Wednesday, February 8, 2012

Lync Snooper: More Than Just Log Analysis (Reporting)

I recently ran across some great features in the Snooper tool that I not very aware about.  Snooper is part of the Resource Kit Tools and is primarily used to analyze logs generated from the Lync Server Logging Tool.

When Snooper is open, clicking on the “Reports” menu will expose options for querying the backend database for errors, user activity, conferencing statistics, etc.

Lync - Snooper - Reports menu

Error Analysis…

When clicking on the “Error Analysis…” option, you will need to fill in the blanks for the Lync SQL instance that holds the Monitoring database.  This report will show errors generated by client programs.

Lync - Snooper - Analyze error reports

Here you have the option of searching for errors by user or by error.  Also, selecting the “Generate Error Report” option will give a web view of the report.  Below are example outputs.

Lync - Snooper - Analyze error reports - list

Lync - Snooper - Analyze error reports - generate

Conferencing and Presence…

The “Conferencing and Presence” option has several great reports to choose from.  Start by entering in the SQL instance name that contains the backend RTC database, then choose the report to run.  A few example report outputs follow.

Lync - Snooper - Conf Pres reports


The User report has a ton of information in it.  By searching on a user’s sip address, a few of the things that can be seen include:

  • Pool information
  • Contact information
  • Conferencing data
  • Certificates provisioned to user

Lync - Snooper - Conf Pres reports - user1

Lync - Snooper - Conf Pres reports - user2


I was really impressed by the Conference reports.  By searching on a conference ID, a few of the things that can be seen include:

  • Conference scheduling time
  • Access times
  • Invitees and roles
  • MCUs used
  • Which attendee used which MCUs

Lync - Snooper - Conf Pres reports - conf1

Lync - Snooper - Conf Pres reports - conf2

I am not showing examples of the Resolve Conference, MCU Health, or Diagnostic reports.  Check them out, there is some great information.

Stored Procedure Error Analysis…

This report shows SQL stored procedure errors over a specified block of time.  Start by entering in the SQL instance name that contains the Lync databases, then choose a date range.  This will list and graph any errors found.

Lync - Snooper - Stored Proc reports

I know I will definitely be using Snopper then more than just log analysis.  Hope this helps.


  1. Great. Thanks for he heads up!

  2. Hey Tim, what do you use for looking at the logging on the Mac Client, because snooper doesn't work. i have just been using CM-trace

    Matt Helfer

    1. Disregard Tim, i was opening the wrong file for the Mac log. I was able to get it to work thanks bud.

      Matt Helfer

  3. Tim, have you seen this work against the Lync 2013 Servers yet? I am receiving an error, "The database was not a version we understand. Expected 59, but found 125." So, the tool does not seem to like a SQL Server 2012 back end.

    Naturally, the Lync 2013 Snooper tool does not have these Reports.

  4. Snooper tries to query RTC DB which just not exist in 2013 evironment.

  5. Selamat datang di Situs IDN Poker Android uang asli minimal deposit 10ribu rupiah terpercaya. Kunjungi situs resmi kami sekarang juga dan daftarkan diri kalian pada laman pendaftaran yang telah disediakan.

  6. Suggest good information in this message, click here.