how to create a lot to see who has log on to the CUCM 9

[Rachel Au]

Hi

is there any way that can keep track of who has been log on to the cucm administrator page and make changes on cucm 9 based on the user login name?

many thanks

Rachel

[Suresh Hudda]

You can collect the Audit logs using RTMT to see any configuration changes performed on CUCM and by whom and which IP.

Suresh

[Rachel Au]

Hi

I have tried to set it up as per the screen shot, however when I tried to download it, even though i can see the log file, and also the size of the file is not 0, however it keep saying file file does not exist....

I tried both browse on the viewer and also download it, there is no file can be downloaded...

any idea?

Rachel

[Nadeem Ahmed]

Hello Rachel,

Did you try to access the audit.log through CUCM CLI.

Can you try using and see are you able to so

Below is the command to check the file

login to CLI

file list activelog audit/AuditApp/* date detail

Shows last 10 logs messages from the Audit file

file tail activelog audit/AuditApp/Auditxxxxx.log

pertaining to RTMT issue, looks like you user do not have write access permission
c:\Program Files\Cisco directory.

Br,
Nadeem

[Rachel Au]

I now can open the file, however it only has the time.... but didnt have the username to indicate who has logged on....

<?xml version="1.0"?>
-<QueryResult> -<Node name="10.200.10.10"> <TokenID>1402625972246</TokenID> -<ServiceList> -<ServiceName name="Cisco Audit Logs"> -<FileType name="informixauditlogs"> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.20" size="9999967" modifiedDate="Tue Aug 19 12:42:56 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.21" size="9999978" modifiedDate="Tue Aug 19 12:44:37 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.22" size="9999931" modifiedDate="Tue Aug 19 12:46:30 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.23" size="9999907" modifiedDate="Tue Aug 19 12:49:38 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.24" size="9999925" modifiedDate="Tue Aug 19 12:53:02 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.25" size="9999931" modifiedDate="Tue Aug 19 12:53:50 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.26" size="9999884" modifiedDate="Tue Aug 19 12:56:46 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.27" size="9999948" modifiedDate="Tue Aug 19 13:01:58 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.28" size="9999991" modifiedDate="Tue Aug 19 13:07:57 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.29" size="9999931" modifiedDate="Tue Aug 19 13:10:00 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.30" size="9999895" modifiedDate="Tue Aug 19 13:17:27 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.31" size="9999943" modifiedDate="Tue Aug 19 13:28:55 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.32" size="9999893" modifiedDate="Tue Aug 19 13:39:01 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.33" size="9999878" modifiedDate="Tue Aug 19 13:41:31 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.34" size="9999880" modifiedDate="Tue Aug 19 13:49:27 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.35" size="9999924" modifiedDate="Tue Aug 19 13:59:38 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.36" size="9999997" modifiedDate="Tue Aug 19 14:10:41 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.37" size="9999910" modifiedDate="Tue Aug 19 14:22:01 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.38" size="9999982" modifiedDate="Tue Aug 19 14:33:38 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.39" size="9999974" modifiedDate="Tue Aug 19 14:44:43 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.40" size="9999993" modifiedDate="Tue Aug 19 14:53:11 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.41" size="9999997" modifiedDate="Tue Aug 19 15:03:51 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.42" size="9999885" modifiedDate="Tue Aug 19 15:14:52 EST 2014"/> <FileName name="/var/log/active/audit/informixauditlogs/oc_hub_pub_ccm9_0_1_10000_37.43" size="5571892" modifiedDate="Tue Aug 19 15:19:41 EST 2014"/> </FileType> -<FileType name="AuditApp"> <FileName name="/var/log/active/audit/AuditApp/Audit00000036.log" size="1422908" modifiedDate="Tue Aug 19 15:19:41 EST 2014"/> </FileType> -<FileType name="vos"> <FileName name="/var/log/active/audit/vos/vos-audit.log" size="8593627" modifiedDate="Tue Aug 19 15:19:25 EST 2014"/> </FileType> </ServiceName> </ServiceList> </Node> </QueryResult>

is there way to find out what user has log on?

Thanks

Rachel

[islam.kamal]

Hello

Kindly check the attached file for audit logon using RTMT.

Thanks

please rate all useful informaion 

[Rachel Au]

Hi

I have tried to set it up as per the screen shot, however when I tried to download it, even though i can see the log file, and also the size of the file is not 0, however it keep saying file file does not exist....

I tried both browse on the viewer and also download it, there is no file can be downloaded...

any idea?

Rachel

[islam.kamal]

Hi

Kindly check the permissions for the user .

Thanks

please rate all useful information