Is there a way to see who logged into CUCM and made changes?

[d.anthony.hadley_2]

On CUCM System version: 8.6.2.23060-1, VMWare Installation, some Route Patterns seems to disappear.  Is there a way to see who logged into the CUCM and when?  Also, is there a way to see when config changes were made?  I know this capability was not possible in earlier versions.  Does this version have anything like that, to see who logged in, when, or what changes were made?

Thanks

[Suresh Subramanian · Accepted solution]

You may check the audit logs in CUCM to track who changed what and when. http://www.netcraftsmen.net/blogs/entry/audit-logs-on-cisco-unified-communications-manager-cucm.html .. http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/service/8_6_1/admin/serviceability/saaulog.pdf

[Venkatesh Perumal]

Hi,

You can collect the Audit logs to see any config changes performed on CUCM.

Refer the below link for more detail.

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/service/8_6_1/car/car/carovrvw.html#wp1134447

Regards,

Venkatesh

[d.anthony.hadley_2]

Thanks for the link.  It is helpful in configuring the Audit Logs but not so much for accessing and downloading them.

[Aman Soi]

Hi,

You can also have a look into this link

http://variphy.com/products/enterprises/cisco-audit-log

regds,

aman

[d.anthony.hadley_2]

Thanks for the answer.  That's what I was looking for.  The second one is helpful in configuring the logs, but not accessing them.  The first link, non-Cisco, was the most helpful - very simple, practical, on how to configure and access the audit logs. 

[andres.pasten]

Hi,

There is a field on Audit Log Configuration, for Remote Syslog, with these fields:
- Server Name    

- Remote Syslog Audit Event Level

I've enabled a syslog server to receive the audit logs, but the only one received are the login/logout events.

Only on the log files obtained with RTMT I can see the update events. It would be helpful to receive these logs on a remote server to avoid the delete of the file on the CUCM.

Any one has configured the remote syslog for audit? It requires another config somewhere in the CUCM?

TIA

Andres Pasten

ENTEL S.A.