EasyUC
English
Aurora

Choose appearance

4.8.7

Diagnostics & monitoring

Audit log: who changed what and when

Search, filter, read in detail and export changes made in EasyUC and directly on the CUCM.

EasyUC · Version 4.8.7

In EasyUC: EasyUC Cisco → Logs → EasyUC Logs

Images come from the EasyUC lab. Names and example values provide orientation. A different interface language is indicated beside the relevant image.

What it is for

The audit log shows who changed what and when. It automatically records every write action from the admin interface, the public API, the end user self-service (including the agent and attendant portals) and from background jobs and the queue. Per CUCM connection, changes made directly on the CUCM are added.

You need it to trace a fault back to a change ("the phone has not been ringing since yesterday"), as evidence for audit and data protection, and for support cases. Sign-ins to EasyUC are also in the log, successful and failed, without the password. Pure read access is not logged; exports are.

Each row is one action, for example changing a device. What was actually written, such as the individual AXL calls to the CUCM, is listed as individual changes in the detail view. Passwords, PINs, keys and the content of requests are never stored.

Prerequisites

  • Page role ROLE_APP_VIEW_LOG_PAGE for the menu entry and ROLE_APP_LIST_LOG ("Logs: classic list and audit log" in the role editor) for list and details.
  • For the Technical tab and IP addresses in the export: ROLE_APP_VIEW_AUDIT_TECHNICAL. Assign it selectively because of the IP addresses.
  • For Export and the support log: ROLE_APP_EXPORT_AUDIT.
  • For Settings (retention, sources): ROLE_APP_EDIT_AUDIT_SETTINGS.
  • You assign the roles in the user editor under Administration → Access & Appearance → Administrators & Roles, area Logs.
  • Location-restricted administrators see only entries of their locations and their own actions. They do not see entries without a location.
  • For changes made directly on the CUCM, the CUCM change log must be switched on at the CUCM connection.

Step by step: find a change

  1. Select the CUCM connection the object belongs to in the header.
  2. Open Logs → EasyUC Logs. The page is titled Audit log.
  3. Enter what you know in the search field: device name or MAC address, phone number, user ID, e-mail address or the name of the actor. Below the field, "Searching as: …" shows how the input was understood.
  4. Click Search.
  5. Under Time range, set Today, Last 7 days, Last 30 days or Custom. The default is the last 7 days.
  6. Use Add filter to add further filters: Source, Result, Type of change, Object type, Action, Performed by or Location. Each filter appears as a chip and can be removed individually.
  7. Click the row in the list. The Details side panel opens.
  8. On the Changes tab, read Before and After per field.
  9. Open the Involved tab to see the individual changes with result and error text and all affected objects.
  10. If required, click Show all entries of this operation to see all steps of the same action, including those that continued in the background.
  11. Load more fetches older matches. Reset all filters restores the initial view.

Step by step: export and create a support log

  1. Set search and filters so that the list shows the entries you want.
  2. Click Export at the top right and choose Export as CSV or Export as Excel file (XLSX).
  3. If there are more matches than allowed, the page offers to export only the newest entries.
  4. For a support case: reproduce the problem, then click Last 5 minutes or Last 10 minutes in the Download support log box. You receive all EasyUC and CUCM activity of that time window as a CSV.

Step by step: set retention and sources

  1. Click Settings at the top right. The Retention and sources dialog opens.
  2. Enter the periods under Keep EasyUC entries (months) and Keep CUCM entries (months).
  3. Enter the period for IP addresses under Remove IP addresses after (days).
  4. Under Recorded sources, switch Record on or off per source.
  5. Click Save. The change takes effect in all services after 30 seconds at the latest.

