audit trail in CUCM 7

simmo · ‎04-30-2009

Is it possible to get info on changes made to the system by user and time on CUCM v 7 or CUCM v6?

Cheers....MS.

Jaime Valencia · ‎04-30-2009

role based logs is the closest we have to that

available on both versions

1. Go to CCM Administration web page.

2. Go to "Cisco Unified Serviceability".

3. Go to Trace tab --> Configuration.

4. Select the server, "Database and Admin services" service group and "Cisco

Role-based Security" service.

5. Set the "Debug Trace Level" field to "Debug".

6. Mark the "Trace On" checkbox.

7. Click "Save" button.

Then collect the logs using the RTMT plugin.

Access Log

The log contains a file report of access/change attempts. That is, Cisco Unified Communications Manager Administration generates a record of attempts to access or modify any directory or database component through Cisco Unified Communications Manager Administration. The change record includes the user name, date, time, window from which the change was made, and the success or failure status of the update. the change was made, and the success or failure status of the update.

there are plenty of posts on this same matter so please try using the Search function of NerPro

HTH

java

if this helps, please rate

HTH

java

if this helps, please rate

teru-lei · ‎11-19-2009

This information is very useful!

I just tested and I can see the trace log the action (e.g. update directory number

) . However, the log still contain some complex string which is difficult to be und

erstood. And I can not find out the detail of the action (e.g. I can see CCMAdministrator update a directory number but I cannot find which phone and which number has been changed).

Is there any more details? Thanks!

Best Regards,
Teru Lei

MARTIN STREULE · ‎11-24-2009

Go to www.variphy.com and ask for a trial license for "Varphy Insight".

With that you can get scheduled snapshots of the CUCM config and see config changes.

hth

nikshah · ‎11-24-2009

hey

With CM 7.1.2 there is feature introduced called as Audit Logs, this will help you trace out the same.

http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/rel_notes/7_1_2/cucm-rel_notes-712a.html#wp1242625

This should also give you some info

Tomcat Logs -      tomcat/logs/local*
RBSaccess Logs –  “Cisco RBS Service” 
DBL Logs –         “Cisco Database Layer Monitor”

HTH

Niket