When audit logging is enabled, but the detailed audit logging option is not selected, the system is configured for standard audit logging.

With standard audit logging, configuration changes to the system get logged in separate log files for auditing. The Cisco Audit Event Service, which displays under Control Center - Network Services in the serviceability GUI, monitors and logs any configuration changes to the system that are made by a user or as a result of the user action.

You access the Audit Log Configuration window in the serviceability GUI to configure the settings for the audit logs.

Standard audit logging contains the following parts:

• Audit logging framework - The framework comprises an API that uses an alarm library to write audit events into audit logs. An alarm catalog that is defined as GenericAlarmCatalog.xml applies for these alarms. Different system components provide their own logging.

  The following example displays an API that a Unified Communications Manager component can use to send an alarm:

  User ID: CCMAdministratorClient IP Address: 172.19.240.207
  Severity: 3
  EventType: ServiceStatusUpdated
  ResourceAccessed: CCMService
  EventStatus: Successful
  Description: CallManager Service status is stopped
  

• Audit event logging - An audit event represents any event that is required to be logged. The following example displays a sample audit event:

  CCM_TOMCAT-GENERIC-3-AuditEventGenerated: Audit Event Generated UserID:CCMAdministrator Client IP Address:172.19.240.207 Severity:3 EventType:ServiceStatusUpdated ResourceAccessed: CCMService EventStatus:Successful Description: Call Manager Service status is stopped App ID:Cisco Tomcat Cluster ID:StandAloneCluster Node ID:sa-cm1-3
  

Tip

Be aware that audit event logging is centralized and enabled by default. An alarm monitor called Syslog Audit writes the logs. By default, the logs are configured to rotate. If the AuditLogAlarmMonitor cannot write an audit event, the AuditLogAlarmMonitor logs this failure as a critical error in the syslog file. The Alert Manager reports this error as part of a SeverityMatchFound alert. The actual operation continues even if the event logging fails. All audit logs get collected, viewed, and deleted from Trace and Log Central in the Cisco Unified Real-Time Monitoring Tool.

Cisco Unified Serviceability Standard Events Logging

Cisco Unified Serviceability logs the following events:

• Activation, deactivation, start, or stop of a service.

• Changes in trace configurations and alarm configurations.

• Changes in SNMP configurations.

• Changes in CDR management. (Cisco Unified Communications Manager only)

• Review of any report in the Serviceability Reports Archive. This log gets viewed on the reporter node. (Unified Communications Manager only)

Cisco Unified Real-Time Monitoring Tool Standard Events Loggin

Cisco Unified Real-Time Monitoring Tool logs the following events with an audit event alarm:

• Alert configuration

• Alert suspension

• E-mail configuration

• Set node alert status

• Alert addition

• Add alert action

• Clear alert

• Enable alert

• Remove alert action

• Remove alert

Unified Communications Manager Standard Events Logging

Cisco CDR Analysis and Reporting (CAR) creates audit logs for these events:

• Loader scheduling

• Daily, weekly, and monthly reports scheduling

• Mail parameters configuration

• Dial plan configuration

• Gateway configuration

• System preferences configuration

• Autopurge configuration

• Rating engine configurations for duration, time of day, and voice quality

• QoS configurations

• Automatic generation/alert of pregenerated reports configurations.

• Notification limits configuration

Cisco Unified CM Administration Standard Events Logging

The following events get logged for various components of Cisco Unified Communications Manager Administration:

• User logging (user logins and user logouts)

• User role membership updates (user added, user deleted, user role updated)

• Role updates (new roles added, deleted, or updated)

• Device updates (phones and gateways)

• Server configuration updates (changes to alarm or trace configurations, service parameters, enterprise parameters, IP addresses, hostnames, Ethernet settings, and Unified Communications Manager server additions or deletions)

Cisco Unified Communications Self Care Portal Standard Events Logging

User logging (user login and user logout) events are logged for Cisco Unified Communications Self Care Portal.

Command-Line Interface Standard Events Logging

All commands issued via the command-line interface are logged (for both Unified Communications Manager and Cisco Unity Connection).

Cisco Unity Connection Administration Standard Events Logging

Cisco Unity Connection Administration logs the following events:

• User logging (user logins and user logouts)

• All configuration changes, including but not limited to users, contacts, call management objects, networking, system settings, and telephony

• Task management (enabling or disabling a task)

• Bulk Administration Tool (bulk creates, bulk deletes)

• Custom Keypad Map (map updates)

Cisco Personal Communications Assistant (Cisco PCA) Standard Events Logging

The Cisco Personal Communications Assistant client logs the following events:

• User logging (user logins and user logouts)

• All configuration changes made via the Messaging Assistant

Cisco Unity Connection Serviceability Standard Events Logging

Cisco Unity Connection Serviceability logs the following events:

• User logging (user logins and user logouts).

