DetailPage-MSS-KB

Microsoft small business knowledge base

Article ID: 2780294 - Last Review: January 22, 2013 - Revision: 3.0

Summary

The Lync Server 2010\2013 diagnostics package for Windows Server 2008 R2 is used to collect a comprehensive set of information for troubleshooting Lync Server 2010\2013 issues.

More information

There are separate Lync Server 2010 diagnostics packages for Windows Server 2008 and for Windows Server 2008 R2. This article describes the Lync Server 2010\2013 diagnostics package for Windows Server 2008 R2.

For more information about on the Lync Server 2010 diagnostics package for Windows Server 2008, click the following article number to view the article in the Microsoft Knowledge Base:
2635830 (http://support.microsoft.com/kb/2635830) [SDP 2][E5B446A9-7843-4EA3-9ED8-DF69D56575D3] Lync Server 2010 diagnostics package for Windows Server 2008

The following information may be collected by the Lync Server 2010\2013 SQL Server component diagnostics package

Note Output file names are prefixed by using the name of the item for which their output was generated. In output file names, the placeholder <prefix> represents the name of the item for which output is generated.

Information collected
Lync Server event logs
Collapse this tableExpand this table
DescriptionFile name
Event log – Application – text, .csv, and .evt/.evtx formats <prefix>_evt_Application.*
Event log – System – text, .csv, and .evt/.evtx formats<prefix>_evt_System.*
Event log – Lync Server – text, .csv, and .evt/.evtx formats<prefix>_evt_LyncServer.*
Lync Server topology
Collapse this tableExpand this table
DescriptionFile name
Get-CsTopology -AsXML cmdlet output<prefix>_DHCPUtil_EmulateClient.txt
Lync Server DHCPUtil output
Collapse this tableExpand this table
DescriptionFile name
DHCPUtil -EmulateClient{prefix}_DHCPUtil_EmulateClient.txt
Lync Server tracing file
Collapse this tableExpand this table
DescriptionFile name
Tracing files{prefix}_{tracing filename}_.etl
Windows firewall information
Collapse this tableExpand this table
DescriptionFile name
Windows Firewall Advanced Security event log in .txt, .csv,
and .evtx formats
Note Available only on Windows 7 and Windows Server 2008 R2
<prefix>_evt_WindowsFirewallWithAdvancedSecurity-Firewall_evt_.csv
<prefix>_evt_WindowsFirewallWithAdvancedSecurity-Firewall_evt_.txt
<prefix>_evt_WindowsFirewallWithAdvancedSecurity-Firewall_evt_.evtx
Output of NETSH ADVFIREWALL SHOW command together with various options<prefix>_Firewall_netsh_advfirewall.txt
Output of NETSH advfirewall consec show rule name=all<prefix>_Firewall_netsh_advfirewall-consec-rules.txt
Output of netsh advfirewall export<prefix>_Firewall_netsh_advfirewall-export.wfw
Output of netsh advfirewall firewall show rule name=all<prefix>_Firewall_netsh_advfw-firewall-rules.txt
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall<prefix>_Firewall_reg_.txt
HKLM\SYSTEM\CurrentControlSet\Services\BFE <prefix>_Firewall_reg_.txt
HKLM\SYSTEM\CurrentControlSet\Services\IKEEXT<prefix>_Firewall_reg_.txt
HKLM\SYSTEM\CurrentControlSet\Services\MpsSvc<prefix>Firewall_reg_.txt
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess<prefix>_Firewall_reg_.txt
Basic information that is collected when the SQL Base Diagnostics Collector is run on a Windows failover cluster
Collapse this tableExpand this table
DescriptionFile name
Cluster logs that are generated by Get-ClusterLog Windows PowerShell cmdlet<prefix>_cluster.log
Cluster Properties<prefix>_ClusterProperties.txt
Cluster Dependency Report<prefix>_ag_DependencyReport.mht
Names and versions of clustering binaries<prefix>_sym_Cluster.csv
Names and versions of clustering binaries<prefix>_sym_Cluster.txt
Failover Cluster Manager Administrative event log in
.txt, .csv, and .evtx formats

Note Available only on Windows Server 2008 R2 failover cluster nodes
<prefix>_evt_FailoverClusteringManager-Admin.csv
<prefix>_evt_FailoverClusteringManager-Admin.txt
<prefix>_evt_FailoverClusteringManager-Admin.evtx
Failover Cluster Operational Eventlog in .txt, .csv, and .evtx formats

