Administration of Microsoft Lync Server 2010 : Troubleshooting (part 2) - Lync Server Logging Tool

Time

A key component of any service running successfully in Lync Server 2010 is the computer time. Verify that the clocks on the Lync Server 2010 servers are correctly set and have the appropriate time zones configured. If the clocks between a server and client are off by more than five minutes, authentication will begin to fail, which might prevent users from logging on successfully.

Services

Basic troubleshooting always begins with making sure the Lync Server services are all running. When services are in a stopped state, users will see many issues such as being unable to sign in or connect to the server. Verify that the following services are configured to start automatically and are running. Verification of the services can be done either through the traditional Services MMC or through the Lync Server Management Shell.

To verify the services are running, open the Lync Server Management Shell and run the Get-CsWindowsService cmdlet. This cmdlet returns both the service status and how many active connections exist, which can be valuable information when draining a server for maintenance.

PS C:\> Get-CsWindowsService
Status Name             Activity Level
Running MASTER
Running REPLICA
Running RTCSRV          Incoming requests per second=0
Running RTCCAA          Concurrent Calls=0
Running RTCCAS          Concurrent Conferences=0
Running RTCRGS          Current Active Calls=0
Running RTCPDAUTH
Running RTCPDPCORE      Active Client Connections=0
Running RTCCPS          Total Parked Calls=0
Running RTCATS          Current Active Calls=0
Running RTCIMMCU        Active Conferences=0
Running RTCDATAMCU      Active Conferences=0
Running RTCAVMCU        Number of Conferences=0
Running RTCASMCU        Active Conferences=0
Running RTCMEDSRV       Current Outbound Calls=0
Running RTCMEETINGMCU   Active Conferences=0
Running FTA

The following command quickly identifies nonrunning services by skipping the activity check:

Get-CsWindowsService –ExcludeActivityLevel | Where-Object {$_.Status –ne "Running"}


					  

Lync Server Logging Tool

When all else fails and the problem cannot be diagnosed, perform a diagnostic trace of the server traffic. Included with the installation of any Lync Server role is the Lync Server Logging Tool. This application can be found within the Start menu under the Microsoft Lync Server 2010 program group. This tool is valuable when troubleshooting Lync Server problems because it provides insight into what is happening at the protocol level.

The most common type of tracing done with this tool is to capture the SIP traffic between servers or clients to determine a potential problem. Other traditional types of tracing tools, such as Wireshark, are unable to analyze the Lync Server SIP traffic because it is encrypted using TLS security. When running the logging tool locally on a server, it is able to decrypt the TLS security so that all the SIP messaging becomes readable. Running the Lync Server Logging Tool does not disrupt the server traffic and can be done while users are actively using the system.

To get started, open the Lync Server Logging Tool (see Figure 1).

Figure 1. Lync Server Logging Tool

To capture the SIP traffic, perform the following steps:

At this point, an administrator has two options. The first is to click View Log Files to display the logs in text format. This can be difficult to read and troubleshoot because SIP conversations include many lines. For a better experience, first install the Lync Server 2010 Resource Kit Tools. The Snooper tool provides a much cleaner view of a SIP conversation.

A message-by-message view of the conversation is located on the left side. Clicking any of the lines change the view in the right-side pane to display the entire SIP message selected. Error messages are highlighted in red for easy identification. A search bar, where keywords such as a username or phone number are entered, is located at the top of the window. After entering a search string and pressing Enter, the view is filtered to only display messages with that string. This kind of filtering can be useful when searching for problems with a single user because it removes all the other traffic through the server.

Figure 2 displays a sample SIP trace using the Snooper tool.

Figure 2. Snooper SIP Trace