log parser and microsoft exchange server, the perfect blend! ilse van criekinge exchange trainer...
TRANSCRIPT
![Page 1: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/1.jpg)
Log Parser and Microsoft Log Parser and Microsoft Exchange Server, the Perfect Exchange Server, the Perfect
Blend!Blend!
Ilse Van CriekingeExchange Trainer & Consultant
(Azlan Training)
![Page 2: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/2.jpg)
ObjectivesObjectivesWho needs reports?What kind of data is available?How to gain access to the data?How to present the acquired data?
![Page 3: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/3.jpg)
AgendaAgenda
Introduction
Process flow
Sources of data
Pulling it all together: Joins
Report creation
Automation
![Page 4: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/4.jpg)
IntroductionIntroductionReports are critical to a healthy Exchange org
understand, monitor, and track “who-what-when-where-how” usage data
mail usage by usermessage traffic patternsdelivery timeshistorical usage trendsmessage content reporting...
![Page 5: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/5.jpg)
Many reporting packages are available at a price
OmniAnalyser, StealthAUDIT for Exchange, eIQ Mailanalyzer, Quest MessageStats, Admin Report Kit for Exchange, IMFStats, bv-Control for Exchange, PROMODAG Reports for Exchange, MailMeter Insight, Mail Access Monitor for MS Exchange Server,MailDetective, Sirana AppAnayzer for Exchange, e-nspect real time reporting, Quest Reporter, DYS CONTROL!, Exchange Monitor, bt-LogAnalyzer, ...
But…easy to develop basic reports yourself!
![Page 6: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/6.jpg)
RequirementsRequirementsMicrosoft Exchange ServerActive DirectoryData extraction tools
Microsoft Log Parser 2.2A dash of scripting
![Page 7: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/7.jpg)
To create & publish reportsTo create & publish reports
Microsoft SQL Server 2000 (or better) to store the data
Visual Studio .NET 2003 (or better) to create reports
SQL Reporting Services to publish reports
![Page 8: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/8.jpg)
Why Reporting Services?Why Reporting Services?
Powerful web based reporting toolEasy to create rich, interactive, graphical reportsEnd-users can subscribe to receive reports via email, file share, etc…End-users can export reports to various formats (XLS, XML, CSV, HTML, TIFF, PDF, etc…)Easy to developRendering and processing can be seperated
![Page 9: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/9.jpg)
AgendaAgenda
Introduction
Process flow
Sources of data
Pulling it all together: Joins
Report creation
Automation
![Page 10: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/10.jpg)
Process FlowProcess Flow
1. Extract data from source2. Load data into SQL Server3. Create report in Visual Studio4. Publish report
![Page 11: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/11.jpg)
Process FlowProcess FlowExchange
Message Tracking LogsActive Directory
User & Mailbox InfoExchange
Mailbox InfoDataDataSourcesSources
DataDataAccessAccessMethodMethod
Log Parser CSVDE WMI
Microsoft SQL Server DatabaseDataDataStorageStorage
DataDataOutputOutput Microsoft SQL Server Reporting Services
![Page 12: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/12.jpg)
AgendaAgenda
Introduction
Process flow
Sources of data
Pulling it all together: Joins
Report creation
Automation
![Page 13: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/13.jpg)
Sources of DataSources of Data
Exchange message tracking logs
Active Directory
HomeMDB, quota settings, ...
User Information
WMI providers for Exchange
![Page 14: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/14.jpg)
Source 1:Source 1:Exchange Message Tracking LogsExchange Message Tracking Logs
Available in Exchange 5.5/2000/2003Has to be enabled
Exchange 5.5: Information Store/MTA/Internet Mail ServiceExchange 2000/2003: Server setting
Options:Remove log files [older than (days)]Exchange 2000/2003: Enable subject logging and displayExchange 2003: Location to store log files
![Page 15: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/15.jpg)
Message Tracking Log Message Tracking Log FormatFormat
Note: Tracking logs in Microsoft Exchange 2000 Server have a significantly different format then Microsoft Exchange Server 5.5 tracking logs.
