Splunk to monitor Skype

[ansif]

Is there any solution to monitor Skype for business using Splunk?

[fainaz]

Running CLS 24x7 to feed Splunk will affect the Skype for Business FE servers and it is not a good idea. I would like to know if Splunk accepts data from Skype SDN?
Skype SDN collects call quality information from Skype servers and provide to third party as xml file. Please let me know if Splunk can accept it.

Regards,
Fainaz

[nickhills · Accepted solution]

It depends on which elements of SFB you are interested in?

Your SFB application servers will log some elements in the windows security/app logs for key events, but will not give you insight into calls/quality/IM etc.

For client side logging, you can enable client debug logging, and then add an input on your client machines to collect these files:
https://support.office.com/en-us/article/turn-on-error-logs-in-skype-for-business-4892fe33-ef40-48e2...

For detailed logging of calls and experience you will need to configure the Central Logging Service (CLS logger) in your SFB deployment.
https://technet.microsoft.com/en-us/library/mt126706.aspx
You can configure the elements you wish to log, the specific events or users, and CLS will perform the specified tracing for those calls.

Typically one uses the MS tool to read these logs, but with a little scripting, you can use powershell to output relevant data, which you could either write to a separate log file, or ingest from stdout.

[fainaz]

In order to read CLS or UCCAPI client logs, we would not be requiring Splunk.
I believe tools like Splunk with Skype for Business will be used when an organization wants monitor their real time/historical call history and call quality information.
This is done by Skype SDN which is a dedicated server to feed call quality information to third parties like Vyopta, Prognosis etc.

My question is, will Splunk support gathering data from Skype SDN server? Please let me know.

Regards,
Fainaz
+6597298732
Singapore