ERROR: Lync Server Centralized Logging Service could not be started

September 30, 2014

in Lync, Microsoft, TS

UPDATE 10/10/2014: Microsoft has updated the following KB Article with a supported fix and listed the root cause.

This problem can occur if you install this security update on Lync Server 2013 before you install the August Update of Lync Server 2013. 


So you’ve just upgraded to the August or September 2014 CU for Lync Server 2013 and now the Centralized Logging Agent is not working. A quick check using netstat reveals that the necessary TCP ports (50001 – 50003) are not listening and the following error is logged in the Lync Server event log.

Lync Server Centralized Logging Service Agent Service could not be started.

Source: LS Centralized Logging Agent
Event ID: 33005

Exception: Could not load file or assembly ‘Microsoft.Rtc.ClsAgent.IISLog, Version=, Culture=neutral, PublicKeyToken=31bf3856ad364e35’ or one of its dependencies. The system cannot find the file specified.

Exception type: FileNotFoundException
Additional Data:
Source: ClsAgent
Stack Tracer.Trace:
at Microsoft.Rtc.ClsAgent.AgentCore.InitializeAgentCore()
at Microsoft.Rtc.ClsAgent.ClsAgent..ctor(ClsAgentService service)
at Microsoft.Rtc.ClsAgent.ClsAgentService.StartAgent()
at Microsoft.Rtc.ClsAgent.ClsAgentService.OnStart(String[] args)
Data: 0 key/value pairs
Inner Exception:

Cause: Exception during startup
Check the events prior to this to resolve the service startup issue.


The clues here are the FileNotFoundException and the Microsoft.Rtc.ClsAgent.IISLog assembly.  Using the assembly name I was able to create a filter for Procmon and made the following discovery by comparing a working system versus a non-working one.







Using this information, I went on a search and discovered that the entire Microsoft.Rtc.ClsAgent.IISLog directory and DLL was missing from the C:\Windows\Microsoft.NET\assembly\GAC_MSIL path on the Front End server.





All I had to do was to to copy the missing Microsoft.Rtc.ClsAgent.IISLog folder and included DLL from a working Front End with the September 2014 CU build to C:\Windows\Microsoft.NET\assembly\GAC_MSIL and the service successfully started.  I was also able to verify that the necessary TCP ports were indeed established using “netstat -a”.

The missing Microsoft.Rtc.ClsAgent.IISLog.DLL should have a version number of 5.0.8308.733.

UPDATED 10/10/2014: If you are having trouble locating the missing DLL and folder to repair your Lync Server 2013 installation you can download a working copy from here.

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)
soder September 30, 2014 at 2:34 pm

So how does it happen the files were deleted? Any probability there are thousands outside who may be also affected by this file deletion?

Matt September 30, 2014 at 2:46 pm

That’s a great question and one I’ll try to tackle next. My first priority was to get the service working again.

Janne October 1, 2014 at 1:53 am

There are more who are affected. But no news from Microsoft on the matter. Great job with fix.
Now its just the problem of finding a correct version of the file. The file is not included in the ocscore.msi in the latest cu or in cu3 or cu4.

Jonas Sealake October 1, 2014 at 3:20 am

Is there anywhere we can download this DLL? We are unable to locate it at any of our front ends and we are experiencing the problem described in the post.

Michael Melling October 5, 2014 at 12:16 pm

I have three FE servers and three Edge servers. On the first FE and Edge server I installed the August CU before installing the MS14-055 CU. The MS14-055 bulletin recommended this. On the other four servers, I saved time and skipped the August CU, going straight for the MS14-055 CU. The GUI for the installer implied that the MS14-055 CU included all the updates that the August CU did, obviously taking some components to a later version. My first two servers don’t have the error, whereas the other four do. Now there’s a September CU too; but applying this does not fix the problem on the problem servers.

So I looked at the updates I have installed relating to “Microsoft Lync Server 2013, Core Components”. On the working servers I have KB2937305 (August CU), KB2992965 (MS14-055) & KB2987511 (September CU). On the servers with this problem, I am missing KB2937305.

So I looked at the file lists for these three updates. KB2937305 includes this file:

File_gac_microsoft.rtc.clsagent.iislog.dll 5.0.8308.733
However, this is missing from KB2992965 & KB2987511. So it looks like Microsoft omitted it from MS14-055 and also neglected to include it in the September CU. Let’s hope they restore this file in the next CU.

I thought I might remove KB2992965 & KB2987511 from my problems servers, install KB2937305 and re-install KB2992965 & KB2987511. But I am not sure if it is possible to download KB2937305: I just get redirected to the September CU.

I have recorded the others “extra” updates that were installed on the Lync servers I applied the August CU to for other components. I haven’t compared the file lists for those at this stage, as I have not noticed any other errors. And I have run out of energy!

Janne October 10, 2014 at 8:20 am

Microsoft has updated the kb now.

Known issues
After you install this security update on a system that is running Microsoft Lync Server 2013, you find that the Central Logging Service is not listening on designated ports. This causes the Central Logging Service not to start or capture data. When the problem occurs, an exception error message that resembles the following is logged in the event log:
This problem can occur if you install this security update on Lync Server 2013 before you install the August Update of Lync Server 2013.