Audit

[bkhanal1971]

I want to check the events such as additions and deletions of phones in CUCM servers (ver 8.6). I tried audit logs through rtmt but but the logs don't tell me much about such details. Am I missing something?

Thanks,

[Aman Soi]

Hi ,

Audit logs keep tracks of following:

Cisco Unified Serviceability

Cisco Unified Serviceability logs the following events:

•Activation, deactivation, start, or stop of a service.

•Changes in trace configurations and alarm configurations.

•Changes in SNMP configurations.

•Changes in CDR management.

•Review of any report in the Serviceability Reports Archive. This log gets viewed on the reporter node.

Cisco Unified Real-Time Monitoring Tool

Cisco Unified Real-Time Monitoring Tool logs the following events with an audit event alarm:

•Alert configuration.

•Alert suspension.

•E-mail configuration.

•Set node alert status.

•Alert addition.

•Add alert action.

•Clear alert.

•Enable alert.

•Remove alert action.

•Remove alert.

Cisco Unified Communications Manager CDR Analysis and Reporting

Cisco Unified Communications Manager CDR Analysis and Reporting (CAR) creates audit logs for these events:

•Loader scheduling.

•Daily, weekly, and monthly reports scheduling.

•Mail parameters configuration.

•Dial plan configuration.

•Gateway configuration.

•System preferences configuration.

•Autopurge configuration.

•Rating engine configurations for duration, time of day, and voice quality.

•QoS configurations.

•Automatic generation/alert of pregenerated reports configurations.

•Notification limits configuration.

Cisco Unified Communications Manager Administration

The following events get logged for various components of Cisco Unified Communications Manager Administration:

•User logging (user logins and user logouts).

•User role membership updates (user added, user deleted, user role updated).

•Role updates (new roles added, deleted, or updated).

•Device updates (phones and gateways).

•Server configuration updates (changes to alarm or trace configurations, service parameters, enterprise parameters, IP addresses, host names, Ethernet settings, and Cisco Unified Communications Manager server additions or deletions

Please refer the URL

http://www.netcraftsmen.net/component/content/article/70-unified-communications/810-audit-logs-on-cisco-unified-communications-manager-cucm.html

They are enabled by default.Just try making change in existing phone such as change in description .The same woulbe tracked in audit log.

regds,

aman

[Aman Soi]

Hi,

One more thing I would like to add : the userID through which u are logging in RTMT has "standard audit log adminsitration" role assigned.Lastly,If u are making any changes,make sure u are saving it.

regds,

aman

[bkhanal1971]

Aman: Thank you very much the response. You were very helpful.

Thanks

[Aman Soi]

Hi,

Were u able to find where u went wrong?

Please let me know.

regds,

aman

[bkhanal1971]

Yes I was able to find the type of information that i was looking for within the audit log. Events such as phones adds/deletions etc can be found in the group called CUCMAdmin. Easiest way to find them is either by searching by the keyword "CUCMAdmin" or the DN or MAC address.