Re: Exchange 2003 log analyzers

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Ben Winzenz [Exchange MVP] (ben_winzenz_at_NOSPAMdotmessageonedotcom)
Date: 12/16/04


Date: Thu, 16 Dec 2004 09:57:08 -0600

You aren't looking for something to analyze the Exchange logs, you are
looking for something that will analyze the actual Server Event logs.
Understand that when working with Exchange, when someone refers to Exchange
log files, the first thing that comes to mind is the actual transaction logs
that Exchange uses to record the transactions (such as e-mail) that it
performs. Those won't tell you anything regarding which accounts are
accessing which mailboxes.

I'd recommend to first of all enable Diagnostics logging in Exchange to
allow it to capture logons. Once you have done that, you can look at
products that analyze event logs. To enable Diagnostics logging, go to the
properties of your server in ESM, then go to the Diagnostics logging tab.
Next, go to MSExchange IS, Mailbox, then on the right, set logging to a
higher level for Logons. This will then log when user accounts log in to
mailboxes, those event will be logged to the Application logs as events 1009
and 1011.

-- 
Ben Winzenz
Exchange MVP
"Sumner Paine" <sumnerp@comcast.net> wrote in message 
news:32bbfiF3kfl0mU1@individual.net...
> Can anyone recommend a log analyzer for Exchange 2003? My goal is to 
> easily search and report on which domain accounts are accessing mailboxes. 


Relevant Pages

  • Re: Track down external email
    ... If it's smtp mail, it should show you originating ip address in message ... MVP - Exchange ... The header only shows who the email was from and who it went to. ... the timestamps in logs still use UTC. ...
    (microsoft.public.exchange.admin)
  • Re: Outlook client fails to connect to Exchange Server 2000 but OW
    ... there were errors in the logs even before this. ... Now I tried to get help from 1 guy workin with MS Exchange, ... We have a single MS Exchange Server 2000 which works as a member ... I can access exchange thru OWA but not thru Outlook client. ...
    (microsoft.public.exchange.clients)
  • Re: Hard Drive Configuration for Exchange 2003
    ... How do I identify the logs that should be moved after the install? ... Go to the properties of the Storage Group in Exchange System Manager. ... I've read that the following should be on separate drives: ...
    (microsoft.public.exchange.setup)
  • RE: Exchange no longer deleting Message Tracking Logs older than x
    ... 01:00 then it decides to not delete the logs. ... I wonder if a full restart of ALL exchange services was needed, ... Microsoft CSS Online Newsgroup Support ... This newsgroup only focuses on SBS technical issues. ...
    (microsoft.public.windows.server.sbs)
  • =?iso-8859-1?Q?Re:_Informationsspeicher_bei_Exchange_2000_h=E4ngt_beim_Be?= =?iso-8859&#
    ... > Exchange liest im laufenden Betrieb nie aus den Logs, nur beim Recovery ... Da habe ich selbst den "Microsoft Exchange ... > werden alle Logs in denen noch offene Transaktionen sind in das Fullbackup ...
    (microsoft.public.de.german.exchange2000.general)