How to get the logs who deleted the Configuration

[Dhirendrakumar]

Hi All,

In my organization, Someone deleted the end user configuration. But don't know who deleted it.

We have reconfigured the configuration back, but want to check the logs from which ID it was done.

In admin Logs we can see who created originally and then another log we can see is created by me because it was deleted. Information we need to find out who delete this account.

[Vaijanath Sonvane]

Hi @Stephanie Knoop ,

Thank you for clarification. I did mention that the control hub doesn't show log entry for deactivation/reactivation.

[Vaijanath Sonvane]

Hi @Dhirendrakumar & @Stephanie Knoop,

I guess Cisco has added this feature recently. The audit logs in control hub now shows the entry for deleted user and who performed the action. 

 

On the other note, the audit logs doesn't show any entry for deactivation/reactivation.

[Stephanie Knoop]

What you are showing here is an actual deletion performed.  If you instead "deactivate", the user will auto delete after 30 days and there will be no record of the deactivation or the auto delete. Many companies deactivate to avoid accidental deletion of all user data, and that activity is not adequately logged in my opinion.

[dtibbe]

Under Admin->Troubleshooting->Admin Activities I can see changes in the license assignment as well as deletions/creations of users..

[Dhirendrakumar]

For me its showing only creation logs for last 1 year. No deletion information

[Stephanie Knoop]

The audit logs in WebEx control hub are riddled with problems. Because many companies do not delete users, rather deactivating them, the actual deletions that occurs 30 days later by a cleanup script that is run WebEx do not show up in the audit logs. Also, the deactivation action does not show up in the audit logs. The other thing not in the audit logs is any activity that is performed within a CSV file.

I have raised this issue with TAC on a couple of occasions and I think the only way it is going to get the attention is if large numbers of the community open up TAC cases and contact their account teams.

[Dhirendrakumar]

For my specific case User was active and he was associated with call queue.