It will have the unregistered event for the phones (one per phone), if you were expecting a list of all devices that's not it.
If you want an explanation the only ways are to review the app and system logs at the time of the failure or to review CUCM traces.
if this helps, please rate
For a CUCM version 7.1.5, where do I get the App and system logs?
Also, if I can also gather some more info via the Traces, which ones would I need to look at from the whole bunch?
Use RTMT to access the logs and CCM traces
If this helps, please rate
STEPS HOW TO COLLECT TRACE AND LOG FILES:
Step 1: Download the RTMT for windows from Admin page -> Application -> Plugins -> RTMT.
Step 2: Collect the Traces using RTMT
a) Login to the RTMT using publisher details
b) Goto “Trace and log central” > Collect Files.
c) Select Cisco Call Manager, Event view application logs , Event view system logs.
Make sure you select the starting time and ending time well within the timestamp when you saw the message.
And try to windows grip the MAC Address of the effected phone if you are aware of any. Once you find the message try to google it.. or post it here..
you need to collect application logs
-To collect application logs:
Open the RTMT, got to System-> tools-> Syslog viewer->open Syslog viewer , then choose the server that you want and select Application logs , you have to check the app logs from all the server right before the alarm time, you will see the following messages before the alarm, here is an example:
here is the alarm:
Apr 17 01:03:55, AXUSCM03, Critical, Cisco AMC Service, : 31042: xxxxx.xxxxx.net: Apr 17 2012 05:03:55.158 UTC : %UC_RTMT-2-RTMT_ALERT: %[AlertName=NumberOfRegisteredPhonesDropped][AlertDetail= Number of registered phones in the cluster drop more than configured percentage between consecutive polls. . Configured high threshold is 10 % Current monitored precanned object has decreased by 90 percent. The alert is generated on Tue Apr 17 01:03:54 EDT 2012 on cluster StandAloneCluster.][ClusterID=][NodeID=xxxxx]: RTMT Alert, 9
now i check the app logs from all servers right before this time Apr 17 01:03:55 and i see the following:
Apr 17 01:03:03,xxxxx, Info, Cisco CallManager, : 25101: xxxxx.xxxx.net Apr 17 2012 05:03:03 UTC : %UC_CALLMANAGER-6-StationConnectionError: %[DeviceName=CFB00077ddd18d0][ReasonCode=0][ClusterID=StandAloneCluster][NodeID=xxxxx]: Station device is closing the connection, 15817
Apr 17 01:03:24, xxxxxx, Info, Cisco CallManager, : 25102: xxxx.xxxxx.net Apr 17 2012 05:03:24 UTC : %UC_CALLMANAGER-6-StationConnectionError: %[DeviceName=CFB00077ddd18d0][ReasonCode=0][ClusterID=StandAloneCluster][NodeID=xxxxx]: Station device is closing the connection, 15818
Apr 17 01:03:44, xxxxxx, Info, Cisco CallManager, : 25103: xxxx.xxxxx.net Apr 17 2012 05:03:44 UTC : %UC_CALLMANAGER-6-StationConnectionError: %[DeviceName=CFB00077ddd18d0][ReasonCode=0][ClusterID=StandAloneCluster][NodeID=xxxx]: Station device is closing the connection, 15819
station connection error with reason code 0 means that the device initiated the reset and it will register back automatically.
and this on another server:
Apr 17 01:03:04, AXUSCM04, Error, Cisco CallManager, : 111897:xxxx.xxxxx.net: Apr 17 2012 05:03:04.345 UTC : %UC_CALLMANAGER-3-DeviceTransientConnection: %[ConnectingPort=2000][DeviceName=ATA2545952E2101][IPAddress=10.22.11.80][DeviceType=12][Reason=29][Protocol=SCCP][IPAddrAttributes=0][UNKNOWN_PARAMNAME:LastSignalReceived=DbStationAutoRegisterErr][UNKNOWN_PARAMNAME:StationState=auto_register][ClusterID=StandAloneCluster][NodeID=xxxxxxx]: A device attempted to register but did not complete registration, 4658
a device transient connection error with reason code 29 means that AutoRegisterDBError
and alot more of those messages.
there are alot of reason codes, plz have a look at this document if you like to know what they mean for each alarm:
the document is for cucm 8.5.1
you can clearly see the name of the devices that are facing the issue.
have a nice day