Log of an action in CUCM 8.5

[reg_cisco]

Hello.

We are three admins of CUCM 8.5 and we use the same administrator user but with different ip's.

My question is:

Is there any way to know from what ip a DN was erased?.

Thanks in advance.       

[Victor Circelli]

Hi reg_cisco,

Yes, you can identify the actions by IP address.

Take a look on this recently extracted Audit Log from my CUCM:

15:57:57.819 |LogMessage  UserID : ccmadmin ClientAddress : 10.55.48.23  Severity : 3  EventType : UserLogging  ResourceAccessed: Cisco Trace Collection Server  EventStatus : Success  CompulsoryEvent : No  AuditCategory : AdministrativeEvent  ComponentID : Cisco CCM Application  AuditDetails : Login Authentication Successful App ID: Cisco Tomcat Cluster ID:  Node ID: XXXXXXXXXX

[Dennis Mink]

Just in case, use RTMT to get the audit logs, and go to TRACE & LOG Central>audit logs

=============================
Please remember to rate useful posts, by clicking on the stars below.

=============================

[reg_cisco]

@Victor, @minkdennis.

I have no enabled logs on my CUCM and I need watch a log of past days.

I don't see the option in RTMT to collect logs of past days.

@Victor I see in your example log that is not valid for my case.

Thanks.