<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: Verdana; font-size: 10pt; color: #000000'>The great thing about the eventide solution is that it has remote devices that you can put out in your network without having to use SPAN.<br><br>---<br>Lelio Fulgenzi, B.A.<br>Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1<br>(519) 824-4120 x56354 (519) 767-1060 FAX (JNHN)<br>^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^<br>Cooking with unix is easy. You just sed it and forget it. <br> - LFJ (with apologies to Mr. Popeil)<br><br><br>----- Original Message -----<br>From: "Lelio Fulgenzi" <lelio@uoguelph.ca><br>To: "Ahmed Elnagar" <ahmed_elnagar@rayacorp.com><br>Cc: cisco-voip@puck.nether.net<br>Sent: Thursday, May 20, 2010 2:04:20 PM GMT -05:00 US/Canada Eastern<br>Subject: Re: [cisco-voip] R: A way to track admin changes in CUCM 6.x<br><br><style>p { margin: 0; }</style><link href="/zimbra/css/msgview.css?v=091102102208" rel="stylesheet"><div style="font-family: Verdana; font-size: 10pt; color: rgb(0, 0, 0);">http://www.eventide.com/CommunicationsDivision/Products/Recorders.aspx<br><br>---<br>Lelio Fulgenzi, B.A.<br>Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1<br>(519) 824-4120 x56354 (519) 767-1060 FAX (JNHN)<br>^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^<br>Cooking with unix is easy. You just sed it and forget it. <br> - LFJ (with apologies to Mr. Popeil)<br><br><br>----- Original Message -----<br>From: "Ahmed Elnagar" <ahmed_elnagar@rayacorp.com><br>To: cisco-voip@puck.nether.net<br>Sent: Thursday, May 20, 2010 12:34:06 PM GMT -05:00 US/Canada Eastern<br>Subject: Re: [cisco-voip] R: A way to track admin changes in CUCM 6.x<br><br>
<style></style>
<div class="Section1">
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">Mentioning other products like billing and
recording….anyone has a recommendation for them “specially call recording” we
tried so many products at different customer site…and never had a product that
really stable and satisfy all customer needs….any recommendations?</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> </span></p>
<div>
<div>
<p class="MsoNormal" style="background: none repeat scroll 0% 0% white;"><span style="font-size: 10pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> </span><span style="font-size: 10.5pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">Best
Regards;</span></p>
<p class="MsoNormal" style="background: none repeat scroll 0% 0% white;"><span style="font-size: 10.5pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> Ahmed Elnagar</span></p>
<p class="MsoNormal" style="background: none repeat scroll 0% 0% white;"><span style="font-size: 10.5pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> Senior Network PS
Engineer</span></p>
<p class="MsoNormal" style="background: none repeat scroll 0% 0% white;"><span style="font-size: 10.5pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> Mob: +2019-0016211</span></p>
<p class="MsoNormal" style="background: none repeat scroll 0% 0% white;"><span style="font-size: 10.5pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> CCIE#24697 (Voice)</span></p>
<p class="MsoNormal" style="background: none repeat scroll 0% 0% white;"><span style="font-size: 10.5pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> <img src="cid:image001.jpg@01CAF84D.AA60C7C0" id="Picture_x0020_5" alt="ccie_voice_large.gif" width="63" height="63"><img src="cid:image002.jpg@01CAF84D.AA60C7C0" id="Picture_x0020_4" alt="ccvp_voice_large.gif" width="63" height="63"></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> </span></p>
<div>
<div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) -moz-use-text-color -moz-use-text-color; padding: 3pt 0in 0in;">
<p class="MsoNormal"><b><span style="font-size: 10pt; font-family: "Tahoma","sans-serif";">From:</span></b><span style="font-size: 10pt; font-family: "Tahoma","sans-serif";"> Lelio Fulgenzi
[mailto:lelio@uoguelph.ca] <br>
<b>Sent:</b> Thursday, May 20, 2010 6:33 PM<br>
<b>To:</b> Ahmed Elnagar<br>
<b>Cc:</b> cisco-voip@puck.nether.net; Ryan Ratliff<br>
<b>Subject:</b> Re: [cisco-voip] R: A way to track admin changes in CUCM 6.x</span></p>
</div>
</div>
<p class="MsoNormal"> </p>
<div>
<p class="MsoNormal" style="margin-bottom: 12pt;"><span style="font-size: 10pt; font-family: "Verdana","sans-serif"; color: black;">I think this is also one of
those things that Cisco will never fix because of the financial investment it's
partners have put into it. Just like recording, paging, etc.<br>
<br>
But still, 3rd party systems rely on system level settings to build groups
and/or multi-level admin (or role based) solutions. For example, you want
someone to admin a group of phones? They have to be in a separate device pool
or partition or search space. What the system should have is either a user
