I ran into an interesting issue while I was building out a test environment in my lab. After applying the latest cumulative updates for Lync Server 2013, if you used the Lync Server 2013 Logging Tool (OCSLogger.exe) from the Microsoft Lync Server 2013 Debugging Tools, SIPStack messages aren't being parsed from the .etl file and displayed in Snooper. The data is being captured by the Lync Server 2013 Logging Tool, and you can verify that if you open the .etl file in Notepad.
To resolve this issue you just need to copy the latest tracing files into the Debugging Tools directory. If you look in C:\Program Files\Microsoft Lync Server 2013\Debugging Tools (assuming you chose the default install location), you should see the following:
If you look at the Properties of the default.tmx file, you can see the following:
Take note of the file size and created date. If you then navigate out to C:\Program Files\Common Files\Microsoft Lync Server 2013\Tracing, you will see the following:
If you look at the file size and the created date on this version, you can see that it is much larger and newer than the default.tmx file in the Debugging Tools directory. This file contains the information that the Lync Server 2013 Logging Tools needs to parse the .etl file. All you need to do is copy both files into the Debugging Tools directory:
Now when you click the Analyze Log Files button in the Lync Server 2013 Logging Tool, the SIPStack messages will be displayed.
While the preferred method of logging in Lync Server 2013 is to utilize the Centralized Logging Service, if you still prefer using the Lync Server 2013 Logging Tool/GUI to configure logging, then make sure to follow the steps above.
Spent the last 3 weeks trying to figure out why the OCS logger was broke after installing CU3. Thanks for the fix...
This was driving me completely nuts that no SIP traffic would show up! Ugh, stumbled across this article by accident. Thanks for the help!