Snooping into Lync Server and Logging

So I am a developer person and never really had to get into logging on server side stuff when errors come up. But I was working on this Lync custom development project and got stuck with issues coming up from the Conferencing server while using UCMA 3.0. So here it goes.

If you've been stuck with errors using UCMA conferencing code, and really want to analyse what's exactly happening on the "Lync server side", there are some good options we have already at Microsoft.

1- Install the Lync resource kit and use logging on the Lync server instead of relying on the UCMA errors that your application throws.

The Resource kit that comes with Lync server 2010 and even 2013, gives you logging tools that you can use. Use the UCSLogger and set up properties in it to point to the location where the log files should be kept.

Keep in mind the properties related to filtering what kind of conversations between UCMA endpoints you want to log. Otherwise it will log every conversation between SIPs. So you need to set the properties of:

1. Filters

2. Order of messages - mostly you need to keep it sequential

3. Location of the file

Once you've started logging the SIP conversations based on the filters on the Lync server, you would also need to know that the log files could be of really large sizes. 

Reading through these log files are not easy. You could use notepad, or just use a tool like Snooper which you get with the Resource kit as well.

You will also find Snooper inside the Reskit :)

You open Snooper and point it to the log file that you want to read through. It practically shows you everything that you need to see. Right from SIP invites, subscribes, BYE, ACKs everything :) IT's what you need to do a thorough investigation on why your conferences are failing, be it audio or video.

Take a look at this screenshot of a snooper view of one of the traces i have: You need to open the etl file in snooper and go to the "messages" tab to see all the order of messages. I have removed some of my SIP addresses for confidentiality purposes.

so it basically shows you the messages in the order of its occurance and you can also filter for some messages.

In my case here i can clearly see that i have the 488 error message from Lync server indicating that a conference was not created with the client.

If you remove the filter, it would show you every messages from the beginning to the end indicating all the steps that take places. Details to the conference getting established within Focus and the AV servers are explained in the logs and can be viewed easily via Snooper. Its a great tool to use and really helped me learn some of the way the conferencing features work as well. Just keep in mind the size of the log files!