Server says we reset the phone, but we didn't...

[voip7372]

I see this when looking at some logs via RTMT:

Endpoint restart initiated or Apply Config initiated on the specified endpoint, 2005

The user says the phone reset without warning.  I checked the logs and from what I can tell, CUCM is claims the reset was requested by us (as if we were logged in and clicked on 'Apply Config' for that phone, but we didn't.   Is there some other reason this could happen where it looks like we clicked apply config but we didn't?  

I attached the info in the log I saw related to this phone and the reset.  From what I can see, it appears the first entry/event that triggered the reset of the phone was that first line where it says the Apply Config was initiated.  The  user didn't tell me if it actually reset when they were using the phone or if it just quickly re-registered when they were not using it but they just happened to notice it.   I'll ask about that.

[Chris Deren]

You can pull the Audit log from RTMT and see if anyone you did not expect initiated it.

[voip7372]

I scanned over the audit log for around that time frame but didn't see anyone logged in doing anything.  I just wonder if there's anything else that could trigger it that would make it seem as though someone manually clicked 'apply config'.

[hsood]

The logs required for such an event are :

CCM logs (Tells if any (let's say) device pool changes were made that triggered the issue or a TCP socket broke)

CCM webadmin logs (Exact menus searched on CCM GUI)

Audit logs (Insert, Delete operations)

Event Viewer Application and System logs (Reason code information might help out)

The only problem with these logs though are they need to be detailed level and the issue has already occurred, so if they were not detailed , you would not be able to make much out of it.

Please rate if found helpful.

Regards,

Hitesh