[cisco-voip] CDR on cucm analysis reports-Fraud Calls

[Ben Amick]

Can someone call into your attendant and then dial an outside number? That’s a common cause

From: cisco-voip [mailto:cisco-voip-bounces at puck.nether.net] On Behalf Of Brian Meade
Sent: Thursday, June 15, 2017 3:52 PM
To: Nazar Shabour <nizarshabour at gmail.com>
Cc: cisco-voip at puck.nether.net; Jonatan Quezada <jonatan.quezada at chemeketa.edu>
Subject: Re: [cisco-voip] CDR on cucm analysis reports-Fraud Calls

What is the origDevice listed in the CDRs?

On Thu, Jun 15, 2017 at 3:03 PM, Nazar Shabour <nizarshabour at gmail.com<mailto:nizarshabour at gmail.com>> wrote:
Dears ,

Please can your give insight on how to  find out "unspecifieduser" on thine CDR reports that has costed us thousands of US placing international and long distance calls ,I cant find any ext real one that he/she uses to place the calls the ext is within the dial-plan but not
configured ,thus user uses it to make the calls.
Any thoughts are valuable ,


Thanks

AbuAlneez,


On Mon, May 22, 2017 at 11:06 AM, Gary Parker <G.J.Parker at lboro.ac.uk<mailto:G.J.Parker at lboro.ac.uk>> wrote:

> On 21 May 2017, at 22:34, Brian Meade <bmeade90 at vt.edu<mailto:bmeade90 at vt.edu>> wrote:
>
> CAR DB only holds up to 30 days.  You need a billing server to offload CDR to if you need to keep info longer than that.
>
> On Fri, May 19, 2017 at 4:29 PM, Jonatan Quezada <jonatan.quezada at chemeketa.edu<mailto:jonatan.quezada at chemeketa.edu>> wrote:
> does anyone have any insight on where to adjust how far back to report on. I get a limit when I try a report older than a month. We should be able to go back for a year? right. if this is a setting for how long to archive call details, where do i change that?

If you don’t already have billing server, can’t get the budget for one or want something a bit different to the regular packages, I can highly recommend Damien Hauser’s CUCM/ELK integration tools. You it’s free (all based on open source tools) and gives you a full elasticsearch database of CDR/CMR database with a Kibana frontend and logstash ingest. There’s even a load of pre-configured reports and visualisations for you to modify for your own needs.

GitHub repo here:
https://github.com/damhau/cucm-cdr<http://cp.mcafee.com/d/FZsScyhJ5wQszDTT6hP9KVJ55BZBcsehd79J55BZBcsY-Orhhpvuv7ffK6Qkn3hOqerTKzsSgRmlyEa9JGX3oSVsSjrlS6NJOVJwQsL-CMqen-LOabb3b0VzHTbFIInV4sPtUs-eWyaaRQRrELYG7DR8OJMddECS3t-KCCYOqehRSnPtPpesRG9px6kOrp3BYgRkDHumrIGnIx4TqlblbCqOmbAaJMJZ0kIToHMd9_7wqrhjKCMr1vF6y0QJSBiRiVCIBziWq818e1pEwH0QgmrIGq8dxFVqAG6y2fHlzexsnzHq1Ew4JffErv76PEhcDElF>

Some more detailed installation instructions here:
https://damienetwork.wordpress.com/2015/10/09/elk-setup-for-cucm-cdr/<http://cp.mcafee.com/d/FZsScCQm3hOevvsp7cCXCQkmnSkNMV4QsCQkmnSkNPPX9J55BZVYsY-Urhhsd79EVLuWdPp3lpmawECSHIdzrBPpdJnor6TbCS3hO_Wr1EVvW_8EIIcI3CeLsKCONvAhPdTxPUXG8EHnjlKy_OEuvkzaT0QSCrodTWWqrP9EV7npvdTdAVPmEBC8qHbMqoH4HNyIk5E_iDbUDt5_4rVsQsVVVkLjVJH5TqNbSrIGnIx73tFkJkKpH9oKgGT2TQ1iPtyL0QDYu1FJ5eWr1I5-Aq83iTqlblbCqOmdbFEw4wU5Cy2I3h1pKOFEwS6DBGiEq88-JmcW5NueJE6y0iQY-xJYsrR2wp>

You *will* need a working knowledge of linux to get this working but the results are worth it, imho. We get a lot more useful technical information out of this than we do our Tiger call logger/billing platform.


---
/-Gary Parker----------------------------------f--\
|     Unified Communications Service Manager      |
n      Loughborough University, IT Services       |
|     tel:+441509635635<tel:%2B441509635635> sip:gary at lboro.ac.uk<mailto:sip%3Agary at lboro.ac.uk>      o
|     http://delphium.lboro.ac.uk/pubkey.txt<http://cp.mcafee.com/d/1jWVIgdEI6zAs--UOepdTdEEILIFzxO9EVdEEILIFzDDSjqabbXPUVVZMSyyUqejhPuZQrCO6GOIl1hdJnor6TbCOrqKMSdKndI6zB_QS3hO_R-hhpopo7ctuVtdBy_8zCrL3DNTkhhmKCHt5_BgY-F6lK1FJASMrLRQQTCjhOeKO-rKr01EuuIjASHNV2IqZJKraUISga-mWovcTqlblbCqOmbAaJMJZ0kIToHMd9_7wqrhjKCMr1vF6y0QJSBiRiVCIBziWq818e1pEwH0QgmrIGq8dxFVqAG6y2fHlzexsnzHq1Ew4JffErv76O856JOz9>      |
\r----------------------------------------------d-/

_______________________________________________
cisco-voip mailing list
cisco-voip at puck.nether.net<mailto:cisco-voip at puck.nether.net>
https://puck.nether.net/mailman/listinfo/cisco-voip<http://cp.mcafee.com/d/k-Kr6wUSyMqehPXXz8VATsSyyO-OCe78CzASyyO-OCeuvpdEEILLfzDDT3qabxEVd7dXThKr8qHaNk54SRtxIrsKr9JGX3oSVsSMqen_jod7b_nV55BxBwsNRXBQSmbYyepKYev7th55qWqJQn-l3PWApmU6CS3r1K_njjupd78WXbVKVIDeqR4INpKNnwqj-f0T1dnoovaAVgtHBFkJkKpH9oTqlblbCqOmbAaJMJZ0kIToHMd9_7wqrhjKCMr1vF6y0QJSBiRiVCIBziWq818e1pEwH0QgmrIGq8dxFVqAG6y2fHlzexsnzHq1Ew4JffErv76ZHCOMc9xMNxW>




Confidentiality Note: This message is intended for use only by the individual or entity to which it is addressed and may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please contact the sender immediately and destroy the material in its entirety, whether electronic or hard copy. Thank you
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20170615/e012d4e4/attachment.html>