[cisco-voip] MLA command history?

[Simon, Bill]

Thanks.  I saw this link go by earlier but ignored it thinking it was
something different.  Looks like a good product.  Do you use it?  What do
you think?


> -----Original Message-----
> From: J. Oquendo [mailto:sil at infiltrated.net] 
> Sent: Monday, July 31, 2006 1:35 PM
> To: Simon, Bill
> Subject: Re: [cisco-voip] MLA command history?
> 
> http://www.cisco.com/en/US/products/ps6524/products_data_sheet
> 0900aecd80313abd.html
> 
> Simon, Bill wrote:
> > This is horribly cryptic.  How about a reporting tool that 
> tells it in plain
> > English (or French, or Chinese, or whatever) ?
> >
> >  
> >
> >   
> >> -----Original Message-----
> >> From: Ryan Ratliff [mailto:rratliff at cisco.com] 
> >> Sent: Monday, July 31, 2006 1:30 PM
> >> To: Robert Kulagowski
> >> Cc: cisco-voip at puck.nether.net
> >> Subject: Re: [cisco-voip] MLA command history?
> >>
> >> Here is a line from the IIS log on my 4.1(3) server after 
> I did an  
> >> update to a 413XXXX route pattern.
> >>
> >> 2006-07-31 17:17:44 14.48.39.100 administrator 
> 14.48.39.100 443 GET / 
> >> CCMAdmin/_RemoteScripts/rs_system.asp  
> >> _method=updateRoutePattern&_mtype=execute&pcount=41&p0=% 
> >> 7BF96BF080-282E-43A7-AD45-576F5C62DCB3%7D&p1=5&p2=421XXXX
> >>
> >> There is a lot more to the line but I've included just the 
> important  
> >> parts.
> >>
> >> The first IP address is the source IP addr, the second is 
> the server  
> >> IP address.  The username is pretty obvious, my server 
> does not have  
> >> MLA enabled.
> >> GET is the operation, and what follows is the good stuff.  
> p0 is the  
> >> SQL pkid of the route pattern, found in the NumPlan table 
> >> (%7b = { so  
> >> the actual pkid in my case starts with F96B).  p2 is the 
> >> actual route  
> >> pattern (421XXXX in my case).  Between these two you 
> should be able  
> >> to identify the correct route pattern.
> >>
> >> The search string you'll want to use is "updateRoutePattern".
> >>
> >> So to put it all together, run the following command from a cmd  
> >> prompt to get all the route pattern udpates from today.
> >> findstr updateRoutePattern c:\winnt\system32\logfiles\w3svc1 
> >> \ex060731.log > routepatternupdates.txt
> >>
> >> This will dump all the updates into the current directory.  From  
> >> there just take a look and see what you have.
> >>
> >> -Ryan
> >>
> >> On Jul 31, 2006, at 11:45 AM, Robert Kulagowski wrote:
> >>
> >> Wes Sisk wrote:
> >>     
> >>> The MLA access logs tell you a little bit:
> >>> http://www.cisco.com/en/US/customer/products/sw/voicesw/ps556/ 
> >>> 
> products_administration_guide_chapter09186a00803eda81.html#wp1025731
> >>>
> >>>
> >>> 07/31/06:11:23:31:Access:|ccmadministrator|access||/CCMAdmin/ 
> >>> _RemoteScripts/rs_system.asp||deleteRoutePattern
> >>> : called with Full Access
> >>> 07/31/06:11:24:18:Access:|ccmadministrator|access||/CCMAdmin/ 
> >>> _RemoteScripts/rs_system.asp||deleteRoutePattern
> >>> : called with Full Access
> >>>
> >>> But as Ryan said, this IIS logs tell you more.
> >>>       
> >> It turns out that in this case it wasn't a delete; it was an 
> >> update that
> >> should have been a copy.
> >>
> >> I haven't had the cycles to investigate, so I'll have to 
> >> check if there
> >> would have been sufficient details in the IIS logs to 
> determine what
> >> happened.
> >> _______________________________________________
> >> cisco-voip mailing list
> >> cisco-voip at puck.nether.net
> >> https://puck.nether.net/mailman/listinfo/cisco-voip
> >>
> >> _______________________________________________
> >> cisco-voip mailing list
> >> cisco-voip at puck.nether.net
> >> https://puck.nether.net/mailman/listinfo/cisco-voip
> >>
> >>     
> > _______________________________________________
> > cisco-voip mailing list
> > cisco-voip at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-voip
> >
> >   
> 
> 
> -- 
> ====================================================
> J. Oquendo
> http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743
> GPG Key ID 0x1383A743
> Fingerprint:
> 7B02 28CF 24D3 ACA7 9907  789A 8772 7736 1383 A743
> 
> sil . infiltrated @ net
> http://www.infiltrated.net 
> 
> 
> The happiness of society is the end of government.
> John Adams
>