CUCM Audit Logs

[Ekin Gumus]

Hi All,

In my cluster, suddenly without my intervention around 50 IP Phones have deleted and need to figure out who did it. I got some audit logs but the file I got from RTMT looking so usefull. Any idea how to get that reliable info from CUCM or RTMT?

Thanks.

[Sreekanth Narayanan]

Have you already enabled the Audit logs on your CUCM? If not, you won't be able to get the information of the changes. You can go ahead now and navigate to Serviceability > Trace configuration > Select server and Audit logs. Then set the logs to a higher detail level than default.

You will then get a higher detail of logs from RTMT when you choose Audit logs.

[Deepak Rawat]

http://docwiki.cisco.com/wiki/CUCM_FAQ#Administration

Regards

Deepak

[Ekin Gumus]

Deepak,

This link helped me a lot but I could not get what I need. In my cucm cluster suddenly around 50 phones deleted but not able to see exactly "who did it". any idea how to do that?