call ID, caller, and diversion in the network trace to analyze and troubleshoot a scenario.
Event Type:Information
Event Source:MSExchange Unified Messaging
Event Category:UMCore
Event ID:1004
Description:
A call was received with the following parameters: Calling Party: "sip:2550@ACGWMP118.req150587.local", Called Party:"sip:2501@65.53.0.18;user=phone", Diversion Information: "<tel:2501>;reason=user-busy", CallID"266956433262200053445@65.53.0.18".
Event Type:Information
Event Source:MSExchange Unified Messaging
Event Category:UMCore
Event ID:1006
Description:
The Unified Messaging server has received a call from "2550", with user extension "2501" and a call ID of"266956433262200053445@65.53.0.18".
Event Type:Information
Event Source:MSExchange Unified Messaging
Event Category:UMCore
Event ID:1084
Description:
The call with ID "266956433262200053445@65.53.0.18" ended because the Unified Messaging server disconnected.
Event Type:Information
Event Source:MSExchange Unified Messaging
Event Category:UMCallData
Event ID:1170
Description:
Call data: C,266956433262200053445@65.53.0.18,UMServer01,7d9f535a-54e9-4eda-bfdc-60af8c2facad,2009-04-17T19:52:31-04:00,0,00:00:15,24d31066-dcf2-4f75-b5f4-912a5aeede00,"2550","2501",B,A,C,,0,0,0,0,0,0,0,0,0,0
Generating Events for Successful UM Startup
When you turn on diagnostics logging to the Expert level, you see the following events for UM startup. Important information is logged, such as the port number of the UM worker process and the certificate used for TLS.
Event Type:Information
Event Source:MSExchange Unified Messaging
Event Category:UMService
Event ID:1114
Description:
The Microsoft Exchange Unified Messaging service will attempt to start in the following mode: TCP and TLS dual mode.
Event Type:Information
Event Source:MSExchange Unified Messaging
Event Category:UMService
Event ID:1112
Description:
The Microsoft Exchange Unified Messaging service will attempt to use a certificate with the
following details: IssuerName = "CN=prosCAServer, DC=proseware, DC=org",
SerialNumber = "722C27C6000000000015", Thumbprint = "BED2404E7EBFA6C63DBB6039B1A6DA83987583F4",
IsSelfSigned = "False",
NotValidAfter = "7/12/2009 6:54:26 PM".
The path to this certificate is "C:\Program Files\Microsoft\Exchange Server\UnifiedMessaging\UMServiceCertificate.cer".
Event Type:Information
Event Source:MSExchange Unified Messaging
Event Category:UMCore
Event ID:1010
Description:
The telephone interface definitions were successfully loaded from the configuration file: "C:\Program Files\Microsoft\Exchange Server\bin\Root.fsm"
Event Type:Information
Event Source:MSExchange Unified Messaging
Event Category:UMWorkerProcess
Event ID:1000
Description:
The Unified Messaging Worker Process was started successfully on port "5065".
Event Type:Information
Event Source:MSExchange Unified Messaging
Event Category:UMService
Event ID:1056
Description:
The state of the Unified Messaging Worker Process Manage has changed. Previous state = "initializing".
Current state = "Ready and Accepting calls".
Event Type:Information
Event Source:MSExchange Unified Messaging
Event Category:UMService
Event ID:1037
Description:
The Microsoft Exchange Unified Messaging service has started successfully.
Return to top