CUCM change log: record direct changes on the CUCM

What it is for

Not every change goes through EasyUC. Someone who changes a phone directly in CUCM Administration only shows up in the EasyUC audit log if EasyUC asks the CUCM afterwards. The CUCM change log switches on this recording per CUCM connection.

There are two stages. The change feed regularly asks the CUCM over AXL for changed objects. It shows what changed and when, but not by whom. The entries appear with the source CUCM direct about one to two minutes after the change.

The second stage additionally evaluates the audit log of the CUCM. It adds the CUCM user and the client IP. For this, EasyUC reads the audit files of every active CUCM node through the log collection interface every 10 minutes. The user therefore appears only 5 to 20 minutes after the change. EasyUC changes nothing on the CUCM itself.

Prerequisites

Access to the CUCM connections in the administration.
For the change feed: a working AXL connection. It is switched on per connection by default.
For the CUCM audit log, on the CUCM: under Cisco Unified Serviceability → Tools → Audit Log Configuration, Enable Audit Log and Detailed Audit Logging are switched on and saved with Apply to All Nodes.
The network services Cisco Audit Event Service and Cisco Log Partitions Monitoring Tool are running on all nodes.
The AXL user of the connection may read serviceability logs, for example through the CUCM role Standard CCM Server Monitoring.
EasyUC reaches every active CUCM node under its name from the CUCM (HTTPS, port 8443). IM&P and Unity nodes are skipped.
In the audit log settings, the sources CUCM direct and CUCM audit log are not switched off.

Step by step: switch on recording at the connection

Open Administration → CUCM & Provisioning → CUCM Connections.
In the row of the connection, click Actions → CUCM change log.
Leave Fetch CUCM changes (change feed) switched on, or switch the option on.
Under Monitored object types, choose which CUCM objects are watched. At least one type must be selected.
Enter the gap between queries under Polling interval (seconds).
On the CUCM, carry out the steps the dialog lists under Enable on the CUCM before using this option.
Then switch on Evaluate the CUCM audit log (who made the change) if you also want to see the CUCM user.
Under Additional EasyUC AXL users, enter further CUCM users through which EasyUC itself works. Type a user name and press Enter.
Click Save. The message "CUCM change log saved" confirms the operation.
As a check, change the description of a test phone directly on the CUCM and look for the phone under Logs → EasyUC Logs after two minutes.

Fields and options

Fields and options
Field / action	Meaning and use
Fetch CUCM changes (change feed)	Regularly asks the CUCM for changed objects. Default: on. While switched off, direct changes on the CUCM do not appear in the audit log. After switching it back on, polling starts afresh without the time in between.
Monitored object types	Phone, device profile, line, user, remote destination and remote destination profile, hunt pilot, hunt list, line group, pickup group, translation pattern and route pattern. All selects all types.
Polling interval (seconds)	60 to 300 seconds allowed. The default is one query per minute.
Evaluate the CUCM audit log (who made the change)	Adds user and IP address from the CUCM audit log. Default: off.
Additional EasyUC AXL users	Changes by these users count as EasyUC changes and are not shown as direct CUCM changes. The AXL user of the connection is always included.

How to read the entries

How to read the entries
Field / action	Meaning and use
Source CUCM direct	Change detected by the change feed. Shows object, action and changed fields. The time is accurate to the polling interval. Performed by initially reads Unknown.
Performed by: CUCM administrator	The CUCM audit log supplied the user. It is added once to the "CUCM direct" entry and can be searched like an EasyUC user.
Source CUCM audit log	Separate entry from the audit log when there was no matching "CUCM direct" entry or some other event was logged, for example a service restart.
Possible echo	A change that EasyUC itself probably triggered. Hidden by default.
"Gap in the change feed"	The CUCM restarted its change list, for example after a restart of the AXL service. Changes in between are added by a resync and carry the note "Detected by resync, time inexact".
Not stored	Sign-ins and sign-outs on the CUCM are not imported by default. Values of sensitive fields such as PIN or password appear only as changed.

Check the result and narrow down errors

You recognise success when the test change appears with source CUCM direct after one to two minutes and, with the audit log switched on, the CUCM user is added after 5 to 20 minutes.
No "CUCM direct" entry: check whether the object type is selected under Monitored object types and whether the source is switched on in the audit log settings.
The user stays missing: on the CUCM, check the audit log configuration on all nodes, the two network services and the serviceability permissions of the AXL user. Without this permission only the retrieval of the audit log is affected; other functions keep running.
"Allowed: 60 to 300 seconds": correct the polling interval.
"Please select at least one object type.": select an object type or switch the change feed off.
"Nothing has been saved for this connection yet – the defaults are shown.": a notice only. Save applies the defaults.
User and change are matched by time. If two administrators change the same object within a few minutes, the user can end up on the wrong entry. The audit log lines are kept as details.
If the audit files on the CUCM are overwritten faster than they are retrieved, lines are lost. After a pause EasyUC reads back at most 7 days.
Changes made by LDAP synchronisation appear as "CUCM direct" without a user if the audit log contains nothing about them.