Audit logs only provide information about GUI, if a user changes CFA on the phone it won't show up there.
You would need to review CUCM traces to get that info. You'll see the softkey event and then the DN.
HTH
java
if this helps, please rate
www.cisco.com/go/pdihelpdesk
HTH
java
if this helps, please rate