Problem description
I need to review who is accessing and making changes in Cisco Unified Communications Manager 10.x as an administrator and what all changes been made and wanted to capture the user name who done the changes on CUCM With date and time.
Solution
You can review and access this information from the Access logs if you enable "Cisco Role based security" trace on CUCM.
Access log files contains a file report of access/change attemps made on CUCM. CUCM administration generates record of attempts to access or change
any database component on CUCM. This log file includes the username with date and time the changes made and status of the update.
Perform the following task
Step1: Log in to the CUCM Administration Page and choose "Cisco Unified Serviceability"
Step2: Go to Trace > Configuration
Step3: Configure the Trace configuration using the following parameters,
- Select the Server
- Service Group : Database and Admin Services
- Service L Cisco Role-based Security (Active)
- Check - Trace On and Apply to All Nodes
- Set the Debug Trace level = Debug
- Check - Enable All Trace
Step4: Click Save
Now you can collect the log files using RTMT
How to collect the log files?
- Open up RTMT And connect to your Server
- Select Trace & Log Central icon
- Now Select "Collect Files" and choose the Trace files to download
- Check the CUCM and next page choose "Role-based-Security" and "Tomcat security" options
- Click Finish
Related Information
