/mcpto circumvent the policy restrictions. If the rejected call was caused by an innocent mistake, educate the affected user about the numbers that he or she is allowed to dial. Your organization may have a policy or guidelines to follow when investigating call rejects. In addition to or instead of the steps recommended here, please refer to your company's guidelines. Error Message %UC_CALLMANAGER-5-ServicePortOnline: %[Protocol=String][PortNumber=UInt][AppID=String] [ClusterID=String][NodeID=String]: A Cisco CallManager service port is online. Explanation Unified CM has successfully opened a socket port to provide service Recommended Action Notification purposes only; no action is required Error Message %UC_CALLMANAGER-2-ServicePortOffline: %[Protocol=String][PortNumber=UInt][ErrorNumber=Int] [AppID=String][ClusterID=String][NodeID=String]: A Unified CM service port is offline. Explanation A Unified CM socket port that is used to provide service has unexpectedly closed; Unified CM will attempt to reopen this port. Normally, this port should never be closed. An unexpected closing of this port generally indicates an operating system failure or an external attack on Unified CM. Recommended Action Verify that Unified CM is able to reopen this socket port and provide service. You can watch for an instance of the notice level alarm, ServicePortOnline, when service to the port has been restored. If the port is not reopened and service restored, restart the Cisco CallManager service. If this alarm occurs for an extended duration, collect the existing trace files and contact the Cisco Technical Assistance Center (TAC). Error Message %UC_CALLMANAGER-4-SuspiciousIPAddress: %[PortNumber=UInt][Address=String][AppID=String] [ClusterID=String][NodeID=String]: Unified CM has identified suspicious connection attempts from an IP address. Explanation Unified CM has identified suspicious connection attempts from an IP address and has temporarily blocked the address. This alarm is an indication that a Denial-of-Service attack may have been attempted from this IP address. Recommended Action Examine network activity for repeated attempts to access the port number specified in this alarm. Using the IP address specified in this alarm, attempt to identify the device that has been sending connection attempts to the port. If the IP address belongs to a device that is configured in Unified CM, evaluate the possible reason for such numerous connection attempts. Generally, no device that is functioning properly will trigger this alarm. Reset the device or remove the device from the network. Error Message %UC_CALLMANAGER-3-LostConnectionToSAFForwarder: %[IPAddress=String] [SafClientHandle=UInt][AppID=String][ClusterID=String][NodeID=String]: Connection to the SAF Forwarder has been lost. Explanation A TCP connection failure caused the connection between the SAF Forwarder and Unified CM to be lost. When the TCP connection is restored, Unified CM attempts to connect to the SAF Forwarder automatically. If IP connectivity is unreachable for longer than the duration of the Cisco CallManager service parameter CCD Learned Pattern IP Reachable Duration, calls to learned patterns 5/24/26, 3:34 AM System Error Messages for Cisco Unified Communications Manager 15 - Cisco https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/err_msgs/15_x/ccmalarms15.html 278/343