defined field(s) for each phone, or a specific field(s) assigned for multi-level
admin. Administration rarely has anything to do with the operation of the
phones, i.e. device pool. <br>
<br>
My 2cents. <br>
<br>
---<br>
Lelio Fulgenzi, B.A.<br>
Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1<br>
(519) 824-4120 x56354 (519) 767-1060 FAX (JNHN)<br>
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^<br>
Cooking with unix is easy. You just sed it and forget it. <br>
- LFJ (with apologies to Mr. Popeil)<br>
<br>
<br>
----- Original Message -----<br>
From: "Ahmed Elnagar" <ahmed_elnagar@rayacorp.com><br>
To: "Ryan Ratliff" <rratliff@cisco.com><br>
Cc: cisco-voip@puck.nether.net<br>
Sent: Thursday, May 20, 2010 11:29:08 AM GMT -05:00 US/Canada Eastern<br>
Subject: Re: [cisco-voip] R: A way to track admin changes in CUCM 6.x</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">Actually this is a very old limitation in CallManager and a lot
of customers are asking for a more detailed “easy to read” log.</span><span style="color: black;"></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> </span><span style="color: black;"></span></p>
<div>
<div>
<p class="MsoNormal" style="background: none repeat scroll 0% 0% white;"><span style="font-size: 10pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> </span><span style="font-size: 10.5pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">Best Regards;</span><span style="color: black;"></span></p>
<p class="MsoNormal" style="background: none repeat scroll 0% 0% white;"><span style="font-size: 10.5pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> Ahmed Elnagar</span><span style="color: black;"></span></p>
<p class="MsoNormal" style="background: none repeat scroll 0% 0% white;"><span style="font-size: 10.5pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> Senior Network PS Engineer</span><span style="color: black;"></span></p>
<p class="MsoNormal" style="background: none repeat scroll 0% 0% white;"><span style="font-size: 10.5pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> Mob: +2019-0016211</span><span style="color: black;"></span></p>
<p class="MsoNormal" style="background: none repeat scroll 0% 0% white;"><span style="font-size: 10.5pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> CCIE#24697 (Voice)</span><span style="color: black;"></span></p>
<p class="MsoNormal" style="background: none repeat scroll 0% 0% white;"><span style="font-size: 10.5pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> </span><span style="color: black;"></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> </span><span style="color: black;"></span></p>
<div>
<div style="border-width: 1pt medium medium; border-style: solid none none; padding: 3pt 0in 0in; border-color: -moz-use-text-color;">
<p class="MsoNormal"><b><span style="font-size: 10pt; font-family: "Tahoma","sans-serif"; color: black;">From:</span></b><span style="font-size: 10pt; font-family: "Tahoma","sans-serif"; color: black;"> cisco-voip-bounces@puck.nether.net
[mailto:cisco-voip-bounces@puck.nether.net] <b>On Behalf Of </b>Ryan Ratliff<br>
<b>Sent:</b> Wednesday, May 19, 2010 11:07 PM<br>
<b>To:</b> Jason Aarons (US)<br>
<b>Cc:</b> cisco-voip@puck.nether.net<br>
<b>Subject:</b> Re: [cisco-voip] R: A way to track admin changes in CUCM 6.x</span><span style="color: black;"></span></p>
</div>
</div>
<p class="MsoNormal"><span style="color: black;"> </span></p>
<p class="MsoNormal"><span style="color: black;">Everything except HTTP posts are
in the Tomcat access logs, it just takes a bit of investigative work to
understand exactly what a given change looks like. A GET request will
contain info like pkids, etc but unfortunately a POST will just have the URL,
not the parameters passed in the request.</span></p>
<div>
<p class="MsoNormal"><span style="color: black;"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;">For example I logged into CCMAdmin
on my 7.1(3) server and deleted a phone (from the search page).</span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;">Here is the audit log
(Audit0000000x.log) entry.</span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;">05/19/2010 15:53:54.936
|LogMessage UserID :administrator ClientAddress :172.18.251.29
Severity :5 EventType :GeneralConfigurationUpdate
ResourceAccessed:CUCMAdmin EventStatus :Success AuditDetails
:record in table device, with key field name = SEPABCDABCDAADD deleted
ComponentID :Cisco CUCM Administration App ID:Cisco Tomcat Cluster ID:
Node ID:rratliff-cm7|</span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;">Here is the Tomcat access log
entry (localhost_access_log2010-05-19.txt):</span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;">[19/May/2010:15:53:55 -0400]
