[cisco-voip] MLA command history?

[Simon, Bill]

This is horribly cryptic.  How about a reporting tool that tells it in plain
English (or French, or Chinese, or whatever) ?

 

> -----Original Message-----
> From: Ryan Ratliff [mailto:rratliff at cisco.com] 
> Sent: Monday, July 31, 2006 1:30 PM
> To: Robert Kulagowski
> Cc: cisco-voip at puck.nether.net
> Subject: Re: [cisco-voip] MLA command history?
> 
> Here is a line from the IIS log on my 4.1(3) server after I did an  
> update to a 413XXXX route pattern.
> 
> 2006-07-31 17:17:44 14.48.39.100 administrator 14.48.39.100 443 GET / 
> CCMAdmin/_RemoteScripts/rs_system.asp  
> _method=updateRoutePattern&_mtype=execute&pcount=41&p0=% 
> 7BF96BF080-282E-43A7-AD45-576F5C62DCB3%7D&p1=5&p2=421XXXX
> 
> There is a lot more to the line but I've included just the important  
> parts.
> 
> The first IP address is the source IP addr, the second is the server  
> IP address.  The username is pretty obvious, my server does not have  
> MLA enabled.
> GET is the operation, and what follows is the good stuff.  p0 is the  
> SQL pkid of the route pattern, found in the NumPlan table 
> (%7b = { so  
> the actual pkid in my case starts with F96B).  p2 is the 
> actual route  
> pattern (421XXXX in my case).  Between these two you should be able  
> to identify the correct route pattern.
> 
> The search string you'll want to use is "updateRoutePattern".
> 
> So to put it all together, run the following command from a cmd  
> prompt to get all the route pattern udpates from today.
> findstr updateRoutePattern c:\winnt\system32\logfiles\w3svc1 
> \ex060731.log > routepatternupdates.txt
> 
> This will dump all the updates into the current directory.  From  
> there just take a look and see what you have.
> 
> -Ryan
> 
> On Jul 31, 2006, at 11:45 AM, Robert Kulagowski wrote:
> 
> Wes Sisk wrote:
> > The MLA access logs tell you a little bit:
> > http://www.cisco.com/en/US/customer/products/sw/voicesw/ps556/ 
> > products_administration_guide_chapter09186a00803eda81.html#wp1025731
> >
> >
> > 07/31/06:11:23:31:Access:|ccmadministrator|access||/CCMAdmin/ 
> > _RemoteScripts/rs_system.asp||deleteRoutePattern
> > : called with Full Access
> > 07/31/06:11:24:18:Access:|ccmadministrator|access||/CCMAdmin/ 
> > _RemoteScripts/rs_system.asp||deleteRoutePattern
> > : called with Full Access
> >
> > But as Ryan said, this IIS logs tell you more.
> 
> It turns out that in this case it wasn't a delete; it was an 
> update that
> should have been a copy.
> 
> I haven't had the cycles to investigate, so I'll have to 
> check if there
> would have been sufficient details in the IIS logs to determine what
> happened.
> _______________________________________________
> cisco-voip mailing list
> cisco-voip at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
> 
> _______________________________________________
> cisco-voip mailing list
> cisco-voip at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
>