LS Centralized Logging Agent Event ID 33041

I am seeing the following error very frequently on all my Lync servers that are running the CLS agent:
LS Centralized Logging Agent Event ID 33041
Lync Server Centralized Logging Service Agent Service was unable to convert etl trace record(s) to cache record(s) due to missing message formats and lost these record(s) permanently
Cache file path: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Tracing\CLS_WPP_10-13-2014-17-21-13.cache
Missing message format(s): 1
d4626f10-6a45-af12-1218-c8e7bb881225(95)
Cause: Lync Server Centralized Logging Service Agent uses default.tmx file to convert ETL records to binary cache file records. If it can't find the message format information for a record it will be unable to determine the data types of the insert data for
the record and the insert data will be lost. This can happen if the default.tmx file is out of sync with respect to the code generating the .ETL records.
Resolution:
Verify that default.tmx file is current and update the default.tmx file if necessary. Check if there are any private bits installed causing default.tmx to be out of sync
It appears the errors started with the install of the August CU updating Lync to 5.0.8308.738. Note, this error is with CLS, not Lync Debugging tools. I have verified that ClsAgent.exe is using C:\Program Files\Common Files\Microsoft
Lync Server 2013\Tracing\default.tmx, which is 23041 KB and dated 8/3/2014.
Anyone else seeing this? Anyone have a fix?

I'm experiencing this issue also. I've updated to latest CU and fixed the agent not starting issue. Now the agents run, and I can see the cache files growing. But I get this blowing up the event log:
Lync Server Centralized Logging Service Agent Service was unable to convert etl trace record(s) to cache record(s)
due to missing message formats and lost these record(s) permanently
Cache file path: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Tracing\CLS_WPP_03-05-2015-16-00-53.cache
Missing message format(s): 2
68fdd900-4a3e-11d1-84f4-0000f80464e3(66)
68fdd900-4a3e-11d1-84f4-0000f80464e3(64)
Cause: Lync Server Centralized Logging Service Agent uses default.tmx file to convert ETL records to binary
cache file records. If it can't find the message format information for a record it will be unable to determine the data types of the insert data for the record and the insert data will be lost. This can happen if the default.tmx file is out of sync
with respect to the code generating the .ETL records.
Resolution:
Verify that default.tmx file is current and update the default.tmx file if necessary. Check if there are any
private bits installed causing default.tmx to be out of sync
Log files created with Search-CsCLSLogging -Output "myfile.log" produce this event and create an empty file.
I've tried copying the default.tmx from the Tracing folder to the Debbing folder, as suggested in other posts, but have the same results.
Interestingly, I can stop the agent service, and run the old OCSLogger Logging Tool program and can produce valid log files.
Any suggestions?

Similar Messages

Event ID 33020 LS Centralized Logging Agent - Error while moving cache files to network share

I have the "AlwaysOn" CLS logging scenario running in my Lync 2013 Enterprise deployment. I did not configure the CacheFileNetworkFolder option since i don't care about retaining these logs anywhere other than on the local drives of the Lync
servers so i just left it blank. Now every few hours or so I am getting Event ID 33020 in each Lync server and SCOM is firing an alert as well.
The CsClsLogging configuration is as follows:
PS C:\> Get-CsClsConfiguration
Identity                      : Global
Scenarios                     : {Name=AlwaysOn, Name=MediaConnectivity, Name=ApplicationSharing,
                                Name=AudioVideoConferencingIssue...}
SearchTerms                   : {Type=Phone;Inserts=ItemE164,ItemURI,ItemSIP,ItemPII,
                                Type=URI;Inserts=ItemURI,ItemSIP,ItemPII,
                                Type=CallId;Inserts=ItemCALLID,ItemURI,ItemSIP,ItemPII,
                                Type=ConfId;Inserts=ItemCONFID,ItemURI,ItemSIP,ItemPII...}
SecurityGroups                : {}
Regions                       : {}
EtlFileFolder                 : C:\CLSTracing
EtlFileRolloverSizeMB         : 20
EtlFileRolloverMinutes        : 60
TmfFileSearchPath             : C:\Program Files\Common Files\Microsoft Lync Server 2013\Tracing\
CacheFileLocalFolders         : C:\CLSTracing
CacheFileNetworkFolder        :
CacheFileLocalRetentionPeriod : 14
CacheFileLocalMaxDiskUsage    : 80
ComponentThrottleLimit        : 5000
ComponentThrottleSample       : 3
MinimumClsAgentServiceVersion : 6
Is there a way to stop the flow of these events without having to configure CLS to transfer the logs to a network share?