• All configuration changes.

• Activating, deactivating, starting or stopping services.

Cisco Unity Connection Clients that Use the Representational State Transfer APIs Events Logging

Cisco Unity Connection clients that use the Representational State Transfer (REST) APIs log the following events:

• User logging (user API authentication).

• API calls that utilize Cisco Unity Connection Provisioning Interface.

Cisco Unified IM and Presence Serviceability Standard Events Logging

Cisco Unified IM and Presence Real-Time Monitoring Tool Standard Events Logging

Cisco IM and Presence Administration Standard Events Logging

IM and Presence Application Standard Events Logging

Command Line Interface Standard Events Logging

All commands issued through the command line interface are logged.

Detailed audit logging is an optional feature that logs additional configuration modifications that are not stored in standard (default) audit logs. In addition to all of the information that is stored in standard audit logs, detailed audit logging also includes configuration items that were added, updated, and deleted, including the modified values. Detailed audit logging is disabled by default, but you can enable it in the Audit Log Configuration window.

System audit logs track activities such as the creation, modification, or deletion of Linux OS users, log tampering, and any changes to file or directory permissions. This type of audit log is disabled by default due to the high volume of data gathered. To enable this function, you must manually enable utils auditd using the CLI. After you have enabled the system audit log feature, you can collect, view, download, or delete selected logs through Trace & Log Central from the Real-Time Monitoring Tool. System audit logs take on the format of vos-audit.log.

For information about how to enable this feature, see the Command Line Interface Reference Guide for Cisco Unified Communications Solutions. For information about how to access collected logs from the Real-Time Monitoring Tool, see the Cisco Unified Real-Time Monitoring Tool Administration Guide .

The Application Audit logs monitor and record any configuration changes to the system that were made by a user or as a result of the user action.

Note	The Application Audit Logs (Linux auditd) can be enabled or disabled only through the CLI. Other than the collection of vos-audit.log through the Real-Time Monitoring Tool, you can not change any settings for this type of audit log.

Database Audit Logs track all activities associated with access to the Informix Database, such as logins.

Before You Begin

Be aware that only a user with an audit role can change the audit log settings. By default, for Unified Communications Manager, the CCMAdministrator possesses the audit role after fresh installs and upgrades. The CCMAdministrator can assign any user that has auditing privileges to the Standard Audit Users group in the User Group Configuration window in Cisco Unified Communications Manager Administration. If you want to do so, you can then remove CCMAdministrator from the Standard Audit Users group.

For IM and Presence Service, the administrator possesses the audit role after fresh installs and upgrades, and can assign any user that has auditing privileges to the Standard Audit Users group.

For Cisco Unity Connection, the application administration account that was created during installation has the Audit Administrator role and can assign other administrative users to the role. You can also remove the Audit Administrator role from this account.

The Standard Audit Log Configuration role is to provide the ability to delete audit logs and to read/update access to Cisco Unified Real-Time Monitoring Tool, IM and Presence Real-Time Monitoring Tool, Trace Collection Tool, Real-Time Monitoring Tool (RTMT) Alert Configuration, Control Center - Network Services in the serviceability user interface, RTMT Profile Saving, Audit Configuration in the serviceability user interface, and a resource that is called Audit Traces.

The Standard Audit Log Configuration role is to provide the ability to delete audit logs and to read/update access to Cisco Unified RTMT, Trace Collection Tool, RTMT Alert Configuration, Control Center - Network Services in Cisco Unified Serviceability, RTMT Profile Saving, Audit Configuration in Cisco Unified Serviceability, and a resource that is called Audit Traces.

The Audit Administrator role in Cisco Unity Connection provides the ability to view, download and delete audit logs in Cisco Unified RTMT.

For information on roles, users, and user groups in Unified Communications Manager, refer to the Administration Guide for Cisco Unified Communications Manager.

For information on roles and users in Cisco Unity Connection, refer to the User Moves, Adds, and Changes Guide for Cisco Unity Connection.

For information on roles, users, and user groups in IM and Presence, refer to Configuration and Administration of IM and Presence Service on Unified Communications Manager.

The following table describes the settings that you can configure in the Audit Log Configuration window in Cisco Unified Serviceability.

Caution

When enabled, database logging can generate large amounts of data in a short period, particularly if the debug audit level is set to Database Updates or Database Reads. This can result in a significant performance impact during heavy usage periods. In general, we recommend that you keep database logging disabled. If you do need to enable logging to track changes in the database, we recommend that you do so only for short periods of time, by using the Database Updates level. Similarly, administrative logging does impact on the overall performance of the web user interface, especially when polling database entries (for example, pulling up 250 devices from the database).