Generally follows the W3C format for log files
First few lines contain directives, tab delimited
One log generated/server/day
Logs roll at midnight GMT
All times in the log are GMT
![Page 16: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/16.jpg)
Message Tracking Log FieldsMessage Tracking Log FieldsField number Field name Field number Field name
1 Date 11 Priority
2 Time 12 Recipient-Report-Status
3 Client-IP 13 Total-bytes
4 Client-hostname 14 Number-recipients
5 Partner-name 15 Time-taken
6 Server-hostname 16 Encryption
7 Server-IP 17 Service-version
8 Recipient-address 18 Linked-MSGID
9 Event-ID 19 Message-subject
10 MSGID 20 Sender-address
Source: http://support.microsoft.com/?kbid=246965
Message tracking event IDs in Exchange Server 20031027: Message submission by store1028: Message deliveryOverview: http://support.microsoft.com/?kbid=821905
![Page 17: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/17.jpg)
Message Tracking Log Message Tracking Log SampleSample
# Message Tracking Log File# Exchange System Attendant Version 6.5.7638.1
# Date Time client-ip Client-hostname Partner-Name Server-hostname server-IP Recipient-AddressEvent-ID MSGID Priority Recipient-Report-Status total-bytes Number-RecipientsOrigination-Time Encryption service-Version Linked-MSGID Message-Subject Sender-Address
2006-2-7 10:28:41 GMT - - - NTS00 - [email protected] [email protected] 0 0 5111 2006-2-7 10:28:41 GMT 0 - c=US;a= ;p=First Organizati;l=NTS00-060207102841Z-5 Will Public Folders disappear? EX:/O=FIRST ORGANIZATION/OU=FIRST ADMINISTRATIVE GROUP/CN=RECIPIENTS/CN=ILSE -
2006-2-7 10:28:41 GMT - - - NTS00 - [email protected] [email protected] 0 0 5111 2006-2-7 10:28:41 GMT 0 - - Will Public Folders
disappear? - -
2006-2-7 10:28:41 GMT - - - NTS00 - [email protected] [email protected] 0 0 5111 2006-2-7 10:28:41 GMT 0 - - Will Public Folders
disappear? - -
2006-2-7 10:28:41 GMT - - - NTS00 - [email protected] [email protected] 0 0 5111 2006-2-7 10:28:41 GMT 0 - - Will Public Folders
disappear? - -
2006-2-7 10:28:41 GMT - - - NTS00 - [email protected] [email protected] 0 0 5111 2006-2-7 10:28:41 GMT 0 - - Will Public Folders
disappear? [email protected] -
2006-2-7 10:28:41 GMT - - - NTS00 - [email protected] [email protected] 0 0 5111 2006-2-7 10:28:41 GMT 0 - - Will Public Folders
disappear? [email protected] -
![Page 18: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/18.jpg)
Column DataDate 2006-2-7
Time 10:28:41 GMT
Client-IP -
Client-Hostname -
Partner-Name -
Server-Hostname NTS00
Server-IP -
Recipient-Address [email protected]
Event-ID 1027
MSGID [email protected]
Priority 0
Recipient-Report-Status 0
total-bytes 511
Number-Recipients 1
Origination Time 2006-2-7 10:28:41 GMT
Encryption 0
Service-Version -
Linked-MSGID c=US;a= ;p=First Organizati;l=NTS00-060207102841Z-5
Message-Subject Will Public Folders disappear?
Sender-Address EX:/O=FIRST ORGANIZATION/OU=FIRST ADMINISTRATIVE GROUP/CN=RECIPIENTS/CN=ILSE
![Page 19: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/19.jpg)
Log ParserLog ParserLog Parser 2.2 can be used to reformat the tracking logs into a format digestible by SQL ServerLog Parser is available for download from the Microsoft Download Center:http://www.microsoft.com/download
![Page 20: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/20.jpg)
Introducing Log ParserIntroducing Log Parser““The world is your database with Log Parser”The world is your database with Log Parser”
Log Parser allows users to treat log files and other information as SQL tables, the rows of which can be queried, processed, and formatted in different ways Born around 2000, as a utility to test the logging mechanisms of IISLatest release = version 2.2“Designed and engineered with the vision of helping users achieve their data-processing goals in a simple, fast, and powerful way.”