Yes, the CacheFileLocalFolders path of 'c:\CLSTracing' is valid on all the Lync servers. The AlwaysOn scenario is started, running and producing .hdr & .cache files in this folder on all servers across my front-end, director and edge pools.
In addition, i am able to search for and extract, valid logging information that i can analyze using Snooper.exe.
Reconfigure the CentralizedLoggingConfiguration how???
Tried setting the CacheFileNetworkFolder value to null by running: Set-CsClsConfiguration -CacheFileNetworkFolder $null and then restarting the CLS agent. As expected, event 33037 fired confirming the settings were received from the CMS.
New config received from CMS
Following are the changed settings:
EtlFileRolloverSizeMB: Old - NULL, New - 20
CacheFileLocalRetentionPeriod: Old - NULL, New - 14
CacheFileLocalMaxDiskUsage: Old - NULL, New - 80
ComponentThrottleLimit: Old - NULL, New - 5000
ComponentThrottleSample: Old - NULL, New - 3
MinimumClsAgentServiceVersion: Old - NULL, New - 6
TmfFileSearchPath: Old - NULL, New - C:\Program Files\Common Files\Microsoft Lync Server 2013\Tracing\
CacheFileLocalFolders: Old - NULL, New - C:\CLSTracing
CacheFileNetworkFolder: Old - NULL, New -
SearchTerms: Old - NULL, New - Type=Phone;Inserts=ItemE164,ItemURI,ItemSIP,ItemPII,Type=URI;Inserts=ItemURI,ItemSIP,ItemPII,Type=CallId;Inserts=ItemCALLID,ItemURI,ItemSIP,ItemPII,Type=ConfId;Inserts=ItemCONFID,ItemURI,ItemSIP,ItemPII,Type=IP;Inserts=ItemIP,ItemIPAddr,ItemIPv6Addr,ItemURI,ItemSIP,ItemPII,Type=SIPContents;Inserts=ItemSIP
Scenarios Added:
Scenario: Name - AlwaysOn
    Provider List:...................... omitted to save space.

Centralized logging service could not be started

When the Lync centralized logginng service agent tries to start I get an error in the Lync server logg on all of the servers.
First I get infromationmessage:
"New config received from CMS. Following are the changed settings: EtlFileRolloverSizeMB: Old - NULL, New - 20.........."
And then an error:
Lync Server Centralized Logging Service Agent Service could not be started.
Exception: Could not load file or assembly 'Microsoft.Rtc.ClsAgent.IISLog, Version=5.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The system cannot find the file specified.
Exception type: FileNotFoundException
Additional Data:
Source: ClsAgent
Stack Tracer.Trace:
at Microsoft.Rtc.ClsAgent.AgentCore.InitializeAgentCore()
at Microsoft.Rtc.ClsAgent.ClsAgent..ctor(ClsAgentService service)
at Microsoft.Rtc.ClsAgent.ClsAgentService.StartAgent()
at Microsoft.Rtc.ClsAgent.ClsAgentService.OnStart(String[] args)
Data: 0 key/value pairs
Inner Exception:
Cause: Exception during startup
Resolution:
Check the events prior to this to resolve the service startup issue."
The service is started though.
Lync 2013 server, CU4.

Hi,
today I have installed all Lync update in two servers, and we have the same issue, on Lync edge server 2013 std ed. and Lync FE server 2013 std. All server are Windows Server 2012 std. ed. with all update.
There is a solution? New fix or a UFFICIAL workaround?
Thanks
Aurelio (5T S.r.l.)
Log Name:      Lync Server
Source:        LS Centralized Logging Agent
Date:          9/28/2014 1:15:41 AM
Event ID:      33005
Task Category: (1007)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:
Description: Lync Server Centralized Logging Service Agent Service could not be started.
Exception: Could not load file or assembly 'Microsoft.Rtc.ClsAgent.IISLog, Version=5.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The system cannot find the file specified.
Exception type: FileNotFoundException
Additional Data:
Source: ClsAgent
Stack Tracer.Trace:
   at Microsoft.Rtc.ClsAgent.AgentCore.InitializeAgentCore()
   at Microsoft.Rtc.ClsAgent.ClsAgent..ctor(ClsAgentService service)
   at Microsoft.Rtc.ClsAgent.ClsAgentService.StartAgent()
   at Microsoft.Rtc.ClsAgent.ClsAgentService.OnStart(String[] args)
Data: 0 key/value pairs
Inner Exception:
Cause: Exception during startup
Resolution:
Check the events prior to this to resolve the service startup issue.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="LS Centralized Logging Agent" />
    <EventID Qualifiers="50159">33005</EventID>
    <Level>2</Level>
    <Task>1007</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-09-27T23:15:41.000000000Z" />
    <EventRecordID>10569118</EventRecordID>
    <Channel>Lync Server</Channel>
    <Computer>               .5t.torino.it</Computer>
    <Security />
</System>
<EventData>
    <Data>Could not load file or assembly 'Microsoft.Rtc.ClsAgent.IISLog, Version=5.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The system cannot find the file specified.
Exception type: FileNotFoundException
Additional Data:
Source: ClsAgent
Stack Tracer.Trace:
   at Microsoft.Rtc.ClsAgent.AgentCore.InitializeAgentCore()
   at Microsoft.Rtc.ClsAgent.ClsAgent..ctor(ClsAgentService service)
   at Microsoft.Rtc.ClsAgent.ClsAgentService.StartAgent()
   at Microsoft.Rtc.ClsAgent.ClsAgentService.OnStart(String[] args)
Data: 0 key/value pairs
Inner Exception:
</Data>
</EventData>
</Event>
Check the events prior to this to resolve the service startup issue.

