Unable to see CUCM database update in Syslog

[sirajuddeen t p]

Hi Team,

I have configured a remote syslog server for Audit logs on my CUCM
9.1.2. I have enabled debug log and selected database update. Unfortunately I could not see any logs in syslog viewer (manage engine) other than login and logout activity. Kndly help to fix the issue.

When I checked via RTMT, I could see the logs generated whatever I made changes in CUCM administration.


Thank you,

Siraj

[Manish Gogna]

Hi Siraj,

You mean to say that collecting the Audit logs locally gives you the complete logs which show all changes made via cucm admin page while transferring these logs to a remote server does not show all the changes?

As far as i know within cucm there is no filtering mechanism to filter the logs and then send it to a remote server via RTMt config. Can you try configuring an external syslog server that is in the same  subnet as CUCM/RTMT and see if you face the same issue.

HTH

Manish

[sirajuddeen t p]

Dear Manish,

I was referring send audit logs from CUCM to Syslog server (Cisco Unified Serviceability-> Tools -> Audit log config)

I had a case with TAC and came to know that this is due to bug in some of the cucm version. Mine is 9.1.2 which is affected release.

Regards,

Siraj

[Manish Gogna]

Ok, in that case you may provide the bug details here for the benefit of others in the future.

Manish

[sirajuddeen t p]

Dear Manish,

Provided Bug ID: CSCus02985

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCus02985/?reffering_site=dumpcr

Regards,

Siraj