As of CUCM version 9.1.2, changes to Device Defaults (such as changing the device pool, phone button template or firmware load) for a phone model still do not appear in CUCM Audit Logs, and thus will not appear in Log Analysis in Variphy.
However, as part of a firmware change in CUCM, the TFTP Service must be restarted for the devices to download the new firmware. The TFTP Service restart will show up in the Audit Logs, which should help identify which user made such a change.
