Working with the audit logs
Cisco TelePresence ISDN Gateway 2.1 Online help (Printable format) 101 of 135
Working with the audit logs The audit log records any user action on the Cisco Tel ePresence ISDN Gateway which might
compromise the sec urity of the unit, of its functions, or of the network.
By enabling auditing, all network settings, security setti ngs, creation/deletion of dial plans and any
changes to the audit log itself are logged on the ISDN Gate way.
All relevant actions on the ISDN Gateway are logged, i ncluding those made through the serial
console, a supervisor blade (for MSE blades), the API, F TP, and the web interface. The module that
has caused a log is listed within the details of that log a nd will be one of:
Web: For configuration changes made through the web interf ace.
Serial: For configuration changes made through the serial interface.
API: For configuration changes made through the API.
Supervisor: For configuration changes made through the Supervisor Blade (on ly applies to
MSE blades).
System: For audit messages from the ISDN Gateway.
FTP: For audit messages recording requests made to the ISDN Gate way over FTP.
Each log also has a severity associated with it (Error, Se vere Warning, Warning, Info, or Status
Warning).
You must enable the audit log for it to record these acti ons.
To enable and view the audit log, go to Logs and select the Audit log tab.
Audit log
The last 2000 audit messages generated by the ISDN Gatewa y are displayed in the Audit log page.
The last 100,000 audit messages are stored on the com pact flash if there is one; otherwise, the last
100,000 audit messages are stored internally. You can onl y view the last 2000 through the web
interface, but you can download all stored audit messages (up t o the 100,000) as XML.
You can delete audit messages, but you cannot delete the m ost recent 400 audit messages. If you
delete any audit messages, that will be audited in a new audit message.
You cannot send the audit log to a syslog server.