Ok.This is great news. This means we can't access the audit logs from Cisco CUCM CLI and edit them, right?
That is correct.
I am really concerned about Off Box solution. How can we store into offbox server (SFTP) and can retrieve when needed? Are there any third party solutions to them?
I can think of two ways to get the audit logs off box. The first is leveraging the syslog facility. When you go to Tools>Audit Log Configuration in CCMService you can specify a syslog destination. That will send a coopy of the audit log to a specific syslog server. Though, that stream will not be encrypted in transit. Which may or may not be a problem for your auditors. I imagine that if you can prove that it is near impossible for someone to introduce a man-in-the-middle scenario then you could go this route. Auditing isn't about who can see the info as much as it is about ensuring that malicious folks can't modify the info. Since you can specify a separate syslog destination, you can put these audit logs on a server that only select people can access.
The second route is SFTP and would involve some CLI scripting. You could setup a scheduled batch process on the secure repository (off box host) that can SSH to the CUCM and run the necessary commands to SFTP files off box using the "file get " command. This script would need to have a process for retrieving files and then will need to either rename the files or zip archive the file. Remember, CUCM uses circular logging and over time the same file name is re-used. After the script retrieves the files, renames them/zips them, then it can move the files to a longer term storage location (on disk, on SAN, etc.).
I am not aware of an API that can be used for audit logs (i.e. like CDR).
I think you can implement a solution that satisfies all needs. You may need to pull in some extra resources (internally or a consultant) to work on the finer details, but it isn't all that difficult to get from point A to point B.
Oh, and I think I recall seeing some product that does this but I don't recall the name and I didn't research it heavily since there are valid methods to do this without a software purchase.
HTH.
Regards,
Bill
please rate helpful posts