Note Available only on Windows Server 2008 R2 failover cluster nodes
prefix}_evt_FailoverClustering-Operational.csv
<prefix>_evt_FailoverClustering-Operational.txt
<prefix>_evt_FailoverClustering-Operational.evtx
Windows cluster registry keys
Collapse this tableExpand this table
DescriptionFile name
HKLM\System\CurrentControlSet\services\ClusDisk<prefix>_reg_ClusDisk.txt
HKLM\System\CurrentControlSet\services\ClusSvc<prefix>_reg_ClusSvc.txt
HKLM\Cluster<prefix>_reg_Cluster.hiv
Information about user rights assignments on the destination computer
Collapse this tableExpand this table
DescriptionFile name
Local User Rights Assignments<prefix>_UserRights.txt
Information about the operating system and whether the destination computer is a virtual machine
Collapse this tableExpand this table
DescriptionFile name
Reports virtualization status of target VM<prefix>_Virtualization.htm
Reports virtualization status of target VM<prefix>_Virtualization.txt
Networking information
Collapse this tableExpand this table
DescriptionFile name
Basic IP networking configuration information, such as
TCP/IP registry key, ipconfig, arp, netstat, nbtstat, and netsh output
<prefix>_TcpIp-Info.txt
Output from the netdiag.exe utility<prefix>_netdiag.txt
Firewall information from netsh firewall<prefix>_FirewallConfig.txt
Netsh information for IPv4<prefix>_TCPIP-Netsh-IPv4.txt
Netsh information for IPv6<prefix>_TCPIP-Netsh-IPv6.txt
Netsh information for TCP global and chimney<prefix>_TCPIP-Netsh-TCP.txt
Autorun information

Note For more information about the Autorun utility, go to the following Microsoft TechNet website:
Autoruns for Windows v11.34 (http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx)

Collapse this tableExpand this table
DescriptionFile name
Autorun information in .htm format<prefix>_Autoruns.htm
Autorun information in .xml format<prefix>_Autoruns.xml
Microsoft SQL Server error logs

The SQL Base Diagnostics Collector will collect up to 20 SQL Server error logs for each discovered instance that meets the following criteria:

  • Each error log file size must be 200 MB or less
  • The maximum total uncompressed size of all collected error log files cannot exceed 250 MB. When the 250MB limit is reached, no additional error logs are collected for the instance of SQL Server
Collapse this tableExpand this table
DescriptionFile name
Collects SQL Server error logs for all instances that are
installed on the computer on which the diagnostic tool is executed.
Named instance:
<prefix>_<INSTANCE_NAME>_1033_ERRORLOG[.n]
Default instance:
<prefix>_MSSQLSERVER_ERRORLOG[.n]
Note When the SQL Base Diagnostics Collector is executed against a Windows failover cluster, SQL Server error logs are only collected if they are stored on a drive that is "owned" and "online" to the target cluster node.

SQL Server Agent logs
The SQL Base Diagnostics Collector will collect up to 20 SQL Server Agent logs for each discovered instance that meets the following criteria:
  • Each SQL Server Agent log file size must be 200 MB or less
  • The maximum total uncompressed size of all collected SQL Server Agent log files cannot exceed 250 MB. When the 250MB limit is reached, no additional SQL Server Agent log files are collected for the instance of SQL Server.
Collapse this tableExpand this table
DescriptionFile name
Collects SQL Server Agent logs for all instances that are installed on the computer on which the diagnostic tool is executed. Named instance:
<prefix>_<INSTANCE_NAME>_1033_SQLAGENT.[OUT | n]
Default instance:
<prefix>_MSSQLSERVER__1033_SQLAGENT.[OUT |n]

Note When the SQL Base Diagnostics Collector is executed against a Windows failover cluster, SQL Server Agent logs are only collected if they are stored on a drive that is "owned" and "online" to the target cluster node.

SQL Server minidump files

The SQL Base Diagnostics Collector will collect up to 10 SQL Server minidump files for each discovered instance of SQL Server. The files are collected in descending order, based on the creation date of the minidump file. This means that the most recently generated files are collected first. The collected files must meet the following criteria:

  • Each minidump file size must be 100 MB or less.
  • Each minidump file must be 30 days old or less.
  • The maximum total uncompressed size of all collected minidump files for a given instance of SQL Server cannot exceed 200 MB. When the 200 MB limit is reached, no additional minidump files are collected for the instance of SQL Server.
Note All the files for a given instance are compressed into a zip archive before they are collected.

Collapse this tableExpand this table
DescriptionFile name
SQL Server minidump files Named instance: <prefix>_<INSTANCE_NAME>_1033_SqlMiniDumps.zip
Default instance:<prefix>_MSSQLSERVER_1033_SqlMiniDumps .zip
A dump inventory report is generated and
collected for each discovered instance of
SQL Server.
Named instance:<prefix>_<INSTANCE_NAME>_DumpInventory.log
Default Instant<prefix>_MSSQLSERVER_DumpInventory.log
Note When the SQL Base Diagnostics Collector is executed against a Windows failover cluster, SQL Server minidump files are only collected if they are stored on a drive that is "owned" and "online" to the target cluster node.