Centralized logging producing empty log files searches

Not sure what I am doing wrong here. Experimenting with Lync 2013 Centralized logging. I started the AlwaysOn scenario which was off by default. I checked the directories on all 3 of my FE servers and a bunch of ETL files are present so it's doing something.
Thing is, no matter how I search, the output or the log file if I pipe the output is always zero. Following the Microsoft document on Centralized Logging. They make it look so easy. Anyone has success with this tool? Seems like a nice feature and more convenient
than ocslogger but its not producing the correct search results.

I am quickly finding out that this utility is nothing but a headache. I am getting errors in the Lync Server log telling me the threshold for logging has been reached. I changed the
CacheFileMaxDiskUsage from 80 to 20. 80%!! Seriously. Who wants a utility to take 80% of the disk space! Even at 20%, with a 125GB drive, I should be able to go up to 25GB. The ETL file was 14MB and I started getting errors saying the threshold
was reached!
Then, I could not stop the scenario. I tried 3 times. Either it would keep running or I got some weird error. I finally spelled AlwaysOn with the caps like it was case sensitive and it worked. This utility is whacked. Maybe I am doing something wrong.
According to MS article CacheFileMaxDiskUsage is Defined as the percentage of disk space that can be used by the cache files. So, 20 for this value means 20% of 125GB or if its talking about free disk space, 18GB in my case. Below is the error I am
getting: 90,479.939.584 is the amount of free space on the disk. I did do the search again and it did work this time. I restarted the Agent on all FE servers. If I can get around this threshold error I think I am in business.
Lync Server Centralized Logging Service Agent Service reached the local disk usage threshold and no network share is configured
EtlFileFolder: c:\temp\tracing - 90,479,939,584 (67.47 %)
CacheFileLocalMaxDiskUsage: 20 %
CacheFileLocalFolders:
c:\temp\tracing - 90,479,939,584 (67.47 %)
CacheFileNetworkFolder: Not set
Cause: Lync Server Centralized Logging Service Agent Service will stop tracing when the local disk usage threshold is reached and no network share is configured. Verify CLS configuration using Get-CsCentralizedLoggingConfiguration. Necessary scenarios will
need to be re-enabled once the more space is made available locally or a network share is configured
Resolution:
Free up local disk space, or increase disk usage threshold for CLS, or configure network share with write permissions for Network Service account

SOA Suite Centralized Logging

Hi, This is Sushil
Can I have a centralized logging mechanism for a SOA project. Is there any way I can use the ESB as a mechanism for centralized logging of messages received by it. Or else does OWSM support logging?
In this case, will there be any performance overhead as all requests will first be intercepted by the OWSM before calling the actual service?
Kindly advice on these. Thanks in advance

There are several options. If you use OWSM, you can define logging rules within the policy. These logging rules can log request, reply or both in the WSM log. Personally I don't like this one, since you can't do anything specific with these logs.
Another option is to publish logging events to ESB (xml message with your logging info into routing service), and route these to a database or file adapter to log to either a table or a file. Then you can decide what you want to do with the logs....
HTH,
Bas

Centralized logging and october update?

