If you actually started logging with OCSLogger, you could also verify that bytes were written onto disk, but once you started analyzing the trace, you find the OCSLogger file and the Snooper EMPTY.
So there are some reasons due to OCSLogger is NOT a supported method any longer how we should analyze log's. Better and suggested is the Central Logging Service. This is why we have some issue after we deployed Snooper. (Sounds wirred, is wirred)
But Snooper is still the best and optimal solution identifying issues. So what could this have caused:
1. Your OS is other than EN-US, this means, you have to ensure that your DATE and TIME Format is set to ENGLISH (United States). (While the location is not relevant!)
2. You have applied an Update, e.g. CU 3. In this case your issues is, where files are or arn't correctly replaced.
You have to manually copy the default.tmx and default.xml file into your Debugging Tools folder (C:\Program Files\Microsoft Lync Server 2013\Debugging Tools)
Destination Location (default):
Source Location (default):
Navigate to C:\Program Files\Common Files\Microsoft Lync Server 2013\Tracing and cope the default.tmx and default.xml file to the destination location.
Now when you click the Analyze Log Files button in the Lync Server 2013 Logging Tool, the SIPStack messages will be displayed.
While the preferred method of logging in Lync Server 2013 is to utilize the Centralized Logging Service, if you still prefer using the Lync Server 2013 Logging Tool/GUI to configure logging, then make sure to follow the steps above.
Author: Thomas Pött Managing Consultant Microsoft UC