![Page 21: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/21.jpg)
Building QueriesBuilding Queries
Data(Input Formats)
Output Records(Output Formats)
Log Parser Query
![Page 22: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/22.jpg)
Building Blocks Log ParserBuilding Blocks Log ParserInput Format
Log Parser Query (dialect of SQL)Output Format
ADS ETW IIS NETMON TSV
BIN EVT IISODBC REG URLSCAN
COM FS IISW3C TEXTLINE W3C
CSV HTTPERR NCSA TEXTWORD XML
CHART IIS SYSLOG W3C
CSV NAT TPL XML
DATAGRID SQL TSV
![Page 23: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/23.jpg)
Example: Retrieving some Example: Retrieving some fields from the Event Log fields from the Event Log
c:\LogParser –i:EVT –o:NAT “SELECT TimeGenerated, SourceName FROM System”
Or “SELECT TimeGenerated, SourceName INTOmytest.txt FROM System”
TimeGenerated SourceName------------------- -----------------------2005-11-10 12:26:07 Windows Update Agent2005-11-10 12:26:14 Windows Update Agent2005-11-10 15:00:23 Service Control Manager2005-11-10 15:00:23 Service Control Manager2005-11-10 15:00:44 Windows Update Agent2005-11-10 15:01:18 Windows Update Agent2005-11-10 15:01:30 NtServicePack2005-11-10 15:01:36 Windows Update Agent2005-11-10 15:01:50 Windows Update Agent2005-11-10 15:02:12 Windows Update AgentPress a key...
![Page 24: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/24.jpg)
Back to Message Tracking Back to Message Tracking LogsLogs
Command:LogParser.exefile:f:\info\msgtracklog.sql?infile=f:\info\logs\20060207.log+outfile= f:\info\logs\20060207.bcp
-i:W3C -o:TSV
W3C input format parses log files in the W3C Extended Log File FormatTSV output format creates text file formatted according to the Tab-Seperated-Values convention
![Page 25: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/25.jpg)
Log Parser Query SyntaxLog Parser Query Syntax
msgtracklog.sql:
SELECTTO_Timestamp(REPLACE_STR(STRCAT(STRCAT(date,' '), time),'
GMT',''),'yyyy-M-d h:m:s') as DateTime,[client-ip], [Client-hostname], [Partner-name], [Server-hostname], [server-
IP], [Recipient-Address],[Event-ID], [MSGID], [Priority], [Recipient-Report-Status], [total-bytes],
[Number-Recipients],TO_Timestamp(REPLACE_STR([Origination-time], ' GMT',''),'yyyy-M-d h:m:s')
as [Origination Time],Encryption, [service-Version], [Linked-MSGID], [Message-Subject], [Sender-
Address]INTO '%outfile%'FROM '%infile%'WHERE [Event-ID] IN (1027;1028)
![Page 26: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/26.jpg)
Log Parser OutputLog Parser Output
DateTime client-ip Client-hostname Partner-Name Server-hostname server-IP Recipient-AddressEvent-IDMSGID Priority Recipient-Report-Status total-bytes Number-RecipientsOrigination TimeEncryption service-Version Linked-MSGID Message-SubjectSender-Address
2006-02-07 10:28:41 NTS00 [email protected] [email protected] 0 0 511 12006-02-07 10:28:41 0 c=US;a= ;p=First Organizati;l=NTS00-060207102841Z-5Will Public Folders disappear? EX:/O=FIRST ORGANIZATION/OU=FIRST ADMINISTRATIVE GROUP/CN=RECIPIENTS/CN=ILSE -
![Page 27: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/27.jpg)
Column DataDateTime 2006-02-07 10:28:41
Client-IP -
Client-Hostname -
Partner-Name -
Server-Hostname NTS00
Server-IP -
Recipient-Address [email protected]
Event-ID 1027
MSGID [email protected]
Priority 0
Recipient-Report-Status 0
total-bytes 511
Number-Recipients 1
Origination Time 2006-02-07 10:28:41
Encryption 0
Service-Version -
Linked-MSGID c=US;a= ;p=First Organizati;l=NTS00-060207102841Z-5
Message-Subject Will Public Folders disappear?
