06-17-2013 01:44 PM - edited 03-18-2019 01:18 AM
Is anyone aware of a log anywhere that tracks changes made to individual an codec's configuration settings? The codecs are managed by a TMS system.
06-17-2013 02:30 PM
there's a feature on the codecs named 'audit logging'.All config changes will be logged together with login attempts.
The data can be stored in a file on the codec or you can opt to send it to a server.
06-18-2013 06:57 AM
Thanks Danny. Any idea where the data is logged if the "internal" option is chosen?
06-18-2013 07:16 AM
the log can be found under the directory :
And can be configured using :
xConfiguration Security Audit Server Address: ""
xConfiguration Security Audit Server Port: 514
xConfiguration Security Audit OnError Action: Ignore
xConfiguration Security Audit Logging Mode: Internal
You need to resboot the codec once you have enabled the logging.
You can also point your browser to the logfile.
06-18-2013 09:55 AM
Thanks Danny, the reboot did it.
I see in the codec configuration that the external server audit logging function defaults to port 514. I assume that's UDP port 514 and is essentially a syslog type of thing? Is that correct?
Also, I've enabled internal audit logging on one of our codecs and I'm seeing tons of these messages (below). What is this? Is this the codec getting the status from the Intouch panel?
Jun 18 11:00:48 (none) main: User (0) successfully executed command '/Message/Echo Text: InTouch' from .
06-18-2013 11:10 AM
Those touch keepalives are indeed cluttering the logs.
Jun 18 20:02:35 (none) main: User (1001) successfully executed command '/Experimental/Peripherals/HeartBeat ID: 00:50:60:06:1E:55 Timeout: 30' from .
Jun 18 20:02:40 (none) main: User (1001) successfully executed command '/Experimental/Peripherals/HeartBeat ID: 00:50:60:06:1E:55 Timeout: 30' from .
Somebody should open an enhancement request to make these messages conditional.
The assumption about the UDP port 514 is incorrect. The syslog uses TCP.
See CSCts98937 - EX60/EX90 and C90/C60 unable to get Syslog working
That ddts is complaining about the fact that the syslog messages are sent using TCP and not UDP.
Is not changed to date, so the transport is still TCP.
06-18-2013 11:38 AM
Thanks Danny. I can't see that bug so it must not be public yet or something. But thanks for shaing the info, at least we know we should be looking for TCP, not UDP.
And yes, it would be great to set the level of audit logging like you can with most other syslog facilities. How would one open up an enhancement request? Also, do you know of anywhere to get the complete list of "audit" messages that can potentially be generated from the codec?
06-18-2013 12:17 PM
I opened a new defect to avoid touch panel messages overwheling the audit logs.
CSCuh58528 - Touch panel heartbeat messages are overhelming the audit log
The type of messages logged are not really documented, at least, I am unaware of such a document. Maybe somebody else on the forum can comment.
The syslog level cannot be set to debug/warnings/informational/etc.
Some examples of messages are login attempt(s) and commands one executed.
Jun 18 21:15:28 (none) sshd: pam_unix(sshd:session): session opened for user root by (uid=0)
Jun 18 21:16:25 (none) main: User (0) successfully changed configuration '/SIP/ListenPort' to 'off' from sweet-brew-7.cisco.com.
06-18-2013 12:25 PM
Thank you for doing that Danny. Much appreciated.
Thanks for your help today!
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: