Traces for Call Manager Authentication attempts

[neilobrien]

Hi Guys,

I have a user who’s Active Directory account is continuously being locked out by our CCM Publisher.  We use LDAP authentication but we’re not quite sure what device or where the authentication attempts are coming from.

What trace would I need to run on Call Manager in order to see the authentication attempts??

Thanks in advance,

Neil

[htluo · Accepted solution]

Since you said "I have a user who’s Active Directory account is continuously being locked out by our CCM Publisher", you must have known the user ID.

There are only two components on CUCM will initiate authentication request against LDAP - Tomcat and CTIManager.

You may get "Tomcat Security Logs" and "CTIManager logs" from CUCM and search for the user ID in problem.  Then cross reference the timestamp with your Active Directory event logs.

Michael

http://htluo.blogspot.com

[neilobrien]

thanks Michael, that's exactly what I was looking for.

[Stuart Lane]

Hello,

I'm having a similar issue to this one and was wondering if you could shed some light on it. I examined the logs mentioned above and can see where the authentication attempt is failing every 10 minutes. However, I dont see anything that indicates what app/service/device the authentication request is originating from. Would you know where I could look for some more information?

Thanks in advance!

Stuart

[JFerello]

Stuart,

Did you ever figure this out?

Thanks,

Justin

[Jose Mendez]

Try these, the bold letters represent the checkboxes when downloading the traces from RTMT, the rest is how to configure the debug filter level:

Cisco Serviceability > Trace > Configuration > Server IP > Directory Services > Cisco DirSync > Detailed

Cisco Serviceability > Trace > Configuration > Server IP > Database and Administration Services > Cisco CallManager User Web Service > Detailed

Collecting traces:

http://supportforums.cisco.com/docs/DOC-11588

Please rate useful posts

[htluo]

Unfortunately, neither "DirSync logs" nor "CallManager User Web Service" will show you authentication information. 

Michael

[Jose Mendez]

Nice.