none
Centralized logging service could not be started

    Question

  • When the Lync centralized logginng service agent tries to start I get an error in the Lync server logg on all of the servers.

    First I get infromationmessage:

    "New config received from CMS. Following are the changed settings:  EtlFileRolloverSizeMB: Old - NULL, New - 20.........."

    And then an error:

    Lync Server Centralized Logging Service Agent Service could not be started.

    Exception: Could not load file or assembly 'Microsoft.Rtc.ClsAgent.IISLog, Version=5.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The system cannot find the file specified.
    Exception type: FileNotFoundException
    Additional Data:
    Source: ClsAgent
    Stack Tracer.Trace:
       at Microsoft.Rtc.ClsAgent.AgentCore.InitializeAgentCore()
       at Microsoft.Rtc.ClsAgent.ClsAgent..ctor(ClsAgentService service)
       at Microsoft.Rtc.ClsAgent.ClsAgentService.StartAgent()
       at Microsoft.Rtc.ClsAgent.ClsAgentService.OnStart(String[] args)
    Data: 0 key/value pairs
    Inner Exception:

    Cause: Exception during startup
    Resolution:
    Check the events prior to this to resolve the service startup issue."

    The service is started though.

    Lync 2013 server, CU4.

    Tuesday, September 16, 2014 6:53 AM

Answers

  • Microsoft has updated the kb:

    http://support2.microsoft.com/kb/2986072/en-us?sd=rss&spid=924

    Known issues

    • Symptoms
      After you install this security update on a system that is running Microsoft Lync Server 2013, you find that the Central Logging Service is not listening on designated ports. This causes the Central Logging Service not to start or capture data. When the problem occurs, an exception error message that resembles the following is logged in the event log: 
    • Cause
      This problem can occur if you install this security update on Lync Server 2013 before you install the August Update of Lync Server 2013.  

    To resolve this issue, install the following cumulative update:
    3003358
    (http://support.microsoft.com/kb/3003358/ )
    October 2014 Cumulative Update 5.0.8308.831 for Lync Server 2013 core components 



    • Marked as answer by Harmankardon Friday, October 10, 2014 6:19 AM
    • Edited by Harmankardon Monday, November 03, 2014 8:10 AM MS updated the KB
    Friday, October 10, 2014 6:19 AM
  • This guy found a fix:

    http://aspoc.net/archives/2014/09/30/error-lync-server-centralized-logging-service-could-not-be-started/

    The bad news though is that I cant find a correct version of that file. It does not seem to be included at all in the ocscore.msi-package for example.
    • Marked as answer by Harmankardon Wednesday, October 01, 2014 6:22 AM
    • Edited by Harmankardon Wednesday, October 01, 2014 6:41 AM
    Wednesday, October 01, 2014 6:22 AM

All replies

  • Could you please help with  "the events prior to this to resolve the service startup issue" from the event veiwer


    Please remember, if you see a post that helped you please click ;Vote As Helpful" and if it answered your question please click "Mark As Answer" Regards Edwin Anthony Joseph

    Tuesday, September 16, 2014 2:46 PM
  • Very strange-I'm having exactly the same problem on multiple front ends after patching them yesterday.  I'm going to try backing out some of the updates and seeing what happens.
    Tuesday, September 16, 2014 6:13 PM
  • There are no events related to lync logging in the eventlog. Only informational messages. One of them is the one above about the config for cls.
    Tuesday, September 16, 2014 7:33 PM
  • Did we apply the update to the backend SQL database as well ?

    Please check windows System Logs are there are startup issue?


    Please remember, if you see a post that helped you please click ;Vote As Helpful" and if it answered your question please click "Mark As Answer" Regards Edwin Anthony Joseph

    Wednesday, September 17, 2014 5:16 AM
  • There are no other errors that could be related.

    This issue has started the last few days. It could be some windows update like Chris suggested.

    The SQL update for the backend was applied long ago. 

    Wednesday, September 17, 2014 6:21 AM
  • Hi,

    Did you change anything from Topology or others in Lync Server environment?

    If yes, please try to run Step 2-Setup or Remove Lync Server Components again to test the issue.

    Also the Centralized Logging Service stops if network traffic is disrupted when log files are being copied to network share. To identify the issue, monitor the event log for Event ID 7031 from the "Service Control Manager" that logs when the "Lync Server Centralized Logging Service Agent" service has terminated unexpectedly. If this happens more than three times, try to manually restart the service by using the Start-CsWindowService cmdlet.

    Best Regards,

    Eason Huang


    Eason Huang
    TechNet Community Support

    Wednesday, September 17, 2014 7:16 AM
    Moderator
  • The service does not crash according to the system log. It is running in services and the process is also running.

    Nothing has changed in the topology. Only change that could have an impact is regular windows updates.

    Wednesday, September 17, 2014 8:23 AM
  • I just confirmed that the problem is with this update: Lync server 2013 core components (KB2992965) 5.0.8308.803.  Go into the installed updates, remove it (on every server), and restart and centralized logging works again. 

    Hopefully this update either gets pulled or revised soon-it looks like it's missing a dependency. 

    Note that I was able to confirm that this same issue was happening on both front end and edge servers, and on both Server 2012 and 2012 R2.  I installed all the other Windows updates at the same time (on Monday), so everything on the OS should be current.  Back end DB updates were installed ages ago, and re-running setup or the bootstrapper on the servers had no effect.  Removing the update seems to be the only solution so far. 

    • Proposed as answer by Chris Bardon Wednesday, September 17, 2014 2:09 PM
    Wednesday, September 17, 2014 2:08 PM
  • I just confirmed that the problem is with this update: Lync server 2013 core components (KB2992965) 5.0.8308.803.  Go into the installed updates, remove it (on every server), and restart and centralized logging works again. 

    Hopefully this update either gets pulled or revised soon-it looks like it's missing a dependency. 

    Note that I was able to confirm that this same issue was happening on both front end and edge servers, and on both Server 2012 and 2012 R2.  I installed all the other Windows updates at the same time (on Monday), so everything on the OS should be current.  Back end DB updates were installed ages ago, and re-running setup or the bootstrapper on the servers had no effect.  Removing the update seems to be the only solution so far. 

    nice solution, solved same problem for us

    Friday, September 19, 2014 4:43 PM
  • Everyone who did this fix, watch out. Removing the Core Services update may return logging to its working state, but other things will start to go south. I just got off the phone with M$ support as we lost all access to MCUs and RGS services. I was told that the Core Services update actually updates the CMS store on the backend with new data. The old Core Services service cant find specific pointers because they have been changed.  I spent the past 6 hours re-applying this patch to all our front end and edge servers to get meeting and RGS content back online.

    It took about 9 hours for the issues to make themselves known. I've been able to recreate the scenario in our lab environment.

    Friday, September 19, 2014 8:02 PM
  • Same here. All updates applied on all servers. CLS is working on all 2008R2 machines but not on all 2012 machines.
    Monday, September 22, 2014 7:45 AM
  • I have the issue on a 2008 R2 environment so the issue does not look to be isolated to 2012.    Has anyone heard from microsoft on a cause?

    William,  when you re-applied the patch did it resolve the issue?

    I know they pulled the update,  but what about us that already deployed it?  

    Monday, September 22, 2014 11:58 AM
  • Updated to CU5 over the weekend and just now noticed the same issue across my entire 2013 environment, 5 FE's, 2 Directors & 2 Edge's - all running Server 2012R2.  KB2992965 - Core Components at ver 5.0.8308.803.

    Not going to remove the Core Services update due to FUD... (Fear, Uncertainty & Doubt)

    I've opened a case with Premier support; will update the thread.

    Update - 9/23/14 10:07am CST:  Opened the case and the support rep said MSFT is actively tracking this issue as a "bug", trying to reproduce the issue in their labs and that there would be no charge for support calls for it.

    • Edited by J.Kuta Tuesday, September 23, 2014 3:10 PM Update
    Monday, September 22, 2014 12:53 PM
  • Strange-I was able to remove the update on the lab servers and once I did so had no problems with the MCUs (able to schedule, join, and manipulate conferences). If the update got pulled, then hopefully that means it gets reissued soon. 
    Monday, September 22, 2014 1:40 PM
  • Yes, when the patch was re-applied the MCU and RGS services came back to normal, we still do not have centralized logging.

    When I was talking to the support Rep he said that they were going to start an investigation into the CLS service issue.
    Tuesday, September 23, 2014 2:06 PM
  • I did the same thing and initially had the same thought. but when I got in and checked the Lab the next morning our FEs had the same errors and issues we were experiencing in our production environment.
    Tuesday, September 23, 2014 2:10 PM
  • The bulletin has been revised. But it only looks like the fixed the problem with Lync 2010. Nothing mentioned about problems with Lync 2013.

    https://technet.microsoft.com/library/security/ms14-055

    Wednesday, September 24, 2014 10:04 AM
  • Hi,

    today I have installed all Lync update in two servers, and we have the same issue, on Lync edge server 2013 std ed. and Lync FE server 2013 std. All server are Windows Server 2012 std. ed. with all update.

    There is a solution? New fix or a UFFICIAL workaround?

    Thanks

    Aurelio (5T S.r.l.)

    Log Name:      Lync Server
    Source:        LS Centralized Logging Agent
    Date:          9/28/2014 1:15:41 AM
    Event ID:      33005
    Task Category: (1007)
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:     
    Description: Lync Server Centralized Logging Service Agent Service could not be started.

    Exception: Could not load file or assembly 'Microsoft.Rtc.ClsAgent.IISLog, Version=5.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The system cannot find the file specified.
    Exception type: FileNotFoundException
    Additional Data:
    Source: ClsAgent
    Stack Tracer.Trace:
       at Microsoft.Rtc.ClsAgent.AgentCore.InitializeAgentCore()
       at Microsoft.Rtc.ClsAgent.ClsAgent..ctor(ClsAgentService service)
       at Microsoft.Rtc.ClsAgent.ClsAgentService.StartAgent()
       at Microsoft.Rtc.ClsAgent.ClsAgentService.OnStart(String[] args)
    Data: 0 key/value pairs
    Inner Exception:

    Cause: Exception during startup
    Resolution:
    Check the events prior to this to resolve the service startup issue.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="LS Centralized Logging Agent" />
        <EventID Qualifiers="50159">33005</EventID>
        <Level>2</Level>
        <Task>1007</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2014-09-27T23:15:41.000000000Z" />
        <EventRecordID>10569118</EventRecordID>
        <Channel>Lync Server</Channel>
        <Computer>               .5t.torino.it</Computer>
        <Security />
      </System>
      <EventData>
        <Data>Could not load file or assembly 'Microsoft.Rtc.ClsAgent.IISLog, Version=5.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The system cannot find the file specified.
    Exception type: FileNotFoundException
    Additional Data:
    Source: ClsAgent
    Stack Tracer.Trace:
       at Microsoft.Rtc.ClsAgent.AgentCore.InitializeAgentCore()
       at Microsoft.Rtc.ClsAgent.ClsAgent..ctor(ClsAgentService service)
       at Microsoft.Rtc.ClsAgent.ClsAgentService.StartAgent()
       at Microsoft.Rtc.ClsAgent.ClsAgentService.OnStart(String[] args)
    Data: 0 key/value pairs
    Inner Exception:
    </Data>
      </EventData>
    </Event>

    Check the events prior to this to resolve the service startup issue.


    • Edited by sistemisti5t Sunday, September 28, 2014 12:32 AM
    Sunday, September 28, 2014 12:10 AM
  • This guy found a fix:

    http://aspoc.net/archives/2014/09/30/error-lync-server-centralized-logging-service-could-not-be-started/

    The bad news though is that I cant find a correct version of that file. It does not seem to be included at all in the ocscore.msi-package for example.
    • Marked as answer by Harmankardon Wednesday, October 01, 2014 6:22 AM
    • Edited by Harmankardon Wednesday, October 01, 2014 6:41 AM
    Wednesday, October 01, 2014 6:22 AM
  • Hi,

    we don't have a backup with this folder:

    C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Rtc.ClsAgent.IISLog and this file Microsoft.Rtc.ClsAgent.IISLog.DLL version number of 5.0.8308.733.

    Is There another solution?

    Aurelio

    Wednesday, October 01, 2014 12:10 PM
  • Hi Alltogether,

    Same to me. I don't have this file available and I checked another "unpatched" System and there it's also not available.

    Any News from Microsoft regarding this issue? Or any other idea?

    Best Regards

    Michael

    Wednesday, October 01, 2014 12:43 PM
  • I have three FE servers and three Edge servers.  On the first FE and Edge server I installed the August CU before installing the MS14-055 CU.  The MS14-055 bulletin recommended this.  On the other four servers, I saved time and skipped the August CU, going straight for the MS14-055 CU.  The GUI for the installer implied that the MS14-055 CU included all the updates that the August CU did, obviously taking some components to a later version.  My first two servers don't have the error, whereas the other four do.  Now there's a September CU too; but applying this does not fix the problem on the problem servers.

    So I looked at the updates I have installed relating to "Microsoft Lync Server 2013, Core Components".  On the working servers I have KB2937305 (August CU), KB2992965 (MS14-055) & KB2987511 (September CU).  On the servers with this problem, I am missing KB2937305.

    So I looked at the file lists for these three updates.  KB2937305 includes this file:

    File_gac_microsoft.rtc.clsagent.iislog.dll 5.0.8308.733

    However, this is missing from KB2992965  & KB2987511.  So it looks like Microsoft omitted it from MS14-055 and also neglected to include it in the September CU.  Let's hope they restore this file in the next CU.

    I thought I might remove KB2992965 & KB2987511 from my problems servers, install KB2937305 and re-install KB2992965 & KB2987511.  But I am not sure if it is possible to download KB2937305: I just get redirected to the September CU.

    I have recorded the others "extra" updates that were installed on the Lync servers I applied the August CU to for other components.  I haven't compared the file lists for those at this stage, as I have not noticed any other errors.  And I have run out of energy!




    Thursday, October 02, 2014 8:49 AM
  • This is ridiculous, I'm going to be contacting M$ support about this soon", when I have time. I need Centralized Logging to work.
    Thursday, October 09, 2014 1:52 PM
  • Microsoft has updated the kb:

    http://support2.microsoft.com/kb/2986072/en-us?sd=rss&spid=924

    Known issues

    • Symptoms
      After you install this security update on a system that is running Microsoft Lync Server 2013, you find that the Central Logging Service is not listening on designated ports. This causes the Central Logging Service not to start or capture data. When the problem occurs, an exception error message that resembles the following is logged in the event log: 
    • Cause
      This problem can occur if you install this security update on Lync Server 2013 before you install the August Update of Lync Server 2013.  

    To resolve this issue, install the following cumulative update:
    3003358
    (http://support.microsoft.com/kb/3003358/ )
    October 2014 Cumulative Update 5.0.8308.831 for Lync Server 2013 core components 



    • Marked as answer by Harmankardon Friday, October 10, 2014 6:19 AM
    • Edited by Harmankardon Monday, November 03, 2014 8:10 AM MS updated the KB
    Friday, October 10, 2014 6:19 AM
  • Thanks for the update :)

    Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer" Regards Edwin Anthony Joseph

    Friday, October 10, 2014 6:20 AM
  • Thanks, think Microsoft should provide an easier way to download previous CU's....

    Saturday, October 11, 2014 6:25 PM
  • Hi,

    I have installed the

    (http://support.microsoft.com/kb/3003358/ )

    October 2014 Cumulative Update 5.0.8308.831 for Lync Server 2013 core components 

    Worked!!!

    Centralized logging service started without problems

    Thanks

    Aurelio


    • Proposed as answer by sistemisti5t Friday, November 14, 2014 8:24 AM
    • Unproposed as answer by sistemisti5t Friday, November 14, 2014 8:24 AM
    • Proposed as answer by sistemisti5t Friday, November 14, 2014 8:24 AM
    • Edited by sistemisti5t Friday, November 14, 2014 8:28 AM
    Thursday, November 13, 2014 10:55 PM