Setting up the CUCM change log on the connection

What it is for

The EasyUC audit log records who changed what in EasyUC. Changes that someone makes directly in the CUCM administration are initially unknown to EasyUC. In the CUCM change log dialog you define per CUCM connection whether and how EasyUC captures such changes.

There are two levels. The Change feed regularly asks the CUCM for changed objects. It shows what changed and when, but not by whom. The entries appear in the audit log with the source “CUCM direct”. The second level additionally evaluates the audit log of the CUCM and adds the user and IP address; its entries carry the source “CUCM audit log”.

EasyUC changes nothing on the CUCM for this. The change feed is also the basis for the CUCM backup capturing changes within a few minutes.

Prerequisites

Sign-in as an administrator (ROLE_APP_ADMIN). The connection settings are not assigned to any other role.
License with the cucm module. The entry does not depend on the provisioning license. The connection is enabled.
In the audit log settings (“Retention and sources”), the sources “CUCM direct” and, for the second level, “CUCM audit log” are switched on.
For the second level, on the CUCM: under Cisco Unified Serviceability → Tools → Audit Log Configuration, “Enable Audit Log” and “Detailed Audit Logging” are switched on and saved with “Apply to All Nodes”.
For the second level: the network services “Cisco Audit Event Service” and “Cisco Log Partitions Monitoring Tool” are running on all nodes.
For the second level: the AXL user of the connection may read serviceability logs, for example through the role “Standard CCM Server Monitoring”. All active CUCM nodes can be reached from the appliance under their names.

Step by step

In the header, select the EasyUC Cisco workspace.
Open Administration → CUCM & Provisioning → CUCM Connections.
In the row of the connection, click Actions and then CUCM change log. The dialog with the alias of the connection opens. If nothing has been saved yet, it shows the defaults.
Leave Fetch CUCM changes (change feed) switched on, or switch the option on.
Under Monitored object types, select the types you want or All.
Enter the Polling interval (seconds).
If the CUCM user who made the change is to appear as well and the prerequisites on the CUCM are met: switch on Evaluate the CUCM audit log (who made the change).
If EasyUC uses further CUCM users besides the AXL user of the connection, enter them under Additional EasyUC AXL users: type the name and press Enter.
Click Save. The message CUCM change log saved appears.
As a check, change a phone directly in the CUCM and, once the polling interval has elapsed, look at the Audit log page.

Fields and options

Fields and options
Field / action	Meaning and use
Fetch CUCM changes (change feed)	Default: on. “Regularly asks the CUCM for changed objects. Shows what changed and when, but not by whom.” When switched off, direct changes on the CUCM do not appear in the audit log. After it is switched on again, fetching starts afresh, without the time in between.
Monitored object types	Phone, DeviceProfile, Line, User, RemoteDestination, RemoteDestinationProfile, HuntPilot, HuntList, LineGroup, CallPickupGroup, TransPattern, RoutePattern and Application User. Default: all. At least one type must be selected.
Polling interval (seconds)	Allowed: 60 to 300 seconds. Default: 60.
Evaluate the CUCM audit log (who made the change)	Default: off. “Adds user and IP address from the CUCM audit log.” Below it, the dialog lists the five steps to be completed on the CUCM beforehand and the note “The CUCM audit log format has not yet been confirmed with real files.”
Additional EasyUC AXL users	Changes by these users count as EasyUC changes and are not listed as direct CUCM changes. The AXL user of the connection is always included. At most 20 entries, each at most 128 characters.
Save / Cancel	Saves the setting for this connection, or closes the dialog without any change.

Checking the result and narrowing down errors

Success: direct changes on the CUCM appear on the Audit log page with the source “CUCM direct”, supplemented by the CUCM user when the second level is switched on.
Entries from the CUCM audit log appear with a delay. The internal documentation states about 5 to 20 minutes after the change, and correspondingly later with a longer polling interval.
“Please select at least one object type.”: no object type is ticked.
“The CUCM change log settings could not be saved.”: check the entries and save again; the polling interval must be between 60 and 300.
No entries appear: check in the audit log settings whether the source “CUCM direct” is being captured, and under Background Jobs whether the change feed job is switched on.
The user is missing despite the second level: on the CUCM, check “Detailed Audit Logging”, the two network services and the serviceability permissions of the AXL user.
Sign-ins to and sign-outs from the CUCM are not stored by default. Passwords and PINs appear only as “changed”, without a value.
The association of user and change is time-based. If two administrators change the same object within a few minutes, the user may appear on the wrong entry.