You are trying to determine which user made configuration changes to a Cisco TelePresence MCU. However,
when you navigate to Logs > Audit log, you discover that only 2,000 audit messages are displayed. The
configuration changes were made before the earliest displayed entry.
Which of the following should you do?

A.
Attempt to discover who made the changes by using another source.

B.
Delete newer audit messages to make room for the older audit messages.

C.
Reboot the Cisco TelePresence MCU.

D.
Send the stored audit messages to a syslog server.

E.
Download the stored audit messages in XML format.

Explanation:
You should download the stored audit messages in Extended Markup Language (XML) format. A Cisco
TelePresence multipoint control unit (MCU) stores the last 100,000 audit messages internally or on compact
flash if it is available. Only 2,000 messages are displayed by using the web interface.
You cannot send the stored audit messages to a syslog server. The stored messages can only be downloaded
as an XML file.
Audit messages can be deleted, but doing so could cause you to delete important audit messages that might be
needed in the future. In addition, the act of deleting audit messages will cause an audit message to be
generated to track the deletion.
You need not reboot the Cisco TelePresence MCU. Rebooting the MCU will not cause the older audit
messages to appear.
You need not attempt to discover who made the changes by using another source. It is likely that you will be
able to discover which user made the configuration changes by downloading the stored audit messages to
XML.

Cisco: Cisco TelePresence MCU Series, Administrator Guide: Working with the audit logs (PDF)