Need to open a ticket with CSS? Here’s the data we need…
Published May 20 2019 05:26 PM 24.2K Views
First published on TECHNET on Mar 13, 2018

Author: Tushar Pathak, with assistance from Shea Caperoon

Log collection

When opening a support issue it’s critical that we have the right information to fully investigate the issue.  Support engineers often get asked by customers what data would be most useful to provide in order to have the case move forward as efficiently as possible. Having this data in first instance speeds up the resolution and avoids going back in circles.

Please refer to following chart for log collection based on the issue. When possible please submit these logs to the support engineer who is assigned to the case.

SfB Client side

User unable to join a SFB meeting (intra & inter

Client Logs + meeting url + Time of the issue

User is unable to sign in

Client Logs + packet capture

SFB client is crashing or hanging

Client Logs + eventviewer logs + Time of

SFB is not connecting to Exchange error

Client Logs + SfB Configuration Info

Client is not saving conversation history

Client Logs + SfB Configuration Info

IM and Presence related issues

Client Logs + Sip address + Time of

A/V or App sharing failing w/ network issues

Client Logs + Network Capture + Time of

Meeting Schedule Delegation issues

Client Logs + SfB Config Info

Mobility issues (sign-in, meeting join, AV

Go to settings -->Logging --> Ensure logging is
turned on and click send logs

PSTN Calling / Conf issues

Meeting ID/caller-Calle number + timestamp


Collecting Client Logs

  • From SfB/Lync Client, sign out or Cancel sign in

  • From the client sign in screen, select Delete My Sign In Information

  • From Tools > Options > enable client-side logging Options > Tools > General tab.

    • Turn on logging = Full (This is default in 2013/2016 client)

    • Select "Also collect troubleshooting info using Windows Event Logging"

  • Exit the SfB/Lync client entirely (Alt + File > Exit)

  • Exit Outlook entirely

  • Go to Start > Run > type

    • For SfB 2016

      • %localappdata%\Microsoft\Office\16.0\Lync

    • For SfB/Lync 2013

      • %localappdata%\Microsoft\Office\15.0\Lync

  • Delete folders starting with sip_

  • Rename the Tracing folder to Tracing_bak

  • Restart SfB/Lync client, and then reproduce the error condition – please capture a screen shot of error condition and the system time so error logs can be correlated.

  • Exit client completely again and gather logging

  • Zip entire \Tracing\ folder from location above

SFB Configuration Information ...

    1. Navigate down to the taskbar and do a CTRL + RightClick on the Skype for Business icon.

    2. On the menu shown, select the Configuration Information option.

    3. A pop-up window will open. Click on the button named Copy and paste the clipboard into a text file or reply email


Troubleshooting network related

For eg. ICE issues, TLS/TCP handshake issues, Audio quality issues, etc

Related tools for capturing network packets

1st option, full Netmon ...

2nd option

Netmon Oneclick (no install required)

3rd option
Netsh trace

Built in to Windows, just run the following cmdlets in cmd with elevated rights

netsh trace start capture=yes scenario=internetclient

Reproduce the issue

netsh trace stop

netsh trace start scenario=netconnection capture=yes

Reproduce the issue

Netsh trace stop

4th option
Message analyzer

Network Capture on windows (GUI)

  1. Download full netmon client from above website per the operating system bitness

  2. Install full netmon on the affected machine

  3. Run netmon as an Administrator (see here if you need instructions)

  4. Start capture, reproduce the issue and stop capture. For best results, close all other windows or applications that are not needed to reproduce the issue

  5. Save the netmon trace

Network Capture on windows

  1. Open a Command Prompt as Administrator

  2. Create a folder on the local disk by running the followingcommand:

    • c:\> mkdir c:\css-temp

  3. Run the command:

    • c:\> netsh trace start scenario=netconnection capture=yes packettruncatebytes=512 tracefile=c:\ css-temp\%computername%_nettrace.etl maxsize=2000 filemode=circular overwrite=yes report=yes

  4. Wait for the command to finish

  5. Reproduce the problem

  6. Run the command:

    • c:\> netsh trace stop and wait for the command to finish

  7. Prepare to upload the two files in c:\css-temp to the case (ask for instructions from your support professional)

Network Capture Mac

  1. Open a Terminal session

  2. Run the follwing commands:

    • sudo tcpdump -w ~/Desktop/CaptureMSFT.pcap

  3. Enter the admin credential to elevate

  4. Reproduce the problem

  5. Press CTRL+C to stop the capture

  6. Ask customer to upload the file CaptureMSFT.pcap from the Desktop

Version history
Last update:
‎May 20 2019 05:26 PM
Updated by: