Aaron Harrison Fri, 03/12/2010 - 02:29
User Badges:
  • Super Bronze, 10000 points or more
  • Community Spotlight Award,

    Member's Choice, May 2015

Hi


You can get this information from the Tomcat logs - they aren't the easiest logs to read in the world, but there are worse ones... Also these will be overwritten quite regularly...


From the CLI:


File list activelog tomcat/logs detail date

- This will list your files


File view activelog tomcat/logs/localhost_access_logxxxxxxxxxx.txt

- To view it


Or retrieve them using RTMT as 'Cisco Tomcat' (on the second page of services when doing a 'Collect Files').


Regards


Aaron

reg_cisco Fri, 03/12/2010 - 03:25
User Badges:

Thanks.


But I have a problem. When I enter the command File list activelog tomcat/logs detail date No valid command entered is show

Aaron Harrison Fri, 03/12/2010 - 03:31
User Badges:
  • Super Bronze, 10000 points or more
  • Community Spotlight Award,

    Member's Choice, May 2015

Hi


You may be mistyping it.


Start with


File list activelog /


That will list your root folders.


Then if you see tomcat


File list activelog tomcat


Etc.. then if this works:


File list activelog tomcat/logs


Try adding the detail and date parameters...


Aaron

reg_cisco Fri, 03/12/2010 - 03:45
User Badges:

All this folders and files is shown but I don't know what I must to see


admin:file list activelog tomcat/logs
   axl
   car
   ccmadmin
   ccmcip
   ccmivr
   ccmrealm
   ccmservice
   ccmuser
   cmplatform
   cucreports
   cui
   dbl
   dna
   em
   grt
   ipma
   iptplatform
   licensing
   log4jinit
   ncs
   pd
   platform-api
   rbs
   redirector
   risbean
   rtmt
   security
   soap
   soapmessage
   tomcatstats
   uxl
   webdialer
catalina.out                            localhost_access_log2010-03-07.txt
localhost_access_log2010-03-08.txt      localhost_access_log2010-03-09.txt
localhost_access_log2010-03-10.txt      localhost_access_log2010-03-11.txt
localhost_access_log2010-03-12.txt      manager.2010-03-07.log
manager.2010-03-08.log                  manager.2010-03-09.log
manager.2010-03-10.log                  manager.2010-03-11.log
manager.2010-03-12.log
dir count = 32, file count = 13

Aaron Harrison Fri, 03/12/2010 - 04:05
User Badges:
  • Super Bronze, 10000 points or more
  • Community Spotlight Award,

    Member's Choice, May 2015

Hi


The localhost_access logs contain list of pages accessed by the admin users.


Pick the one that covers the time period you are interested in...


Regards

Adam Thompson Fri, 03/12/2010 - 06:25
User Badges:
  • Silver, 250 points or more

There is a real easy way to view this information.


1) Launch RTMT

2) Click on Trace & Log Central

3) Select Remote Browse

4) From the Trace File section choose Cisco Role-based Security

     -This is on the second page of list


This will give you the username that logged into CCMAdmin as well as what actions they performed and when.


Thanks,

Adam


Please rate post if helpful

Aaron Harrison Fri, 03/12/2010 - 06:52
User Badges:
  • Super Bronze, 10000 points or more
  • Community Spotlight Award,

    Member's Choice, May 2015

Err.. yeah, that's a nicer way :-)


+5


Now if only Cisco had chosen to write some info about what was actually done (rather than a PKID of a phone I've just deleted, which now doesn't exist, so can't be looked up!) it would be a nice feature..

liuliu0310 Fri, 01/03/2014 - 22:41
User Badges:

dear adam,

I follow your way to see the logs,but how to translate "

INFO  [http-8443-19] utilities.MLA" to the action what the user do?

the information can not read directly.

Octavio Puente Mon, 04/05/2010 - 08:56
User Badges:

i tried the both solution that has been propused.

on the cli screen i can see the log file but i cant understand what the log file says.


On the RTMT i cant see the log file.


pd. sorry by my english.

Pablo Daniel Go... Mon, 04/05/2010 - 15:35
User Badges:
  • Cisco Employee,

Octavio,


On CLI or RTMT the files you are looking for will be the rbsaccessXXXXX.log files. From CLI you can list the files with the following command:


file list activelog /tomcat/logs/rbs/log4j/*


And to view it just issue:


file view activelog /tomcat/logs/rbs/log4j/rbsaccessXXXXX.log


It will display the user who has access CCM and you should be able to see something like this:


2010-04-05 17:58:14,680 INFO  [http-8443-Processor21] utilities.MLA - User is ccmadmin


You will also see updates and changes, but they are not quite detailed and you will see the pkid's, ie:

2010-04-05 13:47:41,235 INFO  [http-8443-Processor20] utilities.MLA - /devicePoolSave: pkid/name f8fdc574-35e8-7232-9cf0-7da5d15d872b update  successful , userid ccmadmin


That means that user ccmadmin made a change to a device pool. If you want to see if they update or modify something you will need to look into the audit logs as well, although they will just give you a rough idea rather than detailed information.


Here is more informaiton on audit logs:

Configuring the Audit Log

http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/service/7_1_2/admin/saaulog.html


HTH,


pablogon

William Bell Tue, 04/06/2010 - 10:12
User Badges:
  • Purple, 4500 points or more

Lots of great advice in this thread for sure.  If you are running CUCM 7.1(2) or later you can use the audit logs as eluded to in a few posts.  Though, the locations I saw posted don't jive with where I see audit logs on my system.  They are in:


admin:file list activelog audit/AuditApp/*


I wrote up a blog on the Audit Logs.  I had it stashed in the "To Do" pile for a while and then I saw a few threads floating around on the topic.  Anyway, I dusted it off and posted it.  Maybe you will find it useful.


http://www.netcraftsmen.net/resources/blogs/audit-logs-on-cucm.html


HTH.


Regards,
Bill

Actions

This Discussion