Sender-Address EX:/O=FIRST ORGANIZATION/OU=FIRST ADMINISTRATIVE GROUP/CN=RECIPIENTS/CN=ILSE
![Page 28: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/28.jpg)
Populate SQL with formed DATAPopulate SQL with formed DATA
Create a table to hold the data
Import information into the database
Several tools available, like:
SQL 2000: SQL Query Analyzer, osql utility, bcp utility
SQL 2005: SQL Management Studio, sqlcmd, bcp or osql utility
![Page 29: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/29.jpg)
Create Table to Hold DataCreate Table to Hold DataUSE Analyzing_ExchangeCREATE TABLE MsgTrackingLogs (
[DateTime] datetime NULL ,[Client-IP] varchar (255) NULL ,[Client-Hostname] nvarchar (255) NULL ,[Partner-name] nvarchar (255) NULL ,[Server-hostname] nvarchar (255) NULL ,[Server-IP] varchar (255) NULL ,[Recipient-Address] varchar (512) NULL ,[Event-ID] int NULL ,[MSGID] nvarchar (1024) NULL ,[Priority] int NULL ,[Recipient-Report-Status] int NULL ,[Total-bytes] bigint NULL ,[Number-Recipients] int NULL ,[Origination Time] datetime NULL ,[Encryption] int NULL ,[Service-version] varchar (255) NULL ,[Linked-MSGID] varchar (255) NULL ,[Message-Subject] nvarchar (255) NULL ,[Sender-Address] varchar (255) NULL ,
)
![Page 30: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/30.jpg)
![Page 31: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/31.jpg)
Import Data Into DatabaseImport Data Into Database
Bcp Analyzing_Exchange.dbo.msgtrackinglogs
in f:\info\logs\20060207.bcp
–c
–t”\t”
–T
–F 2
![Page 32: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/32.jpg)
![Page 33: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/33.jpg)
![Page 34: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/34.jpg)
Source 2: Active DirectorySource 2: Active DirectoryEach mailbox is an object in ADSome relevant properties:
legacyExchangeDNhomeMDBmDBUseDefaults (use default quota)mDBStorageQuota (issue warning)mDBOverQuotaLimit (prohibit send)mDBOverHardQuotaLimit (prohibit send/receive)Can also include fields like city, department, etc..
