All Apps and Add-ons

Splunk App for Exchange

Kendo213
Communicator

Current Exchange environment:

3 node DAG
Exchange 2013
Server 2012

My issue:

I have started off with only installing the Exchange TAs on the passive node in the DAG which has a copy of all databases. Once I have a better idea of the performance impact I will install the forwarder/TAs on the remaining nodes in the DAG. It is successfully pulling some information successfully, however I am running into some problems. For example, if I open up the database overview screen, it only pulled detailed information for a single database (i.e. free space, last backup time, etc). The other 30~ databases have no detailed information (no last backup time, size, etc).

My other problem is the lack of documentation for the Exchange permissions required if you run the Splunk Universal Forwarder service as an AD service account instead of 'LocalSystem'. Is there any documentation on what Exchange permissions would be required if I choose to run it as a different service account?

0 Karma

malmoore
Splunk Employee
Splunk Employee

Hi,

In order to get information from all of the databases, you need to install UF on all of the DAGs. The active DAG node has the databases mounted; the scripts are smart enough to determine this and will not cause issues on the passive nodes.

With regards to using AD service accounts for the Exchange app, it's best to use the Local System account, because using AD service accounts is a fairly significant security risk. If you have to use an AD service account, that account must, at a minimum:

  • Be a local administrator, and
  • Be an Exchange administrator, and
  • Have service rights to every Exchange mailbox.

Hope this helps.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...