All Apps and Add-ons

MSExchange Protocol Logs

nick405060
Motivator

Has anyone been able to ingest and parse out protocol logs? I see that there's two perfmon stanzas for them in TA-Exchange-Mailbox but I don't want perfmon, and also nothing is ingested when I enable those.

1 Solution

nick405060
Motivator

I asked this question so that I could answer it and post my solution for the community. Here's what I did:

In TA-Exchange-Mailbox's inputs.conf, I added these two stanzas right after my MessageTracking stanza and pushed out from my DS to the EX servers:

[monitor://E:\Exchange Server\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive]
whitelist=\.log$|\.LOG$
time_before_close = 0
sourcetype=MSExchange:2013:SmtpReceive
queue=parsingQueue
index=msexchange
disabled=false

[monitor://E:\Exchange Server\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpSend]
whitelist=\.log$|\.LOG$
time_before_close = 0
sourcetype=MSExchange:2013:SmtpSend
queue=parsingQueue
index=msexchange
disabled=false

and then on my SH props.conf:

[MSExchange:2013:SmtpReceive]
EXTRACT-smtpreceive = (?<date_time>[\s\S]*?),(?<connector_id>[\s\S]*?),(?<session_id>[\s\S]*?),(?<sequence_number>[\s\S]*?),(?<local_endpoint>[\s\S]*?),(?<remote_endpoint>[\s\S]*?),(?<event>[\s\S]*?),(\"(?<data1>[\s\S]*?)\",(?<context1>[\s\S]*)|(?<data2>[\s\S]*?),(?<context2>[\s\S]*))
EVAL-data=if(isnull(data1),data2,data1)
EVAL-context=if(isnull(context1),context2,context1)

[MSExchange:2013:SmtpSend]
EXTRACT-smtpsend = (?<date_time>[\s\S]*?),(?<connector_id>[\s\S]*?),(?<session_id>[\s\S]*?),(?<sequence_number>[\s\S]*?),(?<local_endpoint>[\s\S]*?),(?<remote_endpoint>[\s\S]*?),(?<event>[\s\S]*?),(\"(?<data1>[\s\S]*?)\",(?<context1>[\s\S]*)|(?<data2>[\s\S]*?),(?<context2>[\s\S]*))
EVAL-data=if(isnull(data1),data2,data1)
EVAL-context=if(isnull(context1),context2,context1)

You could write the regex better so you don't have to eval, but unfortunately when I tried to use (?J) to extract data and context (conditionally accepting both quotations and no quotations), https://answers.splunk.com/answers/442008/has-anyone-else-come-across-unexpected-behavior-us.html happened.

Cheers,

Nick

View solution in original post

nick405060
Motivator

I asked this question so that I could answer it and post my solution for the community. Here's what I did:

In TA-Exchange-Mailbox's inputs.conf, I added these two stanzas right after my MessageTracking stanza and pushed out from my DS to the EX servers:

[monitor://E:\Exchange Server\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive]
whitelist=\.log$|\.LOG$
time_before_close = 0
sourcetype=MSExchange:2013:SmtpReceive
queue=parsingQueue
index=msexchange
disabled=false

[monitor://E:\Exchange Server\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpSend]
whitelist=\.log$|\.LOG$
time_before_close = 0
sourcetype=MSExchange:2013:SmtpSend
queue=parsingQueue
index=msexchange
disabled=false

and then on my SH props.conf:

[MSExchange:2013:SmtpReceive]
EXTRACT-smtpreceive = (?<date_time>[\s\S]*?),(?<connector_id>[\s\S]*?),(?<session_id>[\s\S]*?),(?<sequence_number>[\s\S]*?),(?<local_endpoint>[\s\S]*?),(?<remote_endpoint>[\s\S]*?),(?<event>[\s\S]*?),(\"(?<data1>[\s\S]*?)\",(?<context1>[\s\S]*)|(?<data2>[\s\S]*?),(?<context2>[\s\S]*))
EVAL-data=if(isnull(data1),data2,data1)
EVAL-context=if(isnull(context1),context2,context1)

[MSExchange:2013:SmtpSend]
EXTRACT-smtpsend = (?<date_time>[\s\S]*?),(?<connector_id>[\s\S]*?),(?<session_id>[\s\S]*?),(?<sequence_number>[\s\S]*?),(?<local_endpoint>[\s\S]*?),(?<remote_endpoint>[\s\S]*?),(?<event>[\s\S]*?),(\"(?<data1>[\s\S]*?)\",(?<context1>[\s\S]*)|(?<data2>[\s\S]*?),(?<context2>[\s\S]*))
EVAL-data=if(isnull(data1),data2,data1)
EVAL-context=if(isnull(context1),context2,context1)

You could write the regex better so you don't have to eval, but unfortunately when I tried to use (?J) to extract data and context (conditionally accepting both quotations and no quotations), https://answers.splunk.com/answers/442008/has-anyone-else-come-across-unexpected-behavior-us.html happened.

Cheers,

Nick

itradeclayton
Path Finder

Am wondering if this would be better placed in TA-Exchange-HubTransport...

0 Karma

nick405060
Motivator

It very well might be, yeah.

0 Karma

itradeclayton
Path Finder

Either way, thanks for this. It came in handy!

Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...