Log Collection API Call not working

[krnsn1601]

Hi team,

We are tying to pull the CUCM (Both v10.5 SU3 & 11.5 SU7) service logs (E.g. Cisco Audit Logs) via the Log collection API as detailed here - https://developer.cisco.com/docs/sxml/#!log-collection-and-dimegetfileservice-api-reference/log-collection-and-dimegetfileservice-api-reference

The listNodeServiceLogs request works perfectly fine but when I use the selectLogFiles request, for both DownloadtoClient & PushtoSFTPServer, it fails with the following AXL response:
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Body>
<soapenv:Fault>
<faultcode>soapenv:Server</faultcode>
<faultstring>unknown</faultstring>
<detail/>
</soapenv:Fault>
</soapenv:Body>
</soapenv:Envelope>

The XML request that I am using is as follows:
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.cisco.com/ast/soap">
<soapenv:Header/>
<soapenv:Body>
<soap:selectLogFiles>
<soap:FileSelectionCriteria>
<soap:ServiceLogs>
<soap:item>Cisco Audit Logs</soap:item>
</soap:ServiceLogs>
<soap:SystemLogs>
<soap:item></soap:item>
</soap:SystemLogs>
<soap:SearchStr></soap:SearchStr>
<soap:Frequency>OnDemand</soap:Frequency>
<soap:JobType>PushtoSFTPServer</soap:JobType>
<soap:ToDate>06/15/22 11:59 PM</soap:ToDate>
<soap:FromDate>06/14/22 11:00 AM</soap:FromDate>
<soap:TimeZone>Client: (GMT+5:30) India Standard Time-Asia/Calcutta</soap:TimeZone>
<soap:RelText/>
<soap:RelTime/>
<soap:Port>22</soap:Port>
<soap:IPAddress>x.x.x.x</soap:IPAddress>
<soap:UserName>username</soap:UserName>
<soap:Password>password</soap:Password>
<soap:ZipInfo>false</soap:ZipInfo>
<soap:RemoteFolder>/</soap:RemoteFolder>
</soap:FileSelectionCriteria>
</soap:selectLogFiles>
</soapenv:Body>
</soapenv:Envelope>

Have tried on different CUCM nodes, tried changing the OS security to "permissive" but still getting the same error. The SOAP traces are not of much help either, if you can please guide us through the correct request please. Thank you!

[Alex Stevenson]

Hello @krnsn1601,

Just an observation...every example for this API call I see (including the link you shared) has 2 lines under 'ServiceLogs', but you only have one. 

Check out this repo of sample scripts demonstrating usage of various Cisco CUCM Serviceability APIs using Python and the Zeep SOAP library: CiscoDevNet/serviceability-python-zeep-samples

logCollection_GetOneFile.py - Performs a listing of log files available for a specific service (Cisco Audit Logs), retrieves the contents of the latest file, then parses/prints a few lines of the results (<selectLogFiles>, <GetOneFile>)

Hope this helps!

[npetrele]

Try connecting to your sftp server on port 22 with the same username/password you're using in the AXL, and double-check that you're using the right remote folder.

[krnsn1601 · Accepted solution]

@Alex Stevenson & @npetrele, thank you for your responses.

Believe have figued out the issue here. When you get the fault code as <faultcode>soapenv:Server</faultcode> <faultstring>unknown</faultstring>, it is generally that your AXL call is missing / has incorrect
mandatory parameters.
In our case, it looks like the format for ToDate, FromDate was incorrect. Also, the node I used this time was in GMT timezone, so Timezone format might also be something to looked into.

Modified the call as below and bang, the Audit log files were successfully pushed to the remote SFTP server.

<soap:JobType>PushtoSFTPServer</soap:JobType>
<soap:ToDate></soap:ToDate>
<soap:FromDate></soap:FromDate>
<soap:TimeZone>Client: (GMT-0:0) Greenwich Mean Time</soap:TimeZone>
<soap:RelText>Days</soap:RelText>
<soap:RelTime>1</soap:RelTime>
<soap:Port>22</soap:Port>

This serves my purpose so did not explore the correct format for the dates or timezone parameter, will update this thread once I figure that out. Cheers!

[Alex Stevenson]

Thanks for sharing how you soled this, @krnsn1601; I'm sure it will be helpful to other people in the community.

[dstaudt]

At least on CUCM 14, the <RelText> and <RelTime> values are ignored (though they must be present, with valid values - i.e. 'None' and '0') so you should have received all existing files rather than the last day's worth...

I've attempted to clarify/update the docs here based on re-testing with CUCM 14: https://developer.cisco.com/docs/sxml/#!log-collection-and-dimegetfileservice-api-reference/log-collection-api

Let us know if your observations differ!