UCCX 8.5.1 logs

[kingdwight1]

Hi All,

Nuub question here but could really use some guidance.  Someone with admin rights appears to be changing the OperationState in Application Management in UCCX Administration and we would like to find out who that person is.  Is there a log file I can access that can tell me who and when someone changes the OperationState?  If so, can you tell me how to access it?

Thank you in advance,

Dwight

[Chris Deren]

You can see if you can run Audit logs on your version as I dont recall if that was available in version 8.5:

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/crs/express_9_0/configuration/guide/CUCM_BK_UC3AA783_00_unified-serviceability-admin-guide/CUCM_BK_UC3AA783_00_unified-serviceability-admin-guide_chapter_01010.html

[kingdwight1]

Thanks Chris!  I was able to view the AuditLog using RTMT but it doesn't indicate when the OperationState is changed nor by whom it was changed by.  There are several different options in Trace and Log Central to look at other than AuditLog.  I'm starting to work my way through each but do you have any suggestions on where that information may be stored?

Thank you in advance...

Dwight

[Anthony Holloway]

The best you'll get is the URL the user was on, and what their IP Address was; this is from the web server access logs. That's all you'll get. Unfortunately, Cisco does not weigh heavily on the auditing side of things.

[kingdwight1]

Hi Anthony,

Thanks for the info but I can't find Web Server Access Log in Trace and Log Central.  Am I looking in the right spot?  Would you be able to tell me which UCCX Service/Applications or System Services/Applications I should be looking in?

Thank you,

Dwight