Use CSVDE to export data to CSV fileUse account with Exchange view only admin rights
![Page 35: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/35.jpg)
Introducing CSVDEIntroducing CSVDE
csvde.exe installed on Windows 200X Server by defaultCan be run from Windows 2000 Pro or XP ProfessionalCan be used to import and export data from Active Directory by using files that store data in the comma-separated value (CSV) file format standardAlso supports batch operations that are based on CSV
![Page 36: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/36.jpg)
CSVDE SyntaxCSVDE SyntaxCSVDE
-f file to export to-s servername-d LDAP search root-r LDAP search filter (default objectClass=*)-l list of attributes to export-u Unicode format (important for DBCS)
![Page 37: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/37.jpg)
CSVDE ExampleCSVDE ExampleExtract a specified list of all Person objects in the
Matisse domain:
CSVDE –f f:\info\ad\directory.csv
-s NTSMATISSE
-d "dc=matisse,dc=edu"
-r "(&(objectCategory=Person)(homeMDB=*))"
-l DN,legacyExchangeDN,mail,homeMDB,mDBUseDefaults,mDBOverQuotaLimit,mDBStorageQuota,mDBOverHardQuotaLimit,department
-u
![Page 38: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/38.jpg)
Create Table to Hold DataCreate Table to Hold DataCREATE TABLE [Active_Directory_Info] (
[DN] [varchar] (1000) NULL ,[legacyExchangeDN] [varchar] (512) NULL,[mail] [varchar] (512) NULL ,[homeMDB] [varchar] (1000) NULL ,[mDBUseDefaults] [varchar] (10) NULL ,[mDBOverQuotaLimit] [int] NULL ,[mDBStorageQuota] [int] NULL ,[mDBOverHardQuotaLimit] [int] NULL ,[Department] [varchar] (256) NULL ,
) ON [PRIMARY]
![Page 39: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/39.jpg)
Import Data Into DatabaseImport Data Into DatabaseLogParser
"SELECT DN,legacyExchangeDN,mail,homeMDB,mDBUseDefaults,mDBOverQuotaLimit,mDBStorageQuota,mDBOverHardQuotaLimit,department
into dbo.Active_Directory_Info
FROM f:\info\ad\directory.csv"
-i:csv
-o:SQL -server:servername -database:Analyzing_Exchange -driver:"SQL Server"
![Page 40: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/40.jpg)
![Page 41: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/41.jpg)
Source 3: WMI Source 3: WMI Windows Management InstrumentationManagement technology allowing scripts to monitor and control managed resources throughout the networkResources include hard drives, file systems, operating system settings, processes, services, shares, registry settings, networking components, event logs, users, and groupsBuilt into clients with Windows 2000 or above, and can be installed on any other 32-bit Windows clientWMI is easy to consume via script
![Page 42: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/42.jpg)
Exchange_Mailbox WMI ClassExchange_Mailbox WMI ClassNew class for Exchange 2003
Returns properties of a mailbox
Interesting fields:MailboxDisplayName
LegacyDN (legacyExchangeDN)
ServerName (Exchange server name)
Size (size of mailbox in kb)
TotalItems (total # messages in the mailbox)
DeletedMessageSizeExtended (Size in bytes of deleted messages being retained per deleted items retention policy)
![Page 43: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/43.jpg)
VBScript to Access WMI DataVBScript to Access WMI DatastrWinMgmts =
"winmgmts:{impersonationLevel=impersonate}!//ServerName/root/MicrosoftExchangeV2"
Set objWMIExchange = GetObject(strWinMgmts)Set listExchange_Mailboxes = objWMIExchange.InstancesOf("Exchange_Mailbox")For each objExchange_Mailbox in listExchange_Mailboxes Wscript.echo objExchange_Mailbox.MailboxDisplayName & vbTab _
& objExchange_Mailbox.LegacyDN & vbTab _& objExchange_Mailbox.ServerName & vbTab _& objExchange_Mailbox.Size & vbTab _& objExchange_Mailbox.TotalItems & vbTab _
& objExchange_Mailbox.DeletedMessageSizeExtended & vbTab _ & objExchange_Mailbox.LastLogonTime & vbTab _ & objExchange_Mailbox.LastLogOffTime & vbTab _
& objExchange_Mailbox.LastLoggedOnUserAccountNext
Execute as: cscript //nologo mailboxes.vbs > Mailboxes.txt
![Page 44: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/44.jpg)
Create Table to Hold DataCreate Table to Hold Data
CREATE TABLE [MailboxSizeData] ([displayName] [varchar] (128) NULL ,[legacyExchangeDN] [varchar] (512) NULL ,[ServerName] [varchar] (50) NULL ,[Size] [int] NULL ,[TotalItems] [int] NULL ,[DeletedMessageSizeExtended] [int] NULL ,[LastLogonTime] [varchar] (50) NULL ,[LastLogoffTime] [varchar] (50) NULL ,[LastLoggedOnUserAccount] [varchar] (50) NULL
