MLA command history?

We have MLA turned on (CM 4.1.3). Is there some sort of
history 
mechanism that would tell us who deleted a route pattern?
_______________________________________________
cisco-voip mailing list
cisco-voippuck.nether.net
h
ttps://puck.nether.net/mailman/listinfo/cisco-voip

IIS logs in c:\winnt\system32\logfiles\w3svc1\ will
show you but  
you'll have to do some digging.

I'd recommend adding a new route pattern pointing to a
dummy gw, then  
deleting it.  Look at the IIS log for your delete and take
note of  
the string invoked.  Then search through all the logs for a
similar  
string that will show you all route patterns deleted,
including the  
mla username and source IP address.

-Ryan

On Jul 31, 2006, at 8:06 AM, Robert Kulagowski wrote:

We have MLA turned on (CM 4.1.3). Is there some sort of
history
mechanism that would tell us who deleted a route pattern?
_______________________________________________
cisco-voip mailing list
cisco-voippuck.nether.net
h
ttps://puck.nether.net/mailman/listinfo/cisco-voip

_______________________________________________
cisco-voip mailing list
cisco-voippuck.nether.net
h
ttps://puck.nether.net/mailman/listinfo/cisco-voip

There is an MLA trace file that is a little cryptic but will
give you
a general breadcrumb history for a user. Normally in the
c:\Program Files\Cisco\Trace\MLA directory if I recall
correctly.

Patrick

On 7/31/06, Robert Kulagowski <bobsmalltime.com> wrote:
> We have MLA turned on (CM 4.1.3). Is there some sort of
history
> mechanism that would tell us who deleted a route
pattern?
> _______________________________________________
> cisco-voip mailing list
> cisco-voippuck.nether.net
> h
ttps://puck.nether.net/mailman/listinfo/cisco-voip
>


-- 
--Patrick
_______________________________________________
cisco-voip mailing list
cisco-voippuck.nether.net
h
ttps://puck.nether.net/mailman/listinfo/cisco-voip

> There is an MLA trace file that is a little cryptic but
will give you
> a general breadcrumb history for a user. Normally in
the
> c:\Program Files\Cisco\Trace\MLA directory if I
recall correctly.

I just took a look, and unless there's some debug level
that isn't 
turned up high enough, the details just aren't there.  I
was really 
hoping for something like "user x: action: delete
route pattern 8.090!" 
or something similar.

Is this level of detail available?  It's difficult to
perform a 
post-mortem with what's in there now.
_______________________________________________
cisco-voip mailing list
cisco-voippuck.nether.net
h
ttps://puck.nether.net/mailman/listinfo/cisco-voip

The MLA access logs tell you a little bit:
http://www.cisco.com/en/US/customer/produc
ts/sw/voicesw/ps556/products_administration_guide_chapter091
86a00803eda81.html#wp1025731

07/31/06:11:23:31:Access:|ccmadministrator|access||/CCMAdmin
/_RemoteScripts/rs_system.asp||deleteRoutePattern 
: called with Full Access
07/31/06:11:24:18:Access:|ccmadministrator|access||/CCMAdmin
/_RemoteScripts/rs_system.asp||deleteRoutePattern 
: called with Full Access

But as Ryan said, this IIS logs tell you more.

/Wes

Robert Kulagowski wrote:
> We have MLA turned on (CM 4.1.3). Is there some sort of
history 
> mechanism that would tell us who deleted a route
pattern?
> _______________________________________________
> cisco-voip mailing list
> cisco-voippuck.nether.net
> h
ttps://puck.nether.net/mailman/listinfo/cisco-voip
>   
_______________________________________________
cisco-voip mailing list
cisco-voippuck.nether.net
h
ttps://puck.nether.net/mailman/listinfo/cisco-voip

Wes Sisk wrote:
> The MLA access logs tell you a little bit:
> http://www.cisco.com/en/US/customer/produc
ts/sw/voicesw/ps556/products_administration_guide_chapter091
86a00803eda81.html#wp1025731 
> 
> 
>
07/31/06:11:23:31:Access:|ccmadministrator|access||/CCMAdmin
/_RemoteScripts/rs_system.asp||deleteRoutePattern 
> : called with Full Access
>
07/31/06:11:24:18:Access:|ccmadministrator|access||/CCMAdmin
/_RemoteScripts/rs_system.asp||deleteRoutePattern 
> : called with Full Access
> 
> But as Ryan said, this IIS logs tell you more.

It turns out that in this case it wasn't a delete; it was
an update that 
should have been a copy.

I haven't had the cycles to investigate, so I'll have to
check if there 
would have been sufficient details in the IIS logs to
determine what 
happened.
_______________________________________________
cisco-voip mailing list
cisco-voippuck.nether.net
h
ttps://puck.nether.net/mailman/listinfo/cisco-voip

Try Cisco's Voice Provisioning Tool
http://www.cisco.com/en/US/pr
oducts/ps6524/products_data_sheet0900aecd80313abd.html

Or  C:\Program Files\Cisco\Trace\MLA  and check for the
access*.log

Wes Sisk wrote:
> The MLA access logs tell you a little bit:
> http://www.cisco.com/en/US/customer/produc
ts/sw/voicesw/ps556/products_administration_guide_chapter091
86a00803eda81.html#wp1025731
>
>
07/31/06:11:23:31:Access:|ccmadministrator|access||/CCMAdmin
/_RemoteScripts/rs_system.asp||deleteRoutePattern 
> : called with Full Access
>
07/31/06:11:24:18:Access:|ccmadministrator|access||/CCMAdmin
/_RemoteScripts/rs_system.asp||deleteRoutePattern 
> : called with Full Access
>
> But as Ryan said, this IIS logs tell you more.
>
> /Wes
>
> Robert Kulagowski wrote:
>   
>> We have MLA turned on (CM 4.1.3). Is there some
sort of history 
>> mechanism that would tell us who deleted a route
pattern?
>> _______________________________________________
>> cisco-voip mailing list
>> cisco-voippuck.nether.net
>> h
ttps://puck.nether.net/mailman/listinfo/cisco-voip
>>   
>>     
> _______________________________________________
> cisco-voip mailing list
> cisco-voippuck.nether.net
> h
ttps://puck.nether.net/mailman/listinfo/cisco-voip
>
>   


-- 
====================================================
J. Oquendo
http://pgp.mit.edu:11371/pks/lookup?op=get&s
earch=0x1383A743
GPG Key ID 0x1383A743
Fingerprint:
7B02 28CF 24D3 ACA7 9907  789A 8772 7736 1383 A743

sil . infiltrated  net
http://www.infiltrated.net
 


The happiness of society is the end of government.
John Adams

_______________________________________________
cisco-voip mailing list
cisco-voippuck.nether.net
h
ttps://puck.nether.net/mailman/listinfo/cisco-voip

> Try Cisco's Voice Provisioning Tool
> http://www.cisco.com/en/US/pr
oducts/ps6524/products_data_sheet0900aecd80313abd.html 

We're AD integrated, so no joy.
_______________________________________________
cisco-voip mailing list
cisco-voippuck.nether.net
h
ttps://puck.nether.net/mailman/listinfo/cisco-voip

Here is a line from the IIS log on my 4.1(3) server after I
did an  
update to a 413XXXX route pattern.

2006-07-31 17:17:44 14.48.39.100 administrator 14.48.39.100
443 GET / 
CCMAdmin/_RemoteScripts/rs_system.asp  
_method=updateRoutePattern&_mtype=execute&pcount=41&
amp;p0=% 
7BF96BF080-282E-43A7-AD45-576F5C62DCB3%7D&p1=5&p2=42
1XXXX

There is a lot more to the line but I've included just the
important  
parts.

The first IP address is the source IP addr, the second is
the server  
IP address.  The username is pretty obvious, my server does
not have  
MLA enabled.
GET is the operation, and what follows is the good stuff. 
p0 is the  
SQL pkid of the route pattern, found in the NumPlan table
(%7b = { so  
the actual pkid in my case starts with F96B).  p2 is the
actual route  
pattern (421XXXX in my case).  Between these two you should
be able  
to identify the correct route pattern.

The search string you'll want to use is
"updateRoutePattern".

So to put it all together, run the following command from a
cmd  
prompt to get all the route pattern udpates from today.
findstr updateRoutePattern
c:\winnt\system32\logfiles\w3svc1 
\ex060731.log > routepatternupdates.txt

This will dump all the updates into the current directory. 
From  
there just take a look and see what you have.

-Ryan

On Jul 31, 2006, at 11:45 AM, Robert Kulagowski wrote:

Wes Sisk wrote:
> The MLA access logs tell you a little bit:
> http://www.cisco.com/en/US/customer/products/sw/vo
icesw/ps556/ 
>
products_administration_guide_chapter09186a00803eda81.html#w
p1025731
>
>
>
07/31/06:11:23:31:Access:|ccmadministrator|access||/CCMAdmin
/ 
> _RemoteScripts/rs_system.asp||deleteRoutePattern
> : called with Full Access
>
07/31/06:11:24:18:Access:|ccmadministrator|access||/CCMAdmin
/ 
> _RemoteScripts/rs_system.asp||deleteRoutePattern
> : called with Full Access
>
> But as Ryan said, this IIS logs tell you more.

It turns out that in this case it wasn't a delete; it was
an update that
should have been a copy.

I haven't had the cycles to investigate, so I'll have to
check if there
would have been sufficient details in the IIS logs to
determine what
happened.
_______________________________________________
cisco-voip mailing list
cisco-voippuck.nether.net
h
ttps://puck.nether.net/mailman/listinfo/cisco-voip

_______________________________________________
cisco-voip mailing list
cisco-voippuck.nether.net
h
ttps://puck.nether.net/mailman/listinfo/cisco-voip