[cisco-voip] MLA command history?

[Ryan Ratliff]

Here is a line from the IIS log on my 4.1(3) server after I did an  
update to a 413XXXX route pattern.

2006-07-31 17:17:44 14.48.39.100 administrator 14.48.39.100 443 GET / 
CCMAdmin/_RemoteScripts/rs_system.asp  
_method=updateRoutePattern&_mtype=execute&pcount=41&p0=% 
7BF96BF080-282E-43A7-AD45-576F5C62DCB3%7D&p1=5&p2=421XXXX

There is a lot more to the line but I've included just the important  
parts.

The first IP address is the source IP addr, the second is the server  
IP address.  The username is pretty obvious, my server does not have  
MLA enabled.
GET is the operation, and what follows is the good stuff.  p0 is the  
SQL pkid of the route pattern, found in the NumPlan table (%7b = { so  
the actual pkid in my case starts with F96B).  p2 is the actual route  
pattern (421XXXX in my case).  Between these two you should be able  
to identify the correct route pattern.

The search string you'll want to use is "updateRoutePattern".

So to put it all together, run the following command from a cmd  
prompt to get all the route pattern udpates from today.
findstr updateRoutePattern c:\winnt\system32\logfiles\w3svc1 
\ex060731.log > routepatternupdates.txt

This will dump all the updates into the current directory.  From  
there just take a look and see what you have.

-Ryan

On Jul 31, 2006, at 11:45 AM, Robert Kulagowski wrote:

Wes Sisk wrote:
> The MLA access logs tell you a little bit:
> http://www.cisco.com/en/US/customer/products/sw/voicesw/ps556/ 
> products_administration_guide_chapter09186a00803eda81.html#wp1025731
>
>
> 07/31/06:11:23:31:Access:|ccmadministrator|access||/CCMAdmin/ 
> _RemoteScripts/rs_system.asp||deleteRoutePattern
> : called with Full Access
> 07/31/06:11:24:18:Access:|ccmadministrator|access||/CCMAdmin/ 
> _RemoteScripts/rs_system.asp||deleteRoutePattern
> : called with Full Access
>
> But as Ryan said, this IIS logs tell you more.

It turns out that in this case it wasn't a delete; it was an update that
should have been a copy.

I haven't had the cycles to investigate, so I'll have to check if there
would have been sufficient details in the IIS logs to determine what
happened.
_______________________________________________
cisco-voip mailing list
cisco-voip at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip