Using Windows Event Logs to Identify Health Issues

Windows event logs are a critical resource for any administrator of a Windows-based application. In addition to the operating system writing all activity in these logs, many applications, including Lync, write activity to the Windows event logs. Lync Server logs important informational, warning, and critical events to the Windows event log. These logs can be found in Event Viewer under Applications and Services Logs, under Lync Server. Figure 13.8 shows an example of these logs on a Lync Server.

Figure 13.8. Lync Server event logs in Event Viewer.

Because event logs are written in the order in which they occur, they often should be the first place to look when you are troubleshooting issues. Lync Server 2013 writes all service activity, as well as critical failures in the application such as conference join failures, or outbound call routing failures.

In Lync Server 2013 deployments of all sizes, collecting event logs for each server can become a daunting task. In order to help with this it is recommended to configure a server to receive event logs for all machines. This functionality requires the following:

• Windows Remote Management (WinRM) enabled on all Lync servers

• Visual C++ 2012 Redistribution Package on the receiving server

• Lync Server 2013 core components on the receiving server

The Lync Server 2013 core components allow the receiving machine to understand Lync Server logs without any additional work from the administrator.

Perform the following tasks to create an Event Collector for Lync Server 2013 event logs:

1. Open Event Viewer, located in the Administrative Tools on Windows Server.

2. Right-click on the Subscriptions folder, and choose Create Subscription.

3. When in the Subscription Wizard, you should set a Subscription Name and choose the Computers and Events you will be collecting. Figure 13.9 shows an example of the basic subscription properties configuration.

Figure 13.9. Lync Server 2013 event subscription.

4. Choose Select Computers and add the appropriate servers for your environment. Figure 13.10 shows an example of a Persistent Chat and SQL Server being selected for the subscription.

Figure 13.10. Adding Lync Servers to an event subscription.

5. Next, choose Select Events. This box enables you to filter the events you want to receive. Figure 13.11 shows an example of just Lync Server events being selected for the subscription.

Figure 13.11. Choosing events for an event subscription.

6. Click OK to close the Select Events box. Then click OK to close the Subscription Wizard.

7. Events from this subscription now show under the Windows LogsForwarded Events folder in Event Viewer.

Windows Event Viewer can also be used on client machines to diagnose issues. By default, logging on Lync 2013 clients is not enabled. However, enabling this feature is recommended and provides a great source of information in troubleshooting specific end-user scenarios. When this is turned on, the Application event log on client machines is populated with Lync client event logs. This can be used to troubleshoot sign-in and other critical issues. Turning on this feature can be done in two ways: on the Lync 2013 client and through a Lync Client Policy, controlled by the administrator.

To enable event logging in the Lync Client Policy, do the following:

1. Open the Lync Server Management Shell (PowerShell).

2. Run the following command. The command shown here enables the global client policy with event logging; if you have separate client policies, substitute the Identity value.

Set-CSClientPolicy -Identity Global -EnableEventLogging $True

To enable event logging on the Lync 2013 client, do the following:

1. Open the Lync Options menu by clicking on the Options Wheel in the upper-right corner of the Lync 2013 client. See Figure 13.12 for an example.

Figure 13.12. Opening the Lync Options menu.

2. When in the General options window, check the box for Also Turn On Windows Event Logging for Lync to Collect Troubleshooting Info. See Figure 13.13 for an example.

Figure 13.13. Enabling Lync client event logging.

Windows event logs are a powerful resource for many reasons. Utilize this tool to troubleshoot and monitor the health of your Lync Server 2013 environment.