Fields and options

Field / actionMeaning and use
Search fieldA MAC or SEP name finds devices. Digits or + find numbers: 4711 finds exact or ending with 4711, 4711* starts with, *4711 ends with. @ finds e-mail and user ID. Anything else matches the beginning of names, descriptions, users and actors.
Time rangeToday, Last 7 days (default), Last 30 days or custom, at most 366 days.
Show possible echoes of own changesWhen EasyUC changes something on the CUCM, the CUCM reports that change back. Echoes that cannot be assigned with certainty are stored but hidden by default. This option shows them.
ExportCSV up to 200,000 rows, Excel up to 10,000 rows, each with the current filters. CSV with separator ; and UTF-8. Every export is itself recorded in the audit log.
Keep EasyUC entries (months)Default 12, allowed 1 to 120.
Keep CUCM entries (months)Applies to the sources CUCM direct and CUCM audit log. Default 3, allowed 1 to 120.
Remove IP addresses after (days)Default 90, allowed 1 to 3650.
Recorded sourcesSwitchable per source, all on by default. Always recorded regardless: logins, changes to EasyUC users, their roles and API users, as well as export and settings of the audit log.
CUCM sources per connectionShows per CUCM connection whether change feed and CUCM audit log are switched on. Edit leads to the setting at the connection.
Classic viewOpens the previous log list. From there, or through Show original entry in the details, Restore still works for entries from the legacy log.

How to read the list and the details

Field / actionMeaning and use
TimeRelative ("5 minutes ago"), with the exact time on hover. A clock icon marks inexact times: for CUCM changes accurate to the polling interval, for imported entries taken from the legacy log.
SourceAdmin UI, Self-service, Public API, Background job, Asynchronous (queue), CUCM direct, CUCM audit log or Legacy log.
Performed byEasyUC user, API user, end user, system, CUCM administrator or Unknown. Unknown is shown for direct CUCM changes as long as the CUCM audit log has not supplied the user.
ActionLabel of the action with a coloured badge for the type: Create, Update, Delete, Sign in, Sign out, Execute or Other.
ObjectMain object of the action, for example phone, user, line or group.
AffectedSearch keys such as device name, MAC address, phone number or user ID. A click filters by it.
LocationLocation of the object, otherwise No location.
ResultSuccessful, Failed, Partially successful or Unknown.
Badge "Not completed"The action was started but never completed, for example because a service was restarted in the meantime.
Badge "Possible echo"Probably the echo of an EasyUC change that the CUCM reported back.
Changes tabField, Before, After. For secrets only "Changed (value is not stored)" is shown.
Involved tabIndividual changes (for example every AXL call with result and error text) and affected objects.
Technical tabIP address, request ID, HTTP status, route parameters and raw technical data in redacted form. Visible only with a separate role.
Open linked entryFor CUCM entries, jumps to the associated EasyUC action and vice versa.

Check the result and narrow down errors

  • Test the function with a small change of your own, such as the description of a test phone. It appears immediately with source Admin UI, your user and the field under Changes.
  • You do not see an entry: check the time range (default 7 days), the CUCM connection in the header and your location restriction.
  • "You do not have permission to view the change log.": ROLE_APP_LIST_LOG is missing. The permissions for the logs widget or the end user profile history are not sufficient.
  • "You are not allowed to view technical details.": ROLE_APP_VIEW_AUDIT_TECHNICAL is missing.
  • "The filter is invalid (…). Please check your input.": correct the filter field named, for example a time range above 366 days.
  • "Too many matches for the export: at most … rows.": narrow the filter or export only the newest entries.
  • A change appears twice: once as an EasyUC action and once as a possible echo from the CUCM. Echoes are visible only when the option for them is switched on.
  • No user is shown for "CUCM direct": the change feed of the CUCM does not know the user. The CUCM audit log adds it if it is switched on at the connection.
  • A daily background job deletes older entries according to the retention periods. Large environments produce several GB per year. Keep an eye on the database volume; the retention periods are the lever for this.
  • If the source Admin UI is switched off, all other actions in the interface are no longer recorded. Switch sources off only deliberately.

Related chapters