) ON [PRIMARY]
![Page 45: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/45.jpg)
Import Data Into DatabaseImport Data Into DatabaseMicrosoft SQL Server Management Studio “BULK INSERT [MailboxSizeData] FROM ‘f:\
info\wmi\Mailboxes.txt'“
![Page 46: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/46.jpg)
![Page 47: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/47.jpg)
AgendaAgenda
Introduction
Process flow
Sources of data
Pulling it all together: Joins
Report creation
Automation
![Page 48: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/48.jpg)
Pulling it all togetherPulling it all together
SQL joins let us relate data in one table with data in another tablePowerful feature for rich reportsUse common columns to relate data
![Page 49: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/49.jpg)
Table JoinsTable Joins
MsgTrackingLogs, MailboxSizeData and Active_Directory_Info can all be joinedActive_Directory_Info and MailboxSizeData join on [legacyExchangeDN]Then join Active_Directory_Info to MsgTrackingLogs on [Recipient-Address]
![Page 50: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/50.jpg)
JoinJoin
![Page 51: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/51.jpg)
AgendaAgenda
Introduction
Process flow
Sources of data
Pulling it all together: Joins
Report creation
Automation
![Page 52: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/52.jpg)
Report Creation – Getting Report Creation – Getting StartedStarted
Install Reporting Services Install Reporting Services Client ToolsCreate new “Business Intelligence” projectSelect template: “Report Server Project Wizard”
![Page 53: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/53.jpg)
Six Easy StepsSix Easy Steps
1. Define data source
2. Design query
3. Choose type of report
4. Specify basic layout of report
5. Format the report
6. Deploy the report
![Page 54: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/54.jpg)
![Page 55: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/55.jpg)
DeployDeployCheck project propertiesCheck TargetServerUrRL =http://myserver.mydomain.com/ReportServer
Deploy!When complete, browse with IE:
http://servername/Reports
![Page 56: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/56.jpg)
![Page 57: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/57.jpg)
AgendaAgenda
Introduction
Process flow
Sources of data
Pulling it all together: Joins
Report creation
Automation
![Page 58: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/58.jpg)
AutomationAutomation
Automate data gathering and import with:
SQL 2000: Data Transformation Services (DTS)
SQL 2005: SQL System Integration Services
(SSIS)
![Page 59: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/59.jpg)
SummarySummary
Reports are vital to the health of your messaging infrastructure
Basic reports are fairly easy to develop
Three key data sources: AD, Tracking logs, WMI
This session gave you a very limited view of all the power you have when you use the available tools to create custom reports!
![Page 60: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/60.jpg)
Thank you for your Thank you for your attention!attention!
Ilse Van CriekingeExchange Trainer & Consultant
(Azlan Training)
![Page 61: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/61.jpg)
![Page 62: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/62.jpg)
ResourcesResourcesLogParser 2.2
Microsoft Log Parser Toolkit, Gabriele Giuseppini&Mark Burnett, Syngresshttp://www.logparser.com/http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=enhttp://www.microsoft.com/technet/scriptcenter/tools/logparser/default.mspx
Message tracking log field descriptionshttp://support.microsoft.com/default.aspx?scid=kb;en-us;246965
Message tracking log event id definitionshttp://support.microsoft.com/default.aspx?scid=kb;en-us;821905
SQL Server 2000/2005http://www.microsoft.com/sql
Visual Studio 2005http://msdn.microsoft.com/vstudio/
WMI Exchange_Mailbox classhttp://msdn.microsoft.com/library/default.asp?url=/library/en-us/e2k3/e2k3/_wmiref_cl_Exchange_Mailbox.asp
![Page 63: Log Parser and Microsoft Exchange Server, the Perfect Blend! Ilse Van Criekinge Exchange Trainer & Consultant (Azlan Training) ilse@vancriekinge.comilse@vancriekinge.com](https://reader036.vdocuments.net/reader036/viewer/2022062322/56649e4a5503460f94b3ede9/html5/thumbnails/63.jpg)
The Connected GenerationThe Connected Generation
7 & 8 March 20067 & 8 March 2006
ICC GentICC Gent