172.18.251.29 172.18.251.29 administrator - 8443 POST
/ccmadmin/phoneFLDeleteSelected.do ?recCnt=9&colCnt=8 HTTP/1.1 200 96499
416</span></p>
<div>
<div>
<p class="MsoNormal"><span style="color: black;"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;">So you can see clearly here the
audit log had more info than the access log. Because
phoneFLDeleteSelected.do was called we can see I deleted something, but not
what.</span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;">Now I deleted a phone from the device
page, not the search page.</span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;">Audit log:</span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;">05/19/2010 16:00:16.524
|LogMessage UserID :administrator ClientAddress :172.18.251.29
Severity :5 EventType :GeneralConfigurationUpdate
ResourceAccessed:CUCMAdmin EventStatus :Success AuditDetails
: record in table device with key field name = ABCDABCDABCD deleted
ComponentID :Cisco CUCM Administration App ID:Cisco Tomcat Cluster ID: Node
ID:rratliff-cm7|</span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;">Access log:</span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;">[19/May/2010:16:00:16 -0400]
172.18.251.29 172.18.251.29 administrator - 8443 POST /ccmadmin/phoneDelete.do
HTTP/1.1 200 73099 383</span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;">Again, nothing terribly useful in
the access log other than I deleted some phone. However if we look a few
lines above we see this:</span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;">[19/May/2010:16:00:10 -0400]
172.18.251.29 172.18.251.29 administrator - 8443 GET /ccmadmin/gendeviceEdit.do
?key=fe651e23-fb2b-14d2-5a30-5843f9172658 HTTP/1.1 200 300148 958</span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;">This tells me that the same source
IP, and same userid went into a phone's device page (gendeviceEdit.do) and the
device had a pkid of fe651e23-fb2b-14d2-5a30-5843f9172658.</span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;">A quick peek into the ccm device
table in a backup, or maybe even in the installdb log file from the last
upgrade would let you tie that pkid to a device name.</span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;"> </span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="color: black;">-Ryan</span></p>
</div>
</div>
<p class="MsoNormal"><span style="color: black;"> </span></p>
<div>
<div>
<p class="MsoNormal"><span style="color: black;">On May 19, 2010, at 3:46 PM, Jason
Aarons (US) wrote:</span></p>
</div>
<p class="MsoNormal" style="margin-bottom: 12pt;"><span style="color: black;"> </span></p>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);">I had a customer use the CLI to query the database and show a
line with a userid and what he changed. Since it wasn’t my userid or my teams I
didn’t pay much attention. But in short someone deleted a DN in
production causing a outage and he was tracing it back. Turns out it was his
teammate. I haven’t used the Audi GUI view or recall what the
CLI query was.</span><span style="color: black;"></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: "Calibri","sans-serif"; color: rgb(31, 73, 125);"> </span><span style="color: black;"></span></p>
</div>
<div style="border-width: 1pt medium medium; border-style: solid none none; padding: 3pt 0in 0in; border-color: -moz-use-text-color;">
<div>
<p class="MsoNormal"><b><span style="font-size: 10pt; font-family: "Tahoma","sans-serif"; color: black;">From:</span></b><span class="apple-converted-space"><span style="font-size: 10pt; font-family: "Tahoma","sans-serif"; color: black;"> </span></span><span style="font-size: 10pt; font-family: "Tahoma","sans-serif"; color: black;"><a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a><span class="apple-converted-space"> </span>[mailto:cisco-voip-bounces@puck.nether.net]<span class="apple-converted-space"> </span><b>On Behalf Of<span class="apple-converted-space"> </span></b>Matthew Saskin<br>
<b>Sent:</b><span class="apple-converted-space"> </span>Wednesday, May 19,
2010 12:17 PM<br>
<b>To:</b><span class="apple-converted-space"> </span><a href="mailto:l.durso@gmail.com" target="_blank">l.durso@gmail.com</a><br>
<b>Cc:</b><span class="apple-converted-space"> </span><a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<b>Subject:</b><span class="apple-converted-space"> </span>Re: [cisco-voip]
R: A way to track admin changes in CUCM 6.x</span><span style="color: black;"></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="color: black;"> </span></p>
</div>
<p class="MsoNormal" style="margin-bottom: 12pt;"><span style="color: black;">The
audit feature in 7x+ isn't all that useful. It does not give you details
on who made specific changes.<br>
<br clear="all">
Matthew Saskin<br>
<a href="mailto:msaskin@gmail.com" target="_blank">msaskin@gmail.com</a><br>
