who delete my data in cucm

[abdullah alnahdi]

Hi expert

We are 5 user who managing the cucm for a cluster consist of 4  servers some data has been change and we want to know which one from the 5 user did that. Please help me in that as it become urgent.

Regards

[Jaime Valencia]

This has been asked plenty f times before, use the role based logs, if not available, Tomcat log.
You can search CSC for further information.

Sent from Cisco Technical Support iPad App

[abdullah alnahdi]

Hi Jaime

I have did what you recommended but still not working.Any idea please me in that.

Regards

[Jaime Valencia]

Exactly what is not working????

HTH

java

if this helps, please rate

www.cisco.com/go/pdihelpdesk

[abdullah alnahdi]

Hi

i tried to get the RTMT but it shown me the following:

2013-09-07 16:14:27,956 INFO  [http-8443-4] utilities.MLA - User is cucmadmin

2013-09-08 10:33:54,815 INFO  [http-8443-7] utilities.MLA - User is cucmadmin

2013-09-08 14:06:28,446 INFO  [http-8443-6] utilities.MLA - User is cucmadmin

2013-09-08 15:45:32,121 INFO  [http-8443-8] utilities.MLA - User is cucmadmin

2013-09-09 09:33:43,497 INFO  [http-8443-4] utilities.MLA - User is cucmadmin

2013-09-09 10:36:59,151 INFO  [http-8443-2] utilities.MLA - User is cucmadmin

2013-09-09 14:01:56,152 INFO  [http-8443-2] utilities.MLA - User is cucmadmin

2013-09-09 14:58:40,930 INFO  [http-8443-4] utilities.MLA - User is cucmadmin

not showing the changes.

Also try to get the auditlog also getting the following:

08:11:39.988 |LogMessage   UserID : cucmadmin  ClientAddress : 172.16.80.210  Severity : 3  EventType : UserLogging  ResourceAccessed: Apache-Axis2  EventStatus : Success  CompulsoryEvent : No  AuditCategory : AdministrativeEvent  ComponentID : Cisco CCM Application  AuditDetails : Login Authentication Successful App ID: Cisco Tomcat Cluster ID:  Node ID: NAB-CM-PUB

08:11:42.328 |LogMessage   UserID : cucmadmin  ClientAddress : 172.16.80.210  Severity : 3  EventType : UserLogging  ResourceAccessed: Apache-Axis2  EventStatus : Success  CompulsoryEvent : No  AuditCategory : AdministrativeEvent  ComponentID : Cisco CCM Application  AuditDetails : Login Authentication Successful App ID: Cisco Tomcat Cluster ID:  Node ID: NAB-CM-PUB

08:11:44.697 |LogMessage   UserID : cucmadmin  ClientAddress : 172.16.80.210  Severity : 3  EventType : UserLogging  ResourceAccessed: Apache-Axis2  EventStatus : Success  CompulsoryEvent : No  AuditCategory : AdministrativeEvent  ComponentID : Cisco CCM Application  AuditDetails : Login Authentication Successful App ID: Cisco Tomcat Cluster ID:  Node ID: NAB-CM-PUB

08:11:47.059 |LogMessage   UserID : cucmadmin  ClientAddress : 172.16.80.210  Severity : 3  EventType : UserLogging  ResourceAccessed: Apache-Axis2  EventStatus : Success  CompulsoryEvent : No  AuditCategory : AdministrativeEvent  ComponentID : Cisco CCM Application  AuditDetails : Login Authentication Successful App ID: Cisco Tomcat Cluster ID:  Node ID: NAB-CM-PUB

08:11:49.493 |LogMessage   UserID : cucmadmin  ClientAddress : 172.16.80.210  Severity : 3  EventType : UserLogging  ResourceAccessed: Apache-Axis2  EventStatus : Success  CompulsoryEvent : No  AuditCategory : AdministrativeEvent  ComponentID : Cisco CCM Application  AuditDetails : Login Authentication Successful App ID: Cisco Tomcat Cluster ID:  Node ID: NAB-CM-PUB

08:11:51.759 |LogMessage   UserID : cucmadmin  ClientAddress : 172.16.80.210  Severity : 3  EventType : UserLogging  ResourceAccessed: Apache-Axis2  EventStatus : Success  CompulsoryEvent : No  AuditCategory : AdministrativeEvent  ComponentID : Cisco CCM Application  AuditDetails : Login Authentication Successful App ID: Cisco Tomcat Cluster ID:  Node ID: NAB-CM-PUB

08:11:54.116 |LogMessage   UserID : cucmadmin  ClientAddress : 172.16.80.210  Severity : 3  EventType : UserLogging  ResourceAccessed: Apache-Axis2  EventStatus : Success  CompulsoryEvent : No  AuditCategory : AdministrativeEvent  ComponentID : Cisco CCM Application  AuditDetails : Login Authentication Successful App ID: Cisco Tomcat Cluster ID:  Node ID: NAB-CM-PUB

08:11:56.464 |LogMessage   UserID : cucmadmin  ClientAddress : 172.16.80.210  Severity : 3  EventType : UserLogging  ResourceAccessed: Apache-Axis2  EventStatus : Success  CompulsoryEvent : No  AuditCategory : AdministrativeEvent  ComponentID : Cisco CCM Application  AuditDetails : Login Authentication Successful App ID: Cisco Tomcat Cluster ID:  Node ID: NAB-CM-PUB

08:11:58.829 |LogMessage   UserID : cucmadmin  ClientAddress : 172.16.80.210  Severity : 3  EventType : UserLogging  ResourceAccessed: Apache-Axis2  EventStatus : Success  CompulsoryEvent : No  AuditCategory : AdministrativeEvent  ComponentID : Cisco CCM Application  AuditDetails : Login Authentication Successful App ID: Cisco Tomcat Cluster ID:  Node ID: NAB-CM-PUB

08:12:01.184 |LogMessage   UserID : cucmadmin  ClientAddress : 172.16.80.210  Severity : 3  EventType : UserLogging  ResourceAccessed: Apache-Axis2  EventStatus : Success  CompulsoryEvent : No  AuditCategory : AdministrativeEvent  ComponentID : Cisco CCM Application  AuditDetails : Login Authentication Successful App ID: Cisco Tomcat Cluster ID:  Node ID: NAB-CM-PUB

where is the change that has been modified how to get that.

Regards