topic How to get the logs who deleted the Configuration in Webex Calling

How to get the logs who deleted the Configuration

Dhirendrakumar — Mon, 27 Sep 2021 07:59:11 GMT

Hi All,

In my organization, Someone deleted the end user configuration. But don't know who deleted it.

We have reconfigured the configuration back, but want to check the logs from which ID it was done.

In admin Logs we can see who created originally and then another log we can see is created by me because it was deleted. Information we need to find out who delete this account.

Re: How to get the logs who deleted the Configuration

dtibbe — Mon, 27 Sep 2021 08:41:07 GMT

Under Admin->Troubleshooting->Admin Activities I can see changes in the license assignment as well as deletions/creations of users..

Re: How to get the logs who deleted the Configuration

Dhirendrakumar — Mon, 27 Sep 2021 09:08:04 GMT

For me its showing only creation logs for last 1 year. No deletion information

Re: How to get the logs who deleted the Configuration

Stephanie Knoop — Mon, 27 Sep 2021 15:04:24 GMT

The audit logs in WebEx control hub are riddled with problems. Because many companies do not delete users, rather deactivating them, the actual deletions that occurs 30 days later by a cleanup script that is run WebEx do not show up in the audit logs. Also, the deactivation action does not show up in the audit logs. The other thing not in the audit logs is any activity that is performed within a CSV file.

I have raised this issue with TAC on a couple of occasions and I think the only way it is going to get the attention is if large numbers of the community open up TAC cases and contact their account teams.

Re: How to get the logs who deleted the Configuration

Dhirendrakumar — Tue, 12 Oct 2021 00:58:54 GMT

For my specific case User was active and he was associated with call queue.

Re: How to get the logs who deleted the Configuration

Vaijanath Sonvane — Wed, 13 Oct 2021 04:32:09 GMT

Hi @Dhirendrakumar & @Stephanie Knoop,

I guess Cisco has added this feature recently. The audit logs in control hub now shows the entry for deleted user and who performed the action.

On the other note, the audit logs doesn't show any entry for deactivation/reactivation.

Re: How to get the logs who deleted the Configuration

Stephanie Knoop — Wed, 13 Oct 2021 13:16:28 GMT

What you are showing here is an actual deletion performed. If you instead "deactivate", the user will auto delete after 30 days and there will be no record of the deactivation or the auto delete. Many companies deactivate to avoid accidental deletion of all user data, and that activity is not adequately logged in my opinion.

Re: How to get the logs who deleted the Configuration

Vaijanath Sonvane — Wed, 13 Oct 2021 04:56:57 GMT

Hi @Stephanie Knoop ,

Thank you for clarification. I did mention that the control hub doesn't show log entry for deactivation/reactivation.