any way to see who ended a SfB meeting?

[David Phillips]

SfB On Premise - We recently hosted a meeting with over 100 attendees.  Everyone was a presenter by default.  Someone ended the meeting and booted everyone out.  I dug through OOTB the monitoring logs, but it doesn't appear they show the account that actually ended the meeting.  Is this information stored in the monitoring DB, and if so, any thoughts on a query to pull that out?

Thanks.

[#2]

We experienced the same situation previously, however our environment is fully Online. 

Maybe you can search for the hint from the log

ms-diagnostics-public: 3116;reason="Conference Terminated – Organizer Ended Session""
Reason: SIP;cause=481;text="Conference Terminated – Organizer Ended Session""

So far, this can be only seen from the client log whom terminates the meeting, but I'm not sure on on-prem environment.

As a suggestion to manage large meeting the best practice is to set a handful Presenters that are present while the rest are Attendees, for this we can avoid any unnecessary end meeting situation.

More info: https://msdn.microsoft.com/en-us/library/dd907238(v=office.12).aspx

Cheers.

[#3]

Unfortunately all of the clients send that diagnostic when the conference ends.  I think what I'm looking for is who sent the deleteConference command to the focus.  If it's actually recorded, it's likely in the SQL data.  Just not 100% sure how to go get it.

https://msdn.microsoft.com/en-us/library/dd907238(v=office.12).aspx 

[#4]

Hi David,  Just wondering if you ever got anywhere with finding the presenter that actually issued "end meeting"?

[#5]

I did not. It looks like the only way to do this is via a sql query of the monitoring database. I'm not much of a query writer. :)