Why are we not getting any message tracking logs using Splunk 6.1.3 and the Splunk App for Microsoft Exchange 3.0.1?

[edwardrose]

Hello All

We are not getting any message tracking logs and we are using Exchange App 3.0.1

Here is our stanza:

[monitor://C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\MessageTracking]
disabled=true

[monitorNoHandle://E:\Exchange\Logs\MessageTracking]
whitelist=\.log$|\.LOG$
sourcetype=MSExchange:2010:MessageTracking
queue=parsingQueue
index=msexchange
disabled=false

I am not sure what we are missing. Any help would be greatly appreciated.

thanks
ed

[ahall_splunk · Accepted solution]

The monitorNoHandle type will only monitor single files (see http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories#Why_use_MonitorNo... ) - use monitor instead.

[edwardrose]

I have changed it to the following:

[monitor://C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\MessageTracking]
disabled=true

[monitor://E:\Exchange\Logs\MessageTracking]
whitelist=\.log$|\.LOG$
sourcetype=MSExchange:2010:MessageTracking
queue=parsingQueue
index=msexchange
disabled=false

How long should it be before the servers start sending the message data? We had changed it to monitorNoHandle based on the Splunk PS engagement we had. I took his word for everything. I guess I should go back through and double check all the settings 🙂

[ahall_splunk]

Once the universal forwarder is restarted, it should be fairly quickly. Your internal logs are your friend here, Check index=_internal source=*splunkd.log to check for any errors.