CUCM 8.6.2 - Doubt about what impact enable audit log

[wilsonsant]

Hi Guys,

My Customer have a solution with 06 Server working the version CUCM 8.6.2 and would like know what is the impact enable audit log. I saw the documentation that this option is enable by default, but, in the your scenario the option "apply all nodes" is not enable. I would like know what the impact in enable this feature in all Server. Are there any recommendation about this? If no have problem, are there any documentation informing about this?

Thanks,

Wilson                   

[Manish Gogna · Accepted solution]

Hi Wilson,

As long as the "Enable Purging" box is checked under Audit Log configuration it should not cause any issues with system performance.

The Log Partition Monitor (LPM) looks at the Enable Purging option to determine whether it needs to purge audit logs. When you check this check box, LPM purges all the audit log files in RTMT whenever the common partition disk usage goes above the high water mark

Additionally, From Platform CLI auditors can use the file search command to search the local Audit logs.

For example to see all the Audit Logs that contains the ClientIP address of 10.81.96.40 within the Audit Logs generated in the last day on a given CUCM Server in the cluster one can use the following CLI command.

admin:file search activelog audit/AuditApp/Audit*.log 10.81.96.40 reltime days 1

HTH

Manish

[wilsonsant]

Hi Manish,

Thanks a lot for your help and explanation.

Wilson