Quantcast
Viewing all articles
Browse latest Browse all 8719

Exchange 2013 - Search SMTPReceive logs on CAS

Is there a sensible way to search the SMTP Receive protocol logs on the client access servers?  The Get-MessageTrackingLog cmdlet only searches the mailbox servers, but I need to be able to look at what's connecting to the CAS sometimes and manipulate those logs.  The transport logs are entirely too verbose for some of my needs.

I've been parsing the logs via PowerShell using some form of these piped commands I've put together, and it's certainly functional, but I can't help but feel that I'm doing things the hard way.

Get-ChildItem -Path 'C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive\*' -Include '*.LOG' |
Where-Object -Filter {$_.LastWriteTime -gt (Get-Date).AddDays(-1)} |
Sort-Object -Property 'LastWriteTime' |
Get-Content |
Where-Object -Filter {$_ -like '*,530 5.7.1 Client was not authenticated,*'} |
ConvertFrom-Csv -Header 'date-time','connector-id','session-id','sequence-number','local-endpoint','remote-endpoint','event','data','context' |
ForEach-Object -Process {
    [void]($_.'local-endpoint' -match '(.*):([0-9]*)$')
    $lip = [IPAddress]$Matches[1]
    $lport = [Int]$Matches[2]
    [void]($_.'remote-endpoint' -match '(.*):([0-9]*)$')
    New-Object -TypeName PSObject -Property @{
        'date-time' = [datetime]$_.'date-time';
        'connector-id' = [string]$_.'connector-id';
        'session-id' = [string]$_.'session-id';
        'sequence-number' = [int]$_.'sequence-number';
        'local-endpoint' = [string]$_.'local-endpoint';
        'local-endpoint-ip' = $lip;
        'local-endpoint-port' = $lport;
        'remote-endpoint' = $_.[string]'remote-endpoint';
        'remote-endpoint-ip' = [IPAddress]$Matches[1];
        'remote-endpoint-port' = $rport = [Int]$Matches[2];
        'event' = [string]$_.'event';
        'data' = [string]$_.'data';
        'context' = [string]$_.'context'
    }
} |
Format-Table -Property 'date-time','remote-endpoint-ip','data'


Viewing all articles
Browse latest Browse all 8719

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>