SQLDIAG data collection script

The SQLDIAG data collection script will be executed against each instance of SQL Server that has a service status of "RUNNING." The script output is redirected to a file and collected by the diagnostic.

Collapse this tableExpand this table
DescriptionFile name
SQLDIAG script outputNamed instance:<prefix>_<INSTANCE_NAME>_1033_sp_sqldiag_Shutdown.OUT
Default Instance:<prefix>_MSSQLSERVER_1033_sp_sqldiag_Shutdown.OUT
SQL Server AlwaysOn configuration information

Note The SQL Server AlwaysOn configuration information is only collected from SQL Server 2012 instances.

Collapse this tableExpand this table
DescriptionFile name
SQL Server AlwaysOn configuration informationNamed instance:<prefix>_<INSTANCE_NAME>_1033_AlwaysOn.OUT
Default Instance:<prefix>_MSSQLSERVER_1033_AlwaysOn.OUT
SQL Server AlwaysOn health logs

SQL Server AlwaysOn health session logs are collected from each SQL Server 2012 instance that is installed on the destination computer. The files are collected and compressed into "instance specific" zip archives.

The maximum number of SQL Server AlwaysOn Health logs that will be collected for each discovered instance is 20. The files are collected in descending order, based on the creation date of the file.

Collapse this tableExpand this table
DescriptionFile name
SQL Server AlwaysOn health logsNamed instance: <prefix>_<INSTANCE_NAME>_AlwaysOn_health_XeLogs.zip
Default Instance:<prefix>_MSSQLSERVER_AlwaysOn_health_XeLogs.zip
Note When the SQL Base Diagnostics Collector is executed against a Windows failover cluster, SQL Server AlwaysOn health logs are only collected if they are stored on a drive that is "owned" and "online" to the target cluster node.

SQL Server failover cluster health logs
SQL Server failover cluster health logs are collected from each "clustered" SQL Server 2012 instance that is installed on the destination computer. The files are collected and compressed into "instance specific" zip archives.

The maximum number of failover cluster health logs that will be collected for each instance is 20. The files are collected in descending order, based on the creation date of the file.

Collapse this tableExpand this table
DescriptionFile name
SQL Server failover cluster health logsNamed instance: <prefix>_<INSTANCE_NAME>_FailoverCluster_health_XeLogs.zip
Default Instance:<prefix>_MSSQLSERVER_FailoverCluster_health_XeLogs.zip
Note The SQL Server failover cluster health logs are only collected if they are stored on a drive that is "owned" and "online" to the target cluster node.

SQL Server default system health logs

SQL Server default system health logs are collected from each SQL Server 2012 instance that is installed on the destination computer. The files are collected and compressed into "instance specific" ZIP archives

Collapse this tableExpand this table
DescriptionFile name
SQL Server default system health logsNamed instance:<prefix>_<INSTANCE_NAME>_system_health_XeLogs.zip
Default Instance:<prefix>_MSSQLSERVER_system_health_XeLogs.zip
Note When the SQL Base Diagnostics Collector is executed against a Windows failover cluster, SQL Server default system health logs are only collected if they are stored on a drive that is "owned" and "online" to the target cluster node.

SQL Server Analysis Services configuration file

The SQL Server Analysis Services configuration file will be collected for each Analysis Services instance that is discovered on the destination computer.

Collapse this tableExpand this table
DescriptionFile name
SQL Server Analysis Services configuration file<prefix>_<INSTANCE_NAME>_1033_msmdsrv.ini
Note When the SQL Base Diagnostics Collector is executed against a Windows failover cluster, SQL Server Analysis Services configuration files are only collected if they are stored on a drive that is "owned" and "online" to the target cluster node.

