<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:"Lucida Grande";
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.apple-style-span
{mso-style-name:apple-style-span;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
p.pb1body1, li.pb1body1, div.pb1body1
{mso-style-name:pb1_body1;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">The audit logs in Connection are rubbish. CUCM is much more robust in the default audit log settings.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="pb1body1"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">To track changes such as user creation and deletion there is a micro trace ‘CUCA’ which logs to
</span><span style="font-size:9.5pt;font-family:"Arial","sans-serif";color:black">diag_Tomcat_*.uc which translates to ‘Connection Tomcat Application’ in RTMT.<o:p></o:p></span></p>
<p class="pb1body1"><span style="font-size:9.5pt;font-family:"Arial","sans-serif";color:black">Still waiting to hear if my assumptions on which of the following need to be enabled is correct.<o:p></o:p></span></p>
<p class="MsoPlainText">00 Errors and Fatal events <o:p></o:p></p>
<p class="MsoPlainText"> 01 General <o:p></o:p></p>
<p class="MsoPlainText"> 02 Data Access (High) <o:p></o:p></p>
<p class="MsoPlainText"> 03 Data Access (Low) <o:p></o:p></p>
<p class="MsoPlainText"> 04 Data Utilities <o:p></o:p></p>
<p class="MsoPlainText"> 05 Actions <o:p></o:p></p>
<p class="MsoPlainText"> 06 Tomcat Tools <o:p></o:p></p>
<p class="MsoPlainText"> 07 Tools <o:p></o:p></p>
<p class="MsoPlainText"> 09 Tags <o:p></o:p></p>
<p class="MsoPlainText"> 10 Port Monitor Service<o:p></o:p></p>
<p class="pb1body1"><span style="font-size:9.5pt;font-family:"Arial","sans-serif";color:black"><o:p> </o:p></span></p>
<p class="pb1body1"><span style="font-size:9.5pt;font-family:"Arial","sans-serif";color:black"><o:p> </o:p></span></p>
<p class="pb1body1"><span style="font-size:9.5pt;font-family:"Arial","sans-serif";color:black">Thanks to Tony at TAC for pointing this document out.<o:p></o:p></span></p>
<p class="pb1body1"><span style="font-size:9.5pt;font-family:"Arial","sans-serif";color:black">http://www.cisco.com/en/US/customer/docs/voice_ip_comm/connection/8x/serv_administration/guide/8xcucservag030.html#wp1050964<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Ryan Ratliff [mailto:rratliff@cisco.com]
<br>
<b>Sent:</b> Tuesday, July 19, 2011 9:52 AM<br>
<b>To:</b> Wellnitz, Erick A.<br>
<b>Cc:</b> cisco-voip@puck.nether.net<br>
<b>Subject:</b> Re: [cisco-voip] Connection log/trace files<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">For CUCM the tomcat access logs can be of help if audit logs are not enabled. It'll take a bit of detective work to figure out the URLs accessed and such but can be done. Since UC has the same platform I'd expect these same logs to
be present on it as well. <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If you can see some activity then go in as yourself and delete a temp user. Find in the logs what your activity looks like and then search through past logs for similar activity.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Helvetica","sans-serif";color:black">-Ryan<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Jul 18, 2011, at 5:45 PM, Wellnitz, Erick A. wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><br>
<br>
<span class="apple-style-span"><span style="font-size:13.5pt;font-family:"Lucida Grande","serif""><o:p></o:p></span></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Anyone know which log /trace file in RTMT I could look at besides audit log to see who has been doing what and when. I need to find when a user was deleted from the system.
Unity Connection 8.x</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#333333">ERICK A. WELLNITZ<span class="apple-converted-space"> </span></span></b><span style="font-size:10.0pt;font-family:"Arial","sans-serif""><br>
<span style="color:#333333">Network Engineer</span><br>
<b><span style="color:#83A6BD">Katten Muchin Rosenman LLP</span></b><br>
<span style="color:#333333">525 W. Monroe Street / Chicago, IL 60661-3693</span><br>
<span style="color:#333333">p / (312) 577-8041<span class="apple-converted-space"> </span></span><br>
</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><a href="mailto:erick.wellnitz@kattenlaw.com"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#333333">erick.wellnitz@kattenlaw.com</span></a></span><span class="apple-converted-space"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""> </span></span><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">/<span class="apple-converted-space"> </span></span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><a href="http://www.kattenlaw.com/"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#333333">www.kattenlaw.com</span></a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> <o:p></o:p></span></p>
</div>
<table class="MsoNormalTable" border="0" cellpadding="0">
<tbody>
<tr>
<td style="background:white;padding:.75pt .75pt .75pt .75pt">
<pre><span style="color:black">===========================================================<o:p></o:p></span></pre>
<pre><span style="color:black">CIRCULAR 230 DISCLOSURE: Pursuant to Regulations Governing Practice Before the Internal Revenue<o:p></o:p></span></pre>
<pre><span style="color:black">Service, any tax advice contained herein is not intended or written to be used and cannot be used<o:p></o:p></span></pre>
<pre><span style="color:black">by a taxpayer for the purpose of avoiding tax penalties that may be imposed on the taxpayer.<o:p></o:p></span></pre>
<pre><span style="color:black">===========================================================<o:p></o:p></span></pre>
<pre><span style="color:black">CONFIDENTIALITY NOTICE:<o:p></o:p></span></pre>
<pre><span style="color:black">This electronic mail message and any attached files contain information intended for the exclusive<o:p></o:p></span></pre>
<pre><span style="color:black">use of the individual or entity to whom it is addressed and may contain information that is<o:p></o:p></span></pre>
<pre><span style="color:black">proprietary, privileged, confidential and/or exempt from disclosure under applicable law. If you<o:p></o:p></span></pre>
<pre><span style="color:black">are not the intended recipient, you are hereby notified that any viewing, copying, disclosure or <o:p></o:p></span></pre>
<pre><span style="color:black">distribution of this information may be subject to legal restriction or sanction. Please notify<o:p></o:p></span></pre>
<pre><span style="color:black">the sender, by electronic mail or telephone, of any unintended recipients and delete the original <o:p></o:p></span></pre>
<pre><span style="color:black">message without making any copies.<o:p></o:p></span></pre>
<pre><span style="color:black">===========================================================<o:p></o:p></span></pre>
<pre><span style="color:black">NOTIFICATION: Katten Muchin Rosenman LLP is an Illinois limited liability partnership that has<o:p></o:p></span></pre>
<pre><span style="color:black">elected to be governed by the Illinois Uniform Partnership Act (1997).<o:p></o:p></span></pre>
<pre><span style="color:black">===========================================================<o:p></o:p></span></pre>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Lucida Grande","serif"">_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>