When Cisco Audit Log files are added to the report comparison process, the generated comparison report will be augmented with the following information:
Cisco Audit Logs need to be enabled first and then retrieved from the CUCM/CUC server to the Report Tool machine. As Cisco Audit Logs from various cluster member servers are not automatically merged, they are logged on each CUCM server where the user performs updates to the Cisco CUCM configuration. In most cases, CUCM configuration changes are performed via Cisco Unified CM Administration on the publisher server but it can be also done on any subscriber. If configuration changes can be performed on any subscriber, Cisco Audit logging should be enabled on all CUCM/CUC cluster member servers and the audit logs copied to a common folder where Report Tool has access. Report Tool will merge all entries below a root path as set in the field Cisco Audit Log Folder, so the files can be simply copied into this folder.
Step 1: Enable Cisco Audit Log generation on CUCM/CUC server.
On the CUCM/CUC Administration web page, navigate to Cisco Unified Serviceability, go to Tools > Audit Log Configuration .
Step 2: Set up Cisco Audit Log file collection in RTMT.
Audit Log files can be retrieved using Cisco Real-Time Monitoring Tool (RTMT) either manually or automatically by setting up a scheduled download.
RTMT can be downloaded for Windows and Linux from the CUCM Administration web page in Application > Plugins by searching for Cisco Unified Real-Time Monitoring Tool .
To download the Cisco Audit Logs manually, do the following:
Alternatively, to set up an automatic scheduled download of the log files, do the following:
Back in the Report Tool, set the Cisco Audit Log Folder path where the logs are located. All subfolders in this path will be searched for log files. Use the test button to read and parse the logs for entries.
Server Time to UTC. If Cisco Audit Log files are added, this must contain the time offset of the Cisco CUCM/CUC server to UTC. This can be automatically retrieved from the CUCM/CUC server by clicking on which will start a wizard to retrieve this setting. The time zone of CUCM/CUC can be seen with the CLI command show status as per screenshot below. If there are no entries matched in the comparison, the time zone might not be correctly set.
Typical time offsets are:
Other timezones can be checked online at http://www.worldtimebuddy.com/pdt-to-utc-converter.
To see the time zone on CUCM/CUC server, SSH to the server and enter the show status command: