Pull in Exchange Auditing Logs

That's good to hear!

To answer your question, we have connectors for the MS Exchange Application and Event logs. As long as you have logging turned on in Exchange, all you'd need to do is install a LEM Agent on the server and configure those two connectors.

Let me know if you have any other questions.

Thanks.

Can you point me in the direction of some documentation on configuring the connectors?

Here are the URLs for a few relevant help topics:

http://www.solarwinds.com/documentation/LEM/Docs/html/Content/Console/Appliances/ConfigManagerTools.htm

http://www.solarwinds.com/documentation/LEM/Docs/html/Content/Console/ToolConfig/ToolConfigTables.htm

Note that the procedure for accessing Agent connectors (AKA "tools") is the same as the one for Manager connectors.

Hope that helps.

By Exchange Auditing Logs, are you referring to the Exchange Management Shell Command Log in Exchange 2010 (MSExchange Management)?  I ran into this log as a problem when exchange admins were making group changes.  I was getting alerts reported to the LEM, by the DC, that group members were being added and removed by the machine account of the Exchange server.  The existing connectors on the LEM are not designed for Exchange 2010 and will not work for monitoring the Applications and Services log file "MSExchange Management".  It is being worked on, but is not yet available.  I understand that it works for Exchange 2003 and 2007.

Hey Jeffster,

Is that Exchange 2010 data you're referring to in a dedicated Event Log? Previously the data was only available in a mysterious built-in location inside of Exchange that would require us to build up some API access to get at, but if you're seeing data in an event log, that would certainly speed things up.

Yes, it's in the MSExchange Management log.  I have an open case 382639 where it is being worked on to pull two specific log entries.  There are a few other entries but the add/remove group members was the important one for us.  I hope they investigate further since you can make other AD changes from the console.  I was going to wait to see what was developed before I proceed with a feature request for full on Exchange 2010 auditing.  Weird that it's now 2012 and it hasn't come up....

Just to follow up, we're actively looking into this one - we'll add the handful of specific requests you had and look to see what else appears valuable from the data we've got.