Lync Server Logging Tool

When all else fails and the problem cannot be diagnosed, perform a diagnostic trace of the server traffic. Included with the installation of any Lync Server role is the Lync Server Logging Tool. This application can be found within the Start menu under the Microsoft Lync Server 2010 program group. This tool is valuable when troubleshooting Lync Server problems because it provides insight into what is happening at the protocol level.

The most common type of tracing done with this tool is to capture the SIP traffic between servers or clients to determine a potential problem. Other traditional types of tracing tools, such as Wireshark, are unable to analyze the Lync Server SIP traffic because it is encrypted using TLS security. When running the logging tool locally on a server, it is able to decrypt the TLS security so that all the SIP messaging becomes readable. Running the Lync Server Logging Tool does not disrupt the server traffic and can be done while users are actively using the system.

To get started, open the Lync Server Logging Tool (see Figure 15.5).

Figure 15.5 Lync Server Logging Tool

To capture the SIP traffic, perform the following steps:

1. Check the box labeled SIP Stack.

2. Click Start Logging.

3. Reproduce the issue that is driving the troubleshooting.

4. Click Stop Logging when the issue has been experienced again.

At this point, an administrator has two options. The first is to click View Log Files to display the logs in text format. This can be difficult to read and troubleshoot because SIP conversations include many lines. For a better experience, first install the Lync Server 2010 Resource Kit Tools. The Snooper tool provides a much cleaner view of a SIP conversation.

1. After the Resource Kit Tools are installed, click the Analyze Log Files button.

2. Verify that the SIP Stack is still selected and click Analyze.

3. Snooper should open automatically and display the conversation. Click the Messages tab to view the SIP conversation.

A message-by-message view of the conversation is located on the left side. Clicking any of the lines change the view in the right-side pane to display the entire SIP message selected. Error messages are highlighted in red for easy identification. A search bar, where keywords such as a username or phone number are entered, is located at the top of the window. After entering a search string and pressing Enter, the view is filtered to only display messages with that string. This kind of filtering can be useful when searching for problems with a single user because it removes all the other traffic through the server.

Figure 15.6 displays a sample SIP trace using the Snooper tool.

Figure 15.6 Snooper SIP Trace