accounting with CUCM

Unanswered Question
Rob Huffman Wed, 08/11/2010 - 06:00
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 IP Telephony, Unified Communications

Hi Ambi,


There are basic "MLA" style logs available but they may not contain the detail level you require for Audit purposes;




Access Log




The log contains a file report of access/change attempts. That is, Cisco Unified CallManager Administration generates a record of attempts to access or modify any directory or database component through Cisco Unified CallManager Administration. The change record includes the user name, date, time, window from which the change was made, and the success or failure status of the update.




http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/admin/5_1_3/ccmsys/a02mla.html#wp1025731








The Trace File for MLA, Via RTMT (Trace Files) is where you will find the Logs;




Trace tab -> Trace & log central -> Collect files -> Cisco Role Based security






For more detailed logs you would need something like this product;




Cisco does offer some good Management/Monitoring products in the UC space. Have a look;




Key Features of Cisco Unified Operations Manager




Real-time visualization and monitoring of the entire Unified Communications system supports more efficient troubleshooting


Active service assurance ensures that devices and applications are functioning as they should, and reveals faults and performance issues before they affect service




Powerful diagnostic tests and troubleshooting capabilities rapidly isolate faults and increase productivity


Correlation, analysis, and presentation of voice service quality data and alerts make use of information available through Cisco Unified Service Monitor




Inventory and change monitoring enable tracking of complete details of unified communications devices and IP phone inventory




Cisco Unified Operations Manager does not deploy any agent software on the devices being monitored, so it will not disrupt system operations




Cisco Unified Operations Manager helps reduce system maintenance costs, improve productivity, and increase user satisfaction by providing a comprehensive monitoring, alerting, and troubleshooting view into the entire Cisco Unified Communications environment.




http://www.cisco.com/en/US/products/ps6535/index.html





I have also heard great things about registered Cisco Developer/Partner Variphy;


http://variphy.com/products/enterprises.php





Hope this helps!
Rob

William Bell Wed, 08/11/2010 - 06:06
User Badges:
  • Purple, 4500 points or more

Actually, if you are running 7.1(2) and later you do have additional

auditing capabilities. I did a write up on it here:


http://www.netcraftsmen.net/resources/blogs/audit-logs-on-cucm.html


And a follow up here:


http://www.netcraftsmen.net/resources/blogs/audit-logs-on-cucm-part-2.html



HTH.


Regards,

Bill

Please remember to rate helpful posts.



On 8/11/10 9:01 AM, "rob.huffman"

Chris Lee Wed, 10/20/2010 - 05:47
User Badges:

Hi Ambi,


Yes, the screenshot just showed the Change Summary at beginning of the document.  The document above can be many pages in length depending on the situation (number of changes made since the last Snapshot, etc...).  All those numbers in the Summary beginning are hotlinked to go down to more detailed information about what's been changed.  So for example, if you clicked on the "22" in Service Parameters Added from the document in the screenshot above, you would be brought down to this:

The feature will go so far down as to record the changes in a user's Speed Dial.


Deep enough?


Chris

ahochau_2 Tue, 04/19/2011 - 12:24
User Badges:

Hi Chris,


Will Variphy tell me who made the change?  We have a problem with things disappearing and not knowing who disappeard them.


Thanks,

Mark

Chris Lee Fri, 05/04/2012 - 11:45
User Badges:

Hi Mark,


Yes, we now can "read" the CUCM Audit log (in CUCM 7.1.2 and above):


Chris

Actions

This Discussion