In the september cumulative update there was a known issue:
http://support2.microsoft.com/kb/2987511
Symptoms
After you install this cumulative update on a system that is running Microsoft Lync Server 2013, you find that the Central Logging Service is not listening on designated ports. This means the Central Logging Service does not start or capture data. When
this issue occurs, an exception error message that resembles the following is logged in the event log:
Workaround
To work around this issue, you must follow one of these methods based on your scenarios:
Scenario 1
If you do not have August 2014 Cumulative Update 5.0.8308.738 installed, install the following OCSCore.msp from the August 2014 Cumulative Update 5.0.8308.738, and then install this September 2014 Cumulative Update 5.0.8308.815.
In the october cumulative update that known issue is not included? And it says that it replaces the september update?
http://support2.microsoft.com/kb/3003358/en-us?sd=rss&spid=924
Does this mean that you dont have to make the workaround in the october update? I have still not installed the august cumulative or the september cumulative. Only the security update that broke clsagent.
https://social.technet.microsoft.com/Forums/en-US/8ab9efac-13d1-43b7-8da9-3ab770d809b2/centralized-logging-service-could-not-be-started?forum=lyncdeploy

Hi,
Yes, please always keep your server up to date.
Thanks,
Simon Wu
TechNet Community Support

How to enable the Exchange 2010 Admin Audit logs in Event Viewer

How to enable the Exchange 2010 Admin Audit(Mailbox Auditing) logs in Event Viewer.
- Sivashankar. Please mark as answer/useful if my contribution is helpful

Hi Siva,
We could execute the command below to view Administrator Audit Logging settings:
Get-AdminAuditLogConfig
If it is not enabled, please run the command below:
Set-AdminAuditLogConfig -AdminAuditLogEnabled $True
In addition, here are some references for you to utilize this feature:
Configure Administrator Audit Logging :
http://technet.microsoft.com/en-us/library/dd335109(v=exchg.141).aspx
Search the Administrator Audit Log :
http://technet.microsoft.com/en-us/library/ff459262(v=exchg.141).aspx
Regards,
Rebecca Tu
TechNet Community Support

Agent Event Detail Box

Hello,
The Agent event detail box in the Agent Distribution tab of the Call Manager peripheral of the PG Explorer in ICM is not enabled. I remember being told during installation that if checked it unnecessarily increase CPU usage. With the Agent event detail box unchecked, the Agent Not Ready reports (Agent30 and Angent31) in Webview are always blank and a couple of managers are now asking for those reports.
Can anyone confirm that theory on CPU utilization when Agent event detail is enabled?
Thanks,
MB

I have a customer with a decent sized contact center - 2 CM clusters, 1200 agents. I check "Agent Detail" but leave "Enable Agent Reporting" unchecked.
You do want that Agent Detail on. I vaguely remember many years back that there were some warnings about the CPU usage on agent detail, but I would not worry about it.
What version of UCCE are you on?
Regards,
Geoff

Logging of events

I would like to create a file that will log certain events.
How should I create this file without overwriting this?
If I use FileOutputStream,then the file passed to this constructor will overwrite the existing file.?
Is there any way for me to create a log file once and keep appending events to the log file?
An early answer is appreciated.
Ajay Luthria

Do I understand you correct?
You want to open a file and write to it as a log?
Start with rotate the file (toDaysDate.log) at startup, create a new file and send all logevents to that class. The stream should just append a line at a time.
there is a lot you can do, like tracelevel for different levels of severity and so on. ( different logs for different severitys).
Most common i guess is to write System.out and System.err to two different files.
Hope I could help you.
\\Lasse

Data Access Service is unable to log audit events to the security event log

Hi,
Scenario: SCOM 2012 R2 UR4. (Windows 2012 R2)
Today SCOM have generated 4 alerts Data Access Service is unable to log audit events to the security event log.
The service account for "System Center Data Access Service" service is "Local System".
The users at "Generate security audits" are: LOCAL SERVICE and NETWORK SERVICE.
The question is:
how to resolve this alert? (Where look for to obtain more information to resolve this problem)
Thanks in advance!

Local system account is differet to local service account. Fo detail description of these accounts, pls. refer
LocalService Account
http://msdn.microsoft.com/en-us/library/windows/desktop/ms684188(v=vs.85).aspx
LocalSystem Account
http://msdn.microsoft.com/en-us/library/windows/desktop/ms684190(v=vs.85).aspx
Generate security audits which is under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment of Group policy, determines which accounts can be used by a process to add entries to the security log. This user right
is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers. By default, only the LocalSystem account has the privilege to be used by processes to generate security audits.
For identified the SDK account
1) open services.msc
2) From the system Center Data Access Service, you can see the SDK logon on as account
Roger

How to receive a mail when an error is logged in event log

Hi,
How to receive a mail automatically when an error is logged in event log?
I tried the steps in the below link but still i am not able to receive the mail.
http://blogs.iis.net/rickbarber/archive/2012/10/26/send-an-email-when-an-event-is-logged.aspx
Thanks,

