What is Cisco Activity


This document describes how to configure the Real Time Monitoring Tool (RTMT) to display and monitor real-time activity in Cisco Unified Communications Manager (CUCM).



Cisco recommends that you have knowledge of the following areas:

  • CUCM administration
  • CUCM trace configuration
  • RTMT navigation

Components used

The information in this document is based on the following software and hardware versions:

  • Cisco Unified Communications Manager
  • Real-time monitoring tool

The information in this document was produced by the devices in a specific laboratory environment. All devices used in this document started with an empty (standard) configuration. With your network up and running, make sure you understand the potential implications of a command.

Background information

For CUCM, the application audit log supports configuration updates for CUCM interfaces such as Communications Manager Administration, Cisco Unified RTMT, Cisco Unified Communications Manager CDR Analysis and Reporting, and Cisco Unified Serviceability.

For IM and Presence services, the application audit log supports configuration updates for IM and Presence interfaces such as Cisco Unified Communications Manager IM and Presence Administration, Cisco Unified IM and Presence Real-Time Monitoring Tool, and Cisco Unified IM and Presence Serviceability.

For Cisco Unity Connection, the Application Audit Log supports configuration updates for Cisco Unity Connection Interfaces, Cisco Unity Connection Administration, Cisco Unity Connection Serviceability, Cisco Personal Communications Assistant, and clients using the Connection REST Application Programming Interfaces (APIs).


Follow these steps to configure the audit trail feature and view the RTMT audit trail.

Step 1: Enable the audit log. Navigate to Cisco Unified Serviceability> Tools> Audit Log Configurationand enable these parameters.

  • Activate the audit log
  • Activate deletion
  • Enable rotation of log files
  • Detailed audit logs (Detailed audit logs provide the same items as regular audit logs, but also contain configuration changes. For example, the audit log contains items that have been added, updated, and deleted, including changed values.)

Note: You need these services den Network Service Audit Event Service and Network Service Cisco Log Partitions Monitoring activate.

tip: If log rotation is disabled (not enabled), the audit log ignores the Maximum number of files setting.

Step 2: You can now use RTMT to view audit logs. Open and sign in to Cisco RTMT. Navigate to System> Tools> AuditLog Viewer and select the node from which you want to monitor the activity.

Step 3: Choose AuditApp logs and then select the required log file from the selection list. A view of the events for the selected log file is displayed.

Step 4: Select the entry you want twice to view more event details. In this example there is a CLI command audit trail that indicates that the command show me on knot cucm1151pub was executed. Select the icon with a double-sided image to copy the alarm details, which can be pasted elsewhere.

tip: Check the box for automatic updateto enable dynamic updates of log entries in the AuditLog Viewer.


No verification process is currently available for this configuration.


No specific troubleshooting information is currently available for this configuration.

Related information