Exchange 2010 Inputs Assist

[tgiles]

Hi, all.

I was asked to get Exchange logs from an Exchange 2010 cluster going to Splunk. I've installed a forwarder on all four members of the cluster and started looking at the Exchange app (available for download from splunk-base).

From what I can tell from the app (and from other posts on splunk-base) there should be a "Exchange Auditing" Windows event log I can point Splunk to. Unfortunately, I don't see that anywhere. The closest I see might be "MSExchange Management", but it's not really showing me a lot of data.

I also notice there's a "C:\Program Files\Microsoft\Exchange Server\V14\Logging" directory on the systems that seem to have quite a bit I'll be interested in, but unfortunately nothing mentioning Exchange Auditing.

So, what inputs would you recommend I setup in my Splunk forwarders to pull exchange audit logs? Pointing me to the relevant documentation (if available) would be awesome, or input from anyone who's performed this sort of setup would be great.

Thanks,

tom

[ahall_splunk · Accepted solution]

You need to enable Exchange auditing. Unfortunately, it isn't available on Exchange 2010. I will be addressing this in the next release of the Splunk App for Microsoft Exchange.

[piebob]

this doesn't directly answer your question, but there is a Splunk app for Exchange:
http://splunk-base.splunk.com/apps/28976/splunk-app-for-microsoft-exchange

it's a free app. the documentation for it is here:
http://docs.splunk.com/Documentation/MSExchange/latest/DeployMSX/AboutSplunkforMicrosoftExchange