Audit configuration changes and send them to an ELK

[xclchxclch]

Hi,
I would like to validate a project I want to do. Currently I have the CUCM 8 software.
And I would like to audit certain events such as the configuration changes of each phone and changes in the lines configuration.
I understand that the logs belonging to the operating system itself can be sent using RSYSLOG, but those are not the events that I need.
On the other hand, I would like to send such events to a storage system
of logs such as the ELK cluster.

My doubts are:
Where can I activate this audit?
What kind of export do these logs support?
Is there any automation that these events to be exported every x time?.

Thanks!.

 

[whykap]

I'm not sure what you are trying to achieve by logging changes but you will need another product to monitor database changes. Either something like collaboration assurance or a third party product.
Maybe if you tell us why you need to monitor changes we can help with other suggestions

 

[xclchxclch]

Hi!, first of all thank you for your response.

As I understand, make changes such as changing a line for another in an IP phone, generates a log within the CUCM. I have an ELK-based solution that generates some alerts based on the logs, so I want to have control over the configurations of the voiceip terminals. I hope you have understood me, English is not my mother tongue. Thank you!

 

[whykap]

I dont know what an ELK

 

[whykap]

Sorry I typed submit by accident.
I dont know what an ELK solution is but you can enable audit logs, collect them via RTMT and write the code in your software to sort out the audit logs.
tame a look at this link which is for 7X version but still relevant to 8X:

https://www.netcraftsmen.com/audit-logs-on-cisco-unified-communications-manager-cucm/

 

[xclchxclch]

Hi,

ELK is elascticsearch, logstash and kibana. A solution used for logs centralization and views in real time.
I've seen the link, and what interests me is precisely the export of that data. I do not know if the RTMT if it can work through commands and if it allows to automate it every x time. I was also looking to copy it with sftp, but I can not automate it either ...