Great info on Lync Client LoggingRegistry Keys
http://blogs.technet.com/b/rischwen/archive/2013/11/18/lync-2013-uccapi-logging-configuration.aspx
Start, Run, and Paste:
Lync 2013:
%LOCALAPPDATA%\Microsoft\Office\15.0\Lync\Tracing\
Lync 2010:
%UserProfile%\Tracing
Lync Windows 8 App:
%LOCALAPPDATA%\Packages\Microsoft.LyncMX_8wekyb3d8bbwe\LocalState\Tracing
Lync Web App (WebBrowser Plugin):
%LOCALAPPDATA%\Microsoft\LWAPlugin\Tracing
Following steps for how to read ETL files:
1. Rename.etl file to sipstack.etl
2. Copy itto the folder "c:\windows\tracing" on Lync FE server.
3. Open"Lync Server 2010 Logging Tool", click "Analyze Log files",it will load sipstack.etl file from the folder"c:\windows\tracing".
4. Check"SIPStack" in that box and click "Analyze" then itwill launch Snooper.exe to read those logs from .etl file.(Make sure LyncServer resource kit has been installed in Lync FE server.)
Protocolsused by Lync
http://blog.greenl.ee/2013/01/24/protocols-lync/
Deep dive:
http://msdn.microsoft.com/en-us/library/cc307432(v=office.12).aspxALL
http://msdn.microsoft.com/en-us/library/dd949502(v=office.12).aspx
http://msdn.microsoft.com/en-us/library/cc431491(v=office.12).aspx
http://tools.ietf.org/html/rfc4566
http://msdn.microsoft.com/en-us/library/cc431498(v=office.12).aspx
http://www.ietf.org/rfc/rfc3261.txtSIP
http://msdn.microsoft.com/en-us/library/ff595355(v=office.12).aspxPSOM
Standards Track[Page 8]
RFC 4566SDPJuly 2006
Session description
v=(protocol version)
o=(originator and session identifier)
s=(session name)
i=* (session information)
u=* (URI of description)
e=* (email address)
p=* (phone number)
c=* (connection information -- not required if included in
all media)
b=* (zero or more bandwidth information lines)
One or more time descriptions ("t=" and "r=" lines; see below)
z=* (time zone adjustments)
k=* (encryption key)
a=* (zero or more session attribute lines)
Zero or more media descriptions
Time description
t=(time the session is active)
r=* (zero or more repeat times)
Media description, if present
m=(media name and transport address)
i=* (media title)
c=* (connection information -- optional if included at
session level)
b=* (zero or more bandwidth information lines)
k=* (encryption key)
a=* (zero or more media attribute lines)
Web Conferencing Traffic Traversal
http://technet.microsoft.com/en-us/library/gg195797(v=ocs.14).aspx