CUCM application user authentication logs

[tato386]

What is the best way to review password changes, login attempts, lockouts etc for CUCM application users?  I tried using RTMT to download Tomcat logs but they are very hard to read.  Are there other options?

Thanks,

Diego

[Leonardo Santana]

Hi,

I think you can look at CUCM Audit Logs to achieve this goal

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/12_5_1/admin/cucm_b_serviceability-admin-guide-1251/cucm_b_serviceability-admin-guide-1251_chapter_0111.html 

[tato386]

Hello Leonardo,

Thank you, yes I do have access to the physical files and data.  My issue is how to work with them since they are very low level.  I would think there is a better way to review this data than to search for keywords in a text file.  Maybe there is some kind of parsing tool that can analyze them?  For instance, if I want to know when was the last time a user password was changed?  Right now all I can do is search for terms like "password", "reset" or "change" in the file(s).  Maybe some way to format them so I can load in Excel, etc.

[Leonardo Santana · Accepted solution]

Hi,

Try to use the Audit Log Viewer from RTMT i think it might helps you.

[tato386]

The audit log viewer is not ideal but I guess I'll have to work with it unless someone comes up with something better.

Thank you!

[leonardolopes]

Hello Tato386,

I worked on this today and you can collect the last Application-Users login using this command:

run sql select e.name, cd.timelastaccessed from applicationuser as e, credentialdynamic as cd, credential as cr where e.pkid=cr.fkapplicationuser and cr.tkcredential=3 and cr.pkid=cd.fkcredential order by cd.timelastaccessed

hope it can help.

Leonardo DA COSTA