CUCM Audit log alet

[Daniov1]

Hi,

I have a lot of alerts generated in my CUCM servers named AuditLogOverFlowDueToLogRotation.
This alert appears every day for a week and does not disappear.

I understand that this alert indicates that the audit log overflow occurred. An existing audit log file is overwritten resulting in overflow and eventual loss of audit data.
But it's still generating alert.

Any suggest ?

[Mohammed al Baqari]

Hi, you can configure SFTP server to dump your audit log and clear the
buffer to overcome the problem (assuming that your compliance mandate is to
keep audit logs for a certain time). Also, make sure that you don't have
security flaws. It's not very common to have audit buffer overflow.

[Daniov1]

Hi Mohammed,

Thanks for your reply.
How can I check what is the reason that this alert generated every day?

Thanks ,

Danielo. 

[Mohammed al Baqari]

>From RTMT you can view audit logs. Here you go.

https://netcraftsmen.com/audit-logs-on-cisco-unified-communications-manager-cucm/

**** please remember to rate useful posts

[johncpost222]

Mohammad - If you are still online. I looked at the document but it did not show how to  SFTP the log files to remove and reduce the size of the log. Do you have that info or do I need a TAC ticket?