Skype for Business


Skype for Business

Skype for Business

Remote Action: Skype for Business Diagnostic

This remote action collects information every hour about Skype for Business for active devices. It creates 24 log files where every call is monitored and stored in its correspondent file.

The calls diagnostic stored in the engine, is the sumatory of those files with the data within the last 24 hours.

When the remote action is executed, it rotates all files and removes the last one if the elapsed time from the last execution is greater than one hour, otherwise the information gathered in the execution will be saved in the last file, replacing the information in it.

Make sure you have FULL or LIGHT logs enabled for Skype.

see how to enable Skype For Business/Lync logging

You should get the logs written on one of these two folders depending on the Skype version: %LocalAppData%\Microsoft\Office\16.0\Lync\Tracing **FOR SKYPE 2016** %LocalAppData%\Microsoft\Office\15.0\Lync\Tracing **FOR SKYPE 2015**

If the log files are empty, the Remote Action will not be able to return any Skype calls data.

Input parameters

  • MinSecondsForCall: If the time since the call is established until it is finished is lower than the provided value, the call is considered as short. It is categorized in this way because some calls may become short due to technical issues.
  • NumHoursForTimeout: The maximum duration to consider an unfinished call as dropped call. When the remote action is being executed, there may be calls in progress, hence they are stored in a cache file. For the following attempts, if the duration of the call passes the provided value, it is categorized as dropped. The purpose of this value is to categorize dropped and unfinished calls properly, because they have the same traces in the Skype for Business logs.

The first value is useful for identifying calls properly established and dropped by either the caller or the receiver, but whose duration was too short to consider them as "normal" call. It covers the cases when the device is muted, or a wrong audio device was selected and the user has to leave the call and set it up again, etc.

The second parameter is useful for identifying calls established but still in progress or the ones which, due to a Skype crash, don't have the proper termination traces, hence they are never finished. When a call reaches the considered time, they are considered as dropped.

Desired remote action configuration

  • Schedule time: Hourly. Recommended value, because otherwise the calls information is not stored within the set of logs properly hence it could imply a loss of data.
  • User context: Current interactive user. The remote action needs to access data that is stored in the user folder.
  • Timeout: At least 165 seconds. The remote action has an initial wait up to 45 seconds to avoid a huge quantity of devices writing the results in the engine at the same time.

How the remote action identifies each call result

To identify calls and process them properly, the remote action performs the following steps while it is reading text blocks from the Skype for Business logs:

The text "[xxx]" in the following examples, represents a text that is skipped, it is usually the user identity or email.

  • Detects the request of a call by getting this message:

INFO  :: INVITE [xxx] SIP/2.0

  • If the request block does not have these content types, it is skipped:

application/sdp multipart/alternative

  • If the block is taken, the call mode is identified by these tags for audio, video or screen/application sharing:

m=audio m=video m=applicationsharing-video m=applicationsharing

  • In case of gathering a CANCEL or DECLINE block, then it tries to get the reason of it by getting the value until the first ';' from ms client diagnostics node:

CANCEL [xxx] SIP/2.0 SIP/2.0 [xxx] DECLINE ms-client-diagnostics: [NUMBER]

  • If the value is 51004, then the call is categorized as REJECTED and it does not count for the statistics.
  • Otherwise, the call is categorized as FAILED.
  • In case of gathering the BYE block, it means that the call was established and initiated, so then:

BYE [xxx] SIP/2.0

  • If the value from ms client diagnostics is 51004, then it is categorized as SUCCESSFUL, because this value is used also for calls finished properly when they have the BYE block.
  • Otherwise, the call is categorized as DROPPED and the remote action tries to get the reason from ms client diagnostics node.
  • In case of gathering the SERVICE block, it contains the VQReport with details about the call:

SERVICE [xxx] SIP/2.0

  • When the result of the call is SUCCESSFUL, then the quality is measured, categorizing the call as POOR in case of any value is over the threshold recommended by Microsoft.

As it was mentioned before, the remote action stores calls information in several files. The calls with the INVITE block but without the BYE, nor DECLINE, nor CANCEL, are considered calls in progress, hence are stored in a .cache file. If after several remote action executions, the call duration is over the provided value in the parameter NumHoursForTimeout, then it is categorized as DROPPED, having an Unknown reason for the problem.

About the collected metrics/data

The values about the quality call are computed by Skype for Business and stored in the VQReport node within the log file. The remote action does not perform any calculation.

Those values are only available when the result of the call is SUCCESSFUL or POOR (it is categorized as POOR depending on the values), for FAILED and DROPPED only the main reason is provided.

The data collection is performed as detailed on the following link: skype metrics

Nexthink does not modify those values.

Calls statuses

All these types of calls can reach one o more of these final statuses:

  • Successful call: A call of any type which was established and did not have any problem.
  • Failed call: A call of any type which could not be established, or the destination did not receive, typically due to network issues. The users could not communicate each other because the call was not started, it was only an attempt.
  • Dropped call: A call of any type which was established correctly but due to serious issues, was cancelled. Skype cancelled the communication automatically. If the users had finished the communication manually due to network issues, it would become a poor call.
  • Poor call: A call of any type which was established but had some quality issues. A poor call may become dropped call if it is cancelled by Skype for Business.
  • Rejected call: A call of any type which was cancelled by the caller or declined by the receiver before it can be established. This status is not considered by the remote action.
  • Short calls: Uses input parameter "Min Seconds For Call". A call whose duration is lower than X seconds is a short call. The calls not answered by the receiver are not included here, because they were not established.

=How to interprete the NXT logs

About Nexthink Logs

The Nexthink logs are the files where the Remote Action stores the calls informaition for a day. They are available at this location: %LOCALAPPDATA%\Nexthink\SkypeForBusiness

Below you can see the data format:

Mode Quality Bad result reasons Duration Wifi
0 0 0 10 0
0 1/2 0 100 1
0 3 1 "Reason Network 1" 50
0 4/5 2 "Reason Network 2" 20
1 0 0 30 1
1 1/2 0 120 0
1 3 1 "Reason Timeout 1" 1000
1 4/5 2 "Reason Network 3" 500

Nexthink Logs details:

Mode attribute may be:

  • 0 = Audio
  • 1 = Video
  • 2 = Sharing


  • may be 0 if good
  • 1 .. 13 if poor.

If poor, several values separated by '/' are accepted. Possible values in case of poor quality:

  • 0 = Good
  • 1 = PoorMOS
  • 2 = PoorRoundTrip
  • 3 = PoorPacketLoss
  • 4 = PoorJitter
  • 5 = PoorConcealed
  • 6 = PoorVideoPostFECPLR
  • 7 = PoorVideoLocalFrameLoss
  • 8 = PoorRecvFrameRate
  • 9 = PoorLowFrameRate
  • 10 = PoorVideoPacketLoss
  • 11 = PoorVideoFrameRate
  • 12 = PoorDynamicCapability
  • 13 = PoorRelativeOneWay

result may be:

  • -2 = Unfinished (only for cache, not to be included in log)
  • -1 = Rejected/Canceled
  • 0 = Successful
  • 1 = Failed
  • 2 = Dropped

bad_result_reason attribute

contains a string with the reason for the call to be dropped/failed.

It may also be empty (result = Successful).

duration attribute

is the number of seconds that the call lasted.

wifi attribute

may be:

  • 0 = Wired
  • 1 = WiFi

Additional attributes might be available (e.g. device used for the communication).

Recommendation is to execute this remote action every hour to be able to access the generated files for each hour.