I was asked to help in resolving why the reverse number lookup feature wasn't working for a particular user on our Exchange 2010 environment. Don't think the guys have fully resolved it yet, but this has helped to retrieve the relevant information out of the Event Logs using PowerShell.
Unfortunately, there's no way to filter this sort of info completely like this in the GUI.
With logging turned right up on The Exchange Server, it was like looking for a needle in a hay stack for the relevant entries in the Event Logs. The summary information all looked the same, and in an organisation with over 3000 employees, there were a lot of calls being logged.
Enter PowerShell.
First of all, I identified the phone number of the user who was having a problem and searched for all calls where that number was written in the Event Log Message:
Get-EventLog -logname "Application" | select TimeWritten,EventID,Message | where-object{$_.Message -like "*55636*"} | fl
This returned results for all calls that had gone to that UM account, but also enabled me to capture the "Caller ID".
TimeWritten : 4/14/2010 2:05:56 PM
EventID : 1170
Message : Call data: C,7123-5c7b20100414145810390@10.0.0.1,CASSERVER,f18
921d8-7363-4c97-bc9a-4be8 ad6dd36f,CALLMANAGER,2010-04-14T04:05:56+10:00
,0,00:00:00,81f1d291-49c7-43c0-a7e82d717b15a9a,NETVX,"+61282843608","",A,U,F,
"",0,0,0,0,0,0,0,0,0,f68a3ba4-974e-4a88-b7f8-1c87cf67bea8,jsmith
I then just modified my original PowerShell script to include the Caller ID highlighted above. This gave me all of the entries relating to that particular call.
Get-EventLog -logname "Application" | select TimeWritten,EventID,Message | where-object{$_.Message -like "*7123-5c7b20100414145810390*"} | fl
Hopefully, there's enough information being retrieved now to help identify what's going on.
TimeWritten : 4/14/2010 2:05:56 PM
EventID : 1084
Message : The call with ID "[email protected]" ended because the Unified Messaging server disconnected.
TimeWritten : 4/14/2010 2:05:56 PM
EventID : 1317
Message : The call for '[email protected]' isn't supported on this server. The call was redirected to Unified Messaging server 'EX2007CAS'. The caller ID is [email protected]
TimeWritten : 4/14/2010 2:05:56 PM
EventID : 1004
Message : A call was received with the following parameters:
Calling Party: "sip:[email protected];user=phone",
Called Party: "sip:[email protected];user=phone",
Diversion Information: "
It's not a complete solution just yet, but it has given the guys some clues in where the problem lies.
Enjoyed this post?
Help us spread the word by sharing with friends and colleagues!
Posted in: [IT Pros]
Popular tags: exchange 2010, microsoft