Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Procedure to acquire logs from CUCM, CUC servers



This document describes how to retrieve logs from Cisco Unified Communications Manager (CUCM)
and Cisco Unity Connection (CUC).

Core Issue:


There is a need to provide detailed information on how to retrieve logs from Cisco CUCM and CUC.



The log retrieval process is as follows:

1. Configure the logging levels on the servers
2. Wait for the event to re-occur, or actively reproduce the event
3. Download the necessary logs from the servers to your local PC using RTMT
4. If necessary, send the downloaded logs to TAC for further analysis


Each step is described below.

1. Configure the logging levels on the server.

For both CUCM and CUC, ERROR level events are recorded in the logs with default settings,

which are not detailed enough for most issues to be analyzed. In order for the necessary event details
to be recorded, the logging levels need to be changed to Detailed level in advance.


After raising the logging level of the Cisco CallManager trace to detailed, the server’s CPU load
will increase by roughly 10% of its current CPU load. In most environments this increase
in CPU load can be ignored.
For example, if you change the logging level to detailed on a server where average CPU utilization is 30%,
the CPU utilization only increases to 33%.Another side-effect to be aware of is that since the log write
volume increases, the duration of the stored log records decreases.
(Individual CUCM logs are overwritten

on an oldest-first basis as the log files reach the configured max number of files to store.)

Depending on the call volume of the server, even if the log record period is six months when using the

default ERROR level, changing to Detailed level may decrease the period to one month or less.
With the default ERROR level trace, no analysis can be performed if problems arise.
It is mandatory to retrieve Detailed level logs for TAC analysis. 

For other services’ logging levels, please follow the instructions of the Cisco TAC or Escalation team
to set the appropriate values. There may be extra load on the server for other traces, such as DB traces. 
(Or, you can configure the setting for a short period and monitor the CPU load to determine whether
this setting can be applied permanently.)


(For CUCM)
To configure the trace settings of the Cisco CallManager service,
log into the CUCM Serviceability screen and select Trace > Configuration from the menu.
For Server, select one of active servers and click Go. For Service Group, select CM Services
and click Go. For Service, select Cisco CallManager(Active) and click Go.Check the
Apply to All Nodes field directly below the Go buttons and make sure that Trace On is checked as well.
(With Apply to All Nodes checked, your new trace configuration will be simultaneously
applied to the other servers in your cluster.)

Next, select Detailed for Debug Trace Level. This field sets the overall logging level.
You can leave the other fields as they are.
Finally, click Save (or the floppy disk icon) to enable the settings.

TAC recommends you set the level to Detailed for Cisco CallManager service during normal operation as well.

To restore the default settings, click the Set Default button located at the bottom of the screen.


(For CUC)

To configure the trace settings of Cisco Unity,
log into the CUC Serviceability screen and select Trace > Configuration from the menu.
For Server, select an actively used server and click Go. For Component,
select a service to modify and click Go.(For example, if you want to select the main service of CUC,
select Connection Conversation Manager.)

Unlike CUCM, you cannot configure the logging levels on the Configuration page.
On this page, you can restore the default settings of the Macro or Micro settings, which is explained later.

You can also refresh the current log files to a blank state, which is performed after changing the trace level.
To actually change the level in CUC, go to Trace > Macro or Trace > Micro menu.

Micro and Macro refer to different trace setting methods.

Micro - detailed level settings are configured for each service.

Macro - recommended micro-trace settings for each problem-type are configured as a group.
Setting Macro traces will automatically add checkmarks to the corresponding micro trace fields.

Which level to set for each module depends on the event, so please consult with TAC.

Also, a list of typical settings for some common problems is provided at the website below.

After making the necessary changes, click Save (or the floppy disk icon) to apply.

To restore the default settings, click the Set Default button for each module on the Configuration screen.

2. Wait for the event to re-occur, or actively reproduce the event


3. Download the necessary logs from the servers to your local PC using RTMT
A. If you have not installed RTMT onto a PC yet, please do so first.

Log into the Cisco Unified CM Administration or Cisco Unity Connection Administration screen,
and then select Application > Plugins from the menu.When the search screen appears,
search for Real-Time Monitoring Tool.

RTMT for Linux and RTMT for Windows will appear on the search result screen.
Download whichever is appropriate for the OS of the PC you are using to retrieve logs.
Install the tool using the downloaded file. Note that one instance of RTMT can be used
for both CUCM and CUC as long as
their version numbers are the same.

B. Launch the RTMT tool.
Enter the IP address of the CUCM Publisher or Cisco Unity Connection,
the administrator name, and the administrator password. Click OK.
When connecting to a server for the first time, you will be requested to locally install an SSL certificate.
"Information you exchange with this server is secure. it cannot be viewed or changed
by others.  Do you wish to add certificate to certificate store and proceed?”
Click Yes for this question. You need to do this only once, when first using RTMT.

Once RTMT has launched, the profile selection screen appears. Make sure that
Default is selected at first, and then click OK.RTMT will open.
(In RTMT, you can optionally set up specific items to monitor and retain them as a profile.

Since you can have multiple profiles, you need to select a profile first.)

C. Retrieve logs from CUCM/CUC using RTMT.
Click Trace & Log Central located on the left side of the RTMT screen.The right-side pane display
changes. Double-click Collect Files on the right-side pane, and the log collection wizard will start.

The wizard consists of three screens. You will select the types of trace files to retrieve on the first
and second screens. Select the necessary traces as requested by TAC. For example, if you are requested
to retrieve Cisco CallManager logs, check the square on the far left (All Servers column) of the Cisco
CallManager row located in the middle of the first screen.
(Checking the All Servers column will automatically add checks to all squares
of the Cisco CallManager row.)

Click Next.On the second screen, just click Next since there is no additional log needed.

The items to check vary depending on the logs to retrieve.Check the necessary items accordingly.
On the third screen, you will set up the time zone of the logs to retrieve and specify the log
download destination.
Collection Time shown on the upper half of the screen is where you set the time zone.
Select the Absolute Range radio button to specify the time zone range for log collection.
Alternatively select Relative Range to configure the number of minutes (or hours, days, weeks, months)
before the current time to start the log retrieval period, ending at the current time.
If you actively reproduce the event, it will be easier to use the relative range option to
set up the log retrieval period, with which you can set
the number of minutes before the current time
as the start of the retrieval period.
Download File Options shown in the lower half of the screen
is where you set the download options,
such as the destination folder.

Click Browse next to Download File Directory to specify the download destination.
(By default, it is the folder where RTMT is installed.)
You can leave the other items as they are.
Once you have configured the settings, click Finish at the bottom of the screen to start the actual log
retrieval process. On the screen you can see the log retrieval status. When Completed appears in the end,
it means
that the log retrieval has been completed.

Please check the folder you specified earlier.You will find an XML file containing the log settings
and a folder containing log files.

4. Send the retrieved logs to TAC.

You can see the screenshot images for the procedure introduced in this document at the following URL.
Please visit for your reference.


Related Information

Original Document: Cisco Support Community Japan DOC-12738

Author: Shigeomi Shibata

Posted on August 26, 2010

Version history
Revision #:
2 of 2
Last update:
‎08-29-2017 03:02 PM
Updated by:
Labels (1)