SQL Server Analysis Services registry keys
Collapse this tableExpand this table
DescriptionFile name
HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\
<OLAP _INSTANCE_ROOT_KEY>
<prefix>_reg_HKLM_OLAP_IntanceRoot_all.txt
HKCR:\MSOLAP
HKCR:\MSOLAP.2
HKCR:\MSOLAP.3
HKCR:\MSOLAP.4
<prefix>_reg_HKCR_MSOLAP_all.txt
HKLM:\System\CurrentControlSet\Services\<OLAP_Service_Name><prefix>_reg_HKLM_CurrentControlSet_Services
Other
Collapse this tableExpand this table
DescriptionFile name
Installed updates and hotfixes<prefix>_Hotfixes.*
System information<prefix>_sym_*.*
Server Role information<prefix>_ServerManagerCmdQuery.*
Copy of ServerManager.log from Windows\Logs folder<prefix>_ServerManager.log
Process and threads information through pstat.exe<prefix>_PSTAT.txt
Storage/disk information
Collapse this tableExpand this table
DescriptionFile name
Fibre Channel Information through FCInfo.exe utility<prefix>_FCInfo.txt
Volume Shadow Copy Service (VSS) information<prefix>_VSSAdmin.txt
Active Directory and policy Information
Collapse this tableExpand this table
DescriptionFile name
Resultant Set of Policy (RSoP) information through gpresult.exe<prefix>_GPResult.*
Security templates currently cached on the system<prefix>_AppliedSecTempl.txt
Functional Level and Group Membership information<prefix>_DSMisc.txt
Checks that are performed by the Lync Server Core Component Diagnostics Package
Collapse this tableExpand this table
NameDescription
Check whether there is a newer CU.Should check whether the latest CU is applied. The ideal kind of rule identifies a specific issue and can state definitely that a particular CU resolves the issue. For more information, click the article number to view the article in the Microsoft Knowledge Base:
2493736  (http://support.microsoft.com/kb/2493736/ ) Updates for Lync Server 2010
Check weak RSA key certificates.To reduce the risk of unauthorized exposure of sensitive information, Microsoft released a nonsecurity update (KB 2661254) for all supported versions of Microsoft Windows. This update blocks cryptographic keys that are less than 1,024 bits long. This update does not apply to Windows 8 Release Preview or Windows Server 2012 Release Candidate, because these operating systems already include the functionality to block weakRSA keys that are less than 1,024 bits long. For more information, go to the following Microsoft website:
http://technet.microsoft.com/security/advisory/2661254 (http://technet.microsoft.com/security/advisory/2661254)
Check whether the db chaining option for the RTC database and the RTCdyn databases is disabled.If the cross-database ownership chaining option was disabled for the RTC database, the Front End Service will not start on your Lync server. Please refer to the following KB article For more information, click the following article number to view the article in the Microsoft Knowledge Base:
968100  (http://support.microsoft.com/kb/968100/ ) Office Communications Server or Lync Server 2010 Front End Services fail after backend database move
External Users can logon without entering credentialsExternal users can connect via the Edge Serve without entering credentials (username/password) when the external Edge Server certificate was a wildcard certificate. Or on the internal Edge Server interface customer was using a certificate with SAN.

Wildcard Certificate Support (http://technet.microsoft.com/en-us/library/hh202161.aspx)
Lync Certificate may expire in 21 days or lessExpired or soon to expire certificates in 21 Days will be detected
Lync Certificate may expire in 7 days or lessExpired or soon to expire certificates in 7 Days will be detected
Windows Server is missing KB975954 to prevent possible deadlocks in LyncYou are missing Windows Update KB975954. This .NET Framework update addresses a known issue that leads to poor performance on Lync Servers. When this issue occurs you may see an Access Violation in several Lync processes or you may see a hang in some Lync processes. Apply the .NET Framework hotfix from KB975954. See the Knowledge Base article for more information on how to address this issue.

975954 (http://support.microsoft.com/kb/975954/) FIX: When you run a .NET Framework 2.0-based application, a System.AccessViolationException exception occurs, or a dead-lock occurs on two threads in an application domain
Mediation server network interfaces are not properly configuredAll the network interface IP addresses for the Mediation server are from the same subnets or there is only 1 NIC. Make sure that the server has two network interfaces that are configured with IP addresses from different subnets. See the following KB article for more information.

2758662 (http://support.microsoft.com/kb/2758662) Lync Server 2010 Mediation Server single network adapter issues
Edge server network interfaces are not properly configuredAll the network interface IP addresses for the edge server are from the same subnets or there is only 1 NIC. Make sure that the server has two network interfaces that are configured with IP addresses from different subnets. See the following KB article for more information.

2757916 (http://support.microsoft.com/kb/2757916) Lync Server 2010 edge server network configuration issue
Lync Windows Store App cannot sign-in to Lync Server 2010 pool with CU7 or to Lync Server 2013 poolLync Windows Store App (aka Lync MX) cannot sign-in to Lync Server 2010 pool with CU7 (October 2012 Updates) or to Lync Server 2013 pool as internal user.

Same issue can be seen as an external user as well if the certificate assigned to Lync Access Edge service has been enrolled without a CDP which points to a HTTP location



Applies to
  • Microsoft Lync Server 2013
  • Microsoft Lync Server 2010 Enterprise Edition
  • Microsoft Lync Server 2010 Standard Edition
  • Microsoft Office Communications Server 2007 R2 Enterprise Edition
  • Microsoft Office Communications Server 2007 R2 Standard Edition
Keywords: 
kbsurveynew KB2780294
Share
Additional support options
Ask The Microsoft Small Business Support Community
Contact Microsoft Small Business Support
Find Microsoft Small Business Support Certified Partner
Find a Microsoft Store For In-Person Small Business Support