203-253-9571<br>
<br>
July 18, 2010 - 1500m swim (in the hudson), 40k bike, 10k run<br>
Please support the Leukemia & Lyphoma Society<br>
<a href="http://pages.teamintraining.org/nyc/nyctri10/msaskin" target="_blank">http://pages.teamintraining.org/nyc/nyctri10/msaskin</a></span></p>
<div>
<div>
<p class="MsoNormal"><span style="color: black;">On Wed, May 19, 2010 at 11:54 AM,
Leonardo D'Urso <<a href="mailto:l.durso@gmail.com" target="_blank">l.durso@gmail.com</a>>
wrote:</span></p>
</div>
<div>
<p class="MsoNormal"><span style="color: black;">Hi Rob<br>
<br>
I know this is the audit feature. It is supported since 7.x.<br>
<br>
Ciao<br>
Leonardo<br>
<br>
---<br>
</span><span style="color: rgb(136, 136, 136);">Leonardo D'Urso<br>
<a href="mailto:l.durso@gmail.com" target="_blank">l.durso@gmail.com</a><br>
Sent from my BlackBerry®</span><span style="color: black;"></span></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="color: black;"><br>
-----Original Message-----<br>
From: "Leetun, Rob" <<a href="mailto:rleetun@bouldercounty.org" target="_blank">rleetun@bouldercounty.org</a>><br>
Date: Wed, 19 May 2010 09:43:02<br>
To: <<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>><br>
Subject: [cisco-voip] A way to track admin changes in CUCM 6.x<br>
<br>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
<br>
<br>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a></span></p>
</div>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><span style="color: black;"> </span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="color: black;"> </span></p>
</div>
<div class="MsoNormal" style="text-align: center;" align="center"><span style="color: black;">
<hr align="center" width="100%" size="1">
</span></div>
<div>
<p class="MsoNormal"><span style="color: black;"> </span></p>
</div>
<p><strong><span style="color: black;">Disclaimer: This e-mail communication and
any attachments may contain confidential and privileged information and is for
use by the designated addressee(s) named above only. If you are not the
intended addressee, you are hereby notified that you have received this
communication in error and that any use or reproduction of this email or its
contents is strictly prohibited and may be unlawful. If you have received this
communication in error, please notify us immediately by replying to this
message and deleting it from your computer. Thank you.</span></strong><span style="color: black;"></span></p>
<p class="MsoNormal"><span style="color: black;">_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a></span></p>
</div>
</div>
<p class="MsoNormal"><span style="color: black;"> </span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10pt; font-family: "Verdana","sans-serif"; color: black;"> </span></p>
</div>
<p class="MsoNormal"><span style="font-size: 10pt; font-family: "Verdana","sans-serif"; color: black;">Disclaimer: NOTICE The information contained in this message is
confidential and is intended for the addressee(s) only. If you have received
this message in error or there are any problems please notify the originator
immediately. The unauthorized use, disclosure, copying or alteration of this
message is strictly forbidden. Raya will not be liable for direct, special,
indirect or consequential damages arising from alteration of the contents of
this message by a third party or as a result of any malicious code or virus
being passed on. Views expressed in this communication are not necessarily
those of Raya.If you have received this message in error, please notify the
sender immediately by email, facsimile or telephone and return and/or destroy
the original message. <br>
_______________________________________________ cisco-voip mailing list
cisco-voip@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-voip </span></p>
</div>
</div>
<div> </div>Disclaimer: NOTICE The information contained in this message is confidential and is intended for the addressee(s) only. If you have received this message in error or there are any problems please notify the originator immediately. The unauthorized use, disclosure, copying or alteration of this message is strictly forbidden. Raya will not be liable for direct, special, indirect or consequential damages arising from alteration of the contents of this message by a third party or as a result of any malicious code or virus being passed on. Views expressed in this communication are not necessarily those of Raya.If you have received this message in error, please notify the sender immediately by email, facsimile or telephone and return and/or destroy the original message. <br>_______________________________________________
cisco-voip mailing list
cisco-voip@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip
</div></div></body></html>