CUCM Trace Logs Limited to the Previous 10 Minutes Worth of Calls

[kylebrogers]

This is a 2-server cluster of CUCM 12.5
It is a small deployment of around 100 phones that don't handle a large volume of calls.
I'm pulling logs for the CallManager service.
Typically I would expect to be able to go back at least weeks but I can't pull any more than about 10 minutes worth of logs.  

When I try to pull logs either via RTMT or the CLI, only logs for the last 5-10 minutes are available, even if I select a period of days before the download.  The total, combined size of the trace files is a few megabytes.  
To make sure it isn't an RTMT issue, I've looked at the files directly through the CLI and the sdl, calllogs, and sdi folders only contain a few of the corresponding log files, so it's not RTMT.  The logs simply aren't there beyond the last few minutes.  
I verified that the trace settings under the CallManager trace configuration in CUCM are 1500 files at a max size of 10 MB.  
Any idea why the traces may be turning over so quickly and how to correct it?  I'm trying to track down an intermittent call control issue and the lack of traces is making it difficult.  

[Maren Mahoney]

The first two questions are the "How did I miss that?" questions:

• When you set your trace settings, did you "Apply to all nodes"?
• And, are you looking at the trace files from a call processing node (one that is running the CallManager service) and where that call processing node is actually processing calls? (Example: If you have two call processing nodes but only one CallManagerGroup, all calls would process through a single node).

Now the less common stuff:

• Are the SDL Trace settings in the service parameters for the CallManager service set to their defaults?
• Are the service parameter settings for the Cisco AMC Service set to their defaults?
• Do you have sufficient harddrive space?

If all of the above are fine, I would suggest pulling the trace file for the Cisco Trace Collection Service and do a search for "SDL" in the files to see if there are notes about errors or overwrites.

Let us know how all of this goes. If it all looks okay, we can dig further.

Maren

[kylebrogers]

Thank you for your reply.  
The traces are set for "all nodes" and I had gone ahead and re-applied it again when I first saw the issue just to be sure.  
I'm looking on both nodes and the devices are almost evenly split between being registered to the Pub and the Sub.  I also make sure to pull traces from both when using RTMT.  
I just double-checked and the 5 settings for SDL under Service Parameters are set at their default settings.
Likewise, the 9 settings under the AMC Service service parameters are set to defaults.  
The active disk is 94% used and the logging disk is 89% used.  The logging disk has roughly 5.8 GB free space.  
I will pull the trace files for the Trace Collection Service and see anything unusual shows up in those traces.

[Maren Mahoney]

I think your disk utilization will end up being the issue. I often see a 90% threshold for purging on Cisco's UC systems.

Maren

[kylebrogers]

Thanks.  I ran the free space COP and it cut the utilization down to 44% on the Logging partition but the problem persisted.  In the end, it looks like someone had set the water marks down in the 35% range, perhaps to free space for an upgrade or something.  I should have thought to check that earlier.  So I ran the low/high back up to 90/95.