Extension Mobility: logging of logon, logoff, failed logon attempts
I've a need to log all successful logons, the logoffs and failed logon attempts by userID for Extension Mobility. I've been able to get a query going for the successful logons using RTMT querying on UCM>Cisco Extension Mobility Application>log4j>emappxxxxx.log. But I can't get any logoffs nor failed logon attempts out of this trace file. Am I looking at the wrong place? Is there any other trace or alarm setting/configuration I should use to get the required infromatio out of the system?
Thanks for answering. And, yes, I tried both and in the meantime I found out that I can trace loogoffs in the EM Services log. See example below. But I was not able to track down any failed logon attempt for Extension Mobility. By now I have doubts that this is possible at all.
I suggest you use the Performance logs to monitor the number of logins and logouts for a server in the cluster. You can then log these stats to your PC as a csv file. However, you will need to keep the RTMT open while the logging is going on. Here's a doc I wrote a few days ago regarding this. May this would help?
many thanks again. That's a real nie document you wrote! Very helpful. But, it doesn't really help us a lot to use the performance statistics since we need to fulfil some tough audit requirements. The auditors want to be able to determine whether somebody was trying to break into the voice sercice by launching some sort of a brute force attack using a phone and a known userID by trying all sorts of PIN combinations. So, in oder for us to track down the attack, they are looking for information of time and date as well as userID used for failed logon attempds to EM. I was hoping to get this out of some sort of trace.
that's what I've thought too. But I've not found any log providing the information about Extension Mobility end user logon or logoff. Not to mention failed logon. It appears to me that the CUCM just does not provide such information. Or do you know by any chance which logs I might need to look at?
Are you getting this error “Installer User Interface Mode Not Supported. The installer cannot run in this UI mode. To specify the interface mode, use the -i command-line option, followed by the UI mode identifier. The value UI mode identifiers...
The below trick might come handy when you have to add a new node to a cluster but you don't have or is unsure of the security password for the publisher. This procedure has been around for ages.
1) Login into the CLI of the Publisher.