Call forensics

[Jason Learmouth]

Has anyone out there had to do any fairly detailed tracing of a call using the ShoreTel logs? We have a client that has had some calls that appear to be from a particular user, the user says that they didn't make them.

The CDR reports match the phone bill. I can see the call being setup in TmsNcc.log, but there are no button pushes logged for the call. I'm assuming that the call was initiated by TAPI. Is there any way to confirm this and if so is there any way to narrow it down to a computer?

Thanks for your help.

[luckycharms]

How old are these calls that you are looking for in the logs, since the logs are only kept for 7 days. You really need the 128-bit call GUID for each call to filter through the logs. The call GUID can be obtained from the call history file in the call manager.

[Jason Learmouth]

Thanks Matthew,

I have the logs and I have the call GUID, now I just need to figure out what the logs mean. Do you know if there is any documentation on the log files?

Thanks,
Jason

[luckycharms]

The only documentation/training that ShoreTel offers on using the logs is the Advanced Systems/Troubleshooting class. We spent a little time working with the logs. Your best bet is to open a ticket with ShoreTel TAC and they can help you out.