Getting Data In

Onboarding local MS Exchange Server with audit and activity data like O365?

ojay
Path Finder

Hi all,

i have already integrated O365 using the O365 management API and collecting the user, admin, system, and policy actions and events for O365

https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api...

I want to collect similar data from a local exchange server now but I don't know the logs. 

The Splunk Add-on for Microsoft Exchange collects the following data using scripted inputs:

  • Senderbase/reputation data. , Topology and Health information and Mailbox Server health and usage information

Is there even similar data on a local MS exchange? and is that data no possible to be collected with a UF?

Any help to direct me in the right direction would help.

Best,

N.

Labels (3)
0 Karma

aokur_splunk
Splunk Employee
Splunk Employee

Older question - but this still came up as a hit on my search results while trying to help another customer, so this might be useful here.

You have to run (or let the splunk agent run and manage) the monitors and scripts responsible for monitoring exchange related logs. To start - I would locally (like to your laptop) download the Add-On, https://splunkbase.splunk.com/app/3225

From there, explore the inputs.conf configurations available in the subdirectories. These define what is to be collected. If you notice, there are a ton of inputs available. These are set to OFF by default. Let's take a look at one of them under \TA-Windows-Exchange-IIS\default\inputs.conf

####Exchange Server Version 2010 - Start####

[monitor://C:\Program Files\Microsoft\Exchange Server\V14\Logging\Ews]
whitelist=\.log$|\.LOG$
sourcetype=MSWindows:2010EWS:IIS
queue=parsingQueue
index=msexchange
disabled=true
initCrcLength=8192

The monitor stanza is defining the location of the path - so in this case, the files are stored in that file path (...\logging\EWS). The whitelist/allowist statement specifies that all files in that directory ending in .log or .LOG are to be allowed. The 'disabled' statement is currently set to false, as per the default. 

To get this working, copy this stanza to a /local/inputs.conf directory, change disabled to '=false' and deploy to the machine that is running exchange. You will need a a UF, or Heavy Forwarder or some other way to getting data to splunk indexers.

Use a similar process for the many other inputs you have available.  Do not turn on all inputs unless you really need them and have done capacity planning as it can be a lot of volume. 

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...