Hi,
The steps are correct so as Dai said you may need to check your SMTP server. Any error or event received related to SMTP server?
Another related article for setup email notification:
http://blogs.technet.com/b/jhoward/archive/2010/06/16/getting-event-log-contents-by-email-on-an-event-log-trigger.aspx
If you have any feedback on our support, please send to [email protected]

SCCM 2012 OSD: central logging, smsts.log

Hi,
Is there a way to follow an SCCM MDT integrated task sequence in real time?
We configured central logging and this is working fine, though it is only BDD.log that is copied. When task sequence fails or is succesfull the other files are copied too.
We want to have the possibilty to monitor in real time, without needing to go on the machine itself and open smsts.log.
Please advise.
J.
Jan Hoedt

I first created threads about configuring central logging in SCCM, numerous indeed.
That worked fine but then we decided to go to MDT logging, again some threads.
No logging is satisfactory to us, neither is the status message. I don't get the concept of the satus message, why is it there whereas smsts.log is containing all logdata.
We deploy a lot of machines to debug. These are on the central logging share. Loggings like smsts.log also can easily be sent for comment when issues. To be able to debug correctly, we need the smsts.log, it's a struggle each time to go on the machine and
get the smsts.log (when machine is in winpe-phase or has network issues. I don't understand why a simple concept = central logging of smsts.log (not the status messages) is that hard to configure/would not exist at all.
Jan Hoedt

Logging Sensor Events without Sensor Diagnostic Tool

Hello,
I am currently working on develpment of Sensor Driver (Accelerometer)- UMDF Driver on windows 7.
As per documentation when we use Sensor API, the sensor Events can be captured and logged into CSV or xml through sensordiagnostictool.exe
Is there a way I can log Sensor Events by writing an external Application?
If yes, Please suggest me the thread to start with.
Thanks!

If LOGGING_SYNC is deactivated in IE Configuration, then you cannot see th req. and resp. message in MONI.
Synch. messages are not persistence by default. To acheive it, we need to set the logging.
Thanks
Farooq.

Decrypting NAC appliance agent event logs

Talking about the Mac NAC agent the CAM config guide says...
'The Log file (~/Library/Application Support/Cisco Systems/CCAAgent/event.log) is encrypted. The user must use the decryption tool on Windows to see the log in clear text.'
Does any one know what decryption tool they are talking about.

I was told by TAC that logs are encrypted to prevent shared secrets and the like being taken and ONLY TAC persons have the decrypter. I have no idea if that applies here or is even necessarily true, but it's what I was told. So I would contact TAC and upload the log.

Cisco Context Directory Agent - Windows logs - Forwarded events

Hello,
I have a setup testing with Cisco ASA, Cisco CDA and MS 2012 R2. All this works fine. Only problem I encountered is that I want to read the forwarded events on the AD LDS server instead of the security events.
So in small words is it possible to connect CDA agent with wmi to forwarded events instead of security logs?
Is this possible?
Thanks,
Mark Post

Hi,
I applied the solutions mentioned above, but now i get the below error. Domain still shows as down.
wmi-property
exception-stack
org.jinterop.dcom.core.JIRemUnknownServer.call(JIRemUnknownServer.java:158)
org.jinterop.dcom.core.JIRemUnknownServer.addRef_ReleaseRef(JIRemUnknownServer.java:181)
org.jinterop.dcom.core.JISession.releaseRef(JISession.java:805)
org.jinterop.dcom.core.JIComServer.createInstance(JIComServer.java:777)
com.cisco.cda.rt.adobserver.adobserver.jinteropUtil.getWmiLocator(jinteropUtil.java:40)
com.cisco.cda.rt.adobserver.adobserver.EventsThread.QueryWMIProperty(EventsThread.java:83)
com.cisco.cda.rt.adobserver.adobserver.EventsThread.getNetBIOS(EventsThread.java:171)
com.cisco.cda.rt.adobserver.adobserver.EventsThread.extractDCData(EventsThread.java:203)
com.cisco.cda.rt.adobserver.adobserver.EventsThread.run(EventsThread.java:599)
dc-hostname
dc-name
exception-cause
java.net.ConnectException: Connection timed out
wmi-class
Win32_NTDomain
exception-message
An internal error occurred. [0x8001FFFF]
wmi-property
DomainName
dc-username
Any Idea on the error?
Thanks.

LS Centralized Logging Agent Event ID 33041

Similar Messages

Maybe you are looking for