[cisco-voip] Problems with audit logs to remote syslog server

[Roger Wiklund]

Hi

I have configured a remote syslog server for Audit logs on my CUCM
8.6.2. I've set the level do debug, but the only thing I can see are
login/logouts.

Oct 30 15:01:49 xx.xx.xx.xx 21858: Oct 30 2012 14:01:49.389 UTC :
%UC_LOGIN-6-AuthenticationSucceeded: %[Login Date/Time=10/30/2012 at
15:01:49][Login IP Address/Hostname=xx.xx.xx.xx][Login
Interface=Apache-Axis2][Login UserID=VisionAXLUser][App ID=Cisco
Tomcat][Cluster ID=][Node ID=dnd-glb-cucm01]: Login Authentication
succeeded.

When I use RTMT however I can see much more, i.e created/deleted
translation pattern etc.

13:58:40.190 |LogMessage   UserID : Administrator  ClientAddress :
xx.xx.xx.xx  Severity : 5  EventType : GeneralConfigurationUpdate
ResourceAccessed: CUCMAdmin  EventStatus : Success  CompulsoryEvent :
No  AuditCategory : AdministrativeEvent  ComponentID : Cisco CUCM
Administration  AuditDetails :  record in table numplan with key field
dnorpattern = 79827 deleted  App ID: Cisco Tomcat Cluster ID:  Node
ID: dnd-glb-cucm01

What am I doing wrong?

/Roger