<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2900.3020" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2>I know there are PERS and the CIPTUG FAC tool, but are there
product managers that are listening in on this mailing list? Would it be at all
beneficial for us to run completely unscientific polls to substantiate some of
our claims? Could this be brought forward to anyone of importance?</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV>--------------------------------------------------------------------------------<BR>Lelio
Fulgenzi, B.A.<BR>Senior Analyst (CCS) * University of Guelph * Guelph, Ontario
N1G 2W1<BR>(519) 824-4120 x56354 (519) 767-1060 FAX
(JNHN)<BR>^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
<BR>"I can eat fifty eggs." "Nobody can eat fifty eggs."</DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=bills@tns.its.psu.edu href="mailto:bills@tns.its.psu.edu">Simon,
Bill</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=rratliff@cisco.com
href="mailto:rratliff@cisco.com">Ryan Ratliff</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Cc:</B> <A title=erickbe@yahoo.com
href="mailto:erickbe@yahoo.com">Erick Bergquist</A> ; <A
title=lelio@uoguelph.ca href="mailto:lelio@uoguelph.ca">Lelio Fulgenzi</A> ;
<A title=cisco-voip@puck.nether.net
href="mailto:cisco-voip@puck.nether.net">ciscovoip</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Friday, January 05, 2007 3:13
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: [cisco-voip] CCM Audit Log -
MLA?</DIV>
<DIV><BR></DIV>Frankly this is ridiculous. My CCM Event Logs are filled
with <BR>registrations, unregistrations, transient connection attempts, and
<BR>things of similar importance. Actually these are not very important
at <BR>all. But something HUGELY important - like the addition or
removal of a <BR>route pattern - we have to grep through web server logs to
find evidence <BR>of?? And even then all we can see is that a pattern
was deleted - not <BR>what it actually was.<BR><BR>Heck, man, I'd be sending
out SNMP traps, e-mail, sounding klaxons (well <BR>maybe not) if someone
deleted a route pattern...<BR><BR>Seems to me that CallManager was designed
for ONE operator/admin, and <BR>the idea that multiple people would be
administering it was an <BR>afterthought. (Well, MLA was only added in
4.x, right?)<BR><BR>Ryan Ratliff wrote:<BR>> Actually if you take the time
to decipher the IIS logs you can get every <BR>> bit of information
possible in them. Since you are using MLA you will <BR>>
even have the MLA username as well as the source IP address the request
<BR>> is coming from. <BR>> <BR>> Here is me deleting a route
pattern from the search page on a 4.1(3) <BR>> box. Notice the very
searchable "method=..." part highlighted in red.<BR>> <BR>> 2007-01-05
19:46:07 14.48.39.100 rratliff (SQLSvc) 14.48.39.100 443 GET <BR>>
/CCMAdmin/_RemoteScripts/rs_system.asp <BR>>
_method=deleteRoutePattern&_mtype=execute&pcount=2&p0=%7B030C6E22-EEC8-4AEF-AC42-27932C469A00%7D&p1=
<BR>> 200 0 Mozilla/4.0+(Windows+2000+5.0)+Java/1.4.2_05 -<BR>> <BR>>
A quick test shows that no matter where you delete the route pattern <BR>>
from (search page or directly on the route pattern page) the GET request
<BR>> looks the same.<BR>> Unfortunately the only way to identify which
route pattern was deleted <BR>> is by the pkid (p0 in the GET
request). If you know the approxmiate <BR>> time though it
should be easy enough to correlate deletions.<BR>> <BR>> Once you have
the IIS log entry you'll have the MLA username (rratliff <BR>> above), the
source IP address (14.48.39.100) and from there it's your <BR>> call what
to do with the info. My vote is always to blame the intern ;)<BR>>
<BR>> -Ryan<BR></BLOCKQUOTE></BODY></HTML>