See: http://webmaxtor.blogspot.com/2011/01/find-gateway-associated-with-cucm.html for similar information related to MGCP gateways dropping.
After configuring RTMT NumberOfRegisteredPhonesDropped alert to deliver information via email, I found associated phone device details are not included in the email. This can be a real problem on larger scale deployments and no other reporting tools available.
To find the devices in question:
- Freak out when receiving [RTMT-ALERT-StandAloneCluster] NumberOfRegisteredPhonesDropped alert.
- Hope the traces have been enabled in CUCM. The default Error level on CallManager should be sufficient.
- Go to RTMT | SysLog Viewer, and select a Node at the top of the right pane (the logs are specific to servers, so this might be tedious).
- In the Logs tab, go to Application Logs | AlternateSyslog .
- Your results may vary depending on versions. Your option may be Application Logs | Archive | CiscoSysLog or something similar.
- In the bottom grid, scroll to the approximate time of the alert.
- If you choose the Save button at the bottom of the screen, you can save the AlternateSyslog to a text file to be searched with a text editor (Use something besides MS Notepad to save yourself headaches. I like Notepad++ at http://notepad-plus-plus.org/).
- Search for EndPointUnregistered, StationConnectionError or maybe DeviceTransientConnection in the Message column.
- The DeviceName, IP address, Description, etc. of the affected device(s) will be included in the message.
- Note the Reason value in the message. It will shed light on why the device is unregistered.
- Search http://www.cisco.com for System Error Messages for Cisco Unified Communications Manager and find one appropriate to your CUCM version.
- Search that document for EndPointUnregistered for a description of why a phone was unregistered.
- Fix something.
If you're in the right place, here's what it looks like on a CUCM 8.6 using RTMT 8.91: