EVENT ID 56208 – Resolving Issues with CDR Throttling

This post has been republished via RSS; it originally appeared at: Skype for Business Blog articles.

In my previous blog post, I had explained what causes EVENT ID 56208 and had alluded changing the threshold as a work-around. Here is a work-around to resolve identify the issue further, and apply a work-around.

Running a simple SQL query mentioned below will be able to be provide a list of top 10 MS-Diagnostic IDs which occur the most in this environment within the last 30 days.

[sourcecode language='sql'  padlinenumbers='true']
Use LcsCDR 
Go 
Select Top 10 DiagnosticId, Count(DiagnosticId) as 'Frequency' From [LcsCDR].[dbo].[SessionDetails] 
Where (SessionIdTime >= dateadd(day, datediff(day, 0, getdate())-30, 0)) and SessionIdTime <dateadd (day, datediff(day, 0, getdate()), 0) 
Group By [LcsCDR].[dbo].[SessionDetails].DiagnosticId 
Order by Frequency Desc 
Go 
[/sourcecode]

The query can easily be modified to change the period from 30 day currently (getdate()-30) to say 1 day, 7 days, 15 days or 365 days, which would help understand if the issue has been occurring for longer periods of time, but has just reached the tipping point(s).

Let's say MSDiagID 52094 has the highest frequency, and has had this frequency only in the last 1 week, not in data collected from the last say perhaps 30 days.

[sourcecode language="sql"]
Use LcsCDR
Go

Update dbo.MsDiagMetaData
Set ThrottleLimit =20 where MsDiagId = 52094
Go
[/sourcecode]

Once the threshold has been modified, you will notice considerable improvement over the next couple of hours as any data backlogged will now be committed.

Please be aware that this is not a solution, but just a work-around within Lync to prevent problems within Lync and Skype for Business. In-order to find a solution, we may need to use the find the actual reason behind it. Some of the examples are:

Why do clients report MS-DiagnosticID 52094 ? - A temporary loss in WiFi can cause this issue

Why do we have this event mostly from a few IP Addresses? - This probably can help limit the source to a location or geography

Why do PC clients only report the issue ? - Most users at the location were using PC Clients

Why do we have mobile clients not report this issue? - Mobile devices probably used data networks ( 3G/4G/ LTE networks)

Why do we have this MS-DiagnosticID only for this period of 1 week ? - A large conference was hosted last week where say a large population from the company was invited, and the temporary WiFi Set-up was suffering from issues, and an AP in particular was problematic.

Like I mentioned, I can only provide a workaround to provide relief in Lync or Skype for Business Servers and monitoring. The real issue will have to be investigated separately. Getting clear answer to above question will pretty much point you to the actual cause and its resolution.