Splunk App for Exchange

[Kendo213]

Current Exchange environment:

3 node DAG
Exchange 2013
Server 2012

My issue:

I have started off with only installing the Exchange TAs on the passive node in the DAG which has a copy of all databases. Once I have a better idea of the performance impact I will install the forwarder/TAs on the remaining nodes in the DAG. It is successfully pulling some information successfully, however I am running into some problems. For example, if I open up the database overview screen, it only pulled detailed information for a single database (i.e. free space, last backup time, etc). The other 30~ databases have no detailed information (no last backup time, size, etc).

My other problem is the lack of documentation for the Exchange permissions required if you run the Splunk Universal Forwarder service as an AD service account instead of 'LocalSystem'. Is there any documentation on what Exchange permissions would be required if I choose to run it as a different service account?

[malmoore]

Hi,

In order to get information from all of the databases, you need to install UF on all of the DAGs. The active DAG node has the databases mounted; the scripts are smart enough to determine this and will not cause issues on the passive nodes.

With regards to using AD service accounts for the Exchange app, it's best to use the Local System account, because using AD service accounts is a fairly significant security risk. If you have to use an AD service account, that account must, at a minimum:

• Be a local administrator, and
• Be an Exchange administrator, and
• Have service rights to every Exchange mailbox.

Hope this helps.