babstx
asked on
Exchange 2007 Audit Logs
I used the instructions below to configure setting up Audit Logs, but when I look in event viewer under Exchange Auditing or in Application, I do not see any events when I test. Any ideas?
Launch EMC & navigate to Server Configuration -> Mailbox. Select your mailbox server, right click & select “Manage Diagnostic Logging Properties”. Drill down to MSExchangeIS -> 9000 Private.
Increase the logging level, depending upon the level of information you need & click Configure.
Launch EMC & navigate to Server Configuration -> Mailbox. Select your mailbox server, right click & select “Manage Diagnostic Logging Properties”. Drill down to MSExchangeIS -> 9000 Private.
Increase the logging level, depending upon the level of information you need & click Configure.
ASKER
I have set the logging and verified that it is correct. However, I am not seeing anything in the Event viewer when I access someone's mailbox.
I changed Folder Access to Expert. I then went into my mailbox and added another user and accessed one of their folders. When I check the event viewer, I see nothing logged.
Thank you in advance.
I changed Folder Access to Expert. I then went into my mailbox and added another user and accessed one of their folders. When I check the event viewer, I see nothing logged.
Thank you in advance.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Any other suggestions or has anyone else had this issue?
Hi,
What is the Exchange 2007 Service Pack Level? If it is Service Pack 1. Then request you to update it to Service Pack 2.
I hope this helps,
Shree
What is the Exchange 2007 Service Pack Level? If it is Service Pack 1. Then request you to update it to Service Pack 2.
I hope this helps,
Shree
ASKER
It is service pack 2.
ASKER
I restarted the message store and it began logging.
That' Good
Hi,
I was thinking my solution will be accepted as a Assisted Solution.
However i not happened.
The option of restart the Microsoft Exchange Information Store service before the changes will take effect.
Was mentioned in one of the article i provided:
http://www.msexchange.org/articles_tutorials/exchange-server-2007/compliance-policies-archiving/exchange-2007-mailbox-access-auditing-part1.html
Request the review this.
Shree
I was thinking my solution will be accepted as a Assisted Solution.
However i not happened.
The option of restart the Microsoft Exchange Information Store service before the changes will take effect.
Was mentioned in one of the article i provided:
http://www.msexchange.org/articles_tutorials/exchange-server-2007/compliance-policies-archiving/exchange-2007-mailbox-access-auditing-part1.html
Request the review this.
Shree
ASKER
I agree.
Hi babstx,
Any update on this.
Regards,
Shree
Any update on this.
Regards,
Shree
Any update on this.
Hi,
Recommend #3 - http:#a29485933
Because the second link i provide point the steps-by-step configuration of the Mailbox Access Auditing.
In that article it has been mentioned that "However the configuration is not complete yet as you must restart the Microsoft Exchange Information Store service before the changes will take effect."
You can search the above same word in the article.
Hope this should help me to get my deserving points.
----------------
Shreedhar
Recommend #3 - http:#a29485933
Because the second link i provide point the steps-by-step configuration of the Mailbox Access Auditing.
In that article it has been mentioned that "However the configuration is not complete yet as you must restart the Microsoft Exchange Information Store service before the changes will take effect."
You can search the above same word in the article.
Hope this should help me to get my deserving points.
----------------
Shreedhar
ASKER
The expert only gave links to many different articles. It would have been more helpful to have input from someone who experienced the same issue.
I realize this is a 5 yr old issue at this point...but ran in to the issue recently.
Yep the correct answer is once you have completed the change to logging, you need to restart MS Info Store service for it to apply.
http://www.msexchange.org/articles-tutorials/exchange-server-2007/compliance-policies-archiving/exchange-2007-mailbox-access-auditing-part1.html
Yep the correct answer is once you have completed the change to logging, you need to restart MS Info Store service for it to apply.
http://www.msexchange.org/articles-tutorials/exchange-server-2007/compliance-policies-archiving/exchange-2007-mailbox-access-auditing-part1.html
Refer this:
http://exchangeserverpro.com/managing-diagnostic-logging-with-exchange-server-2007
http://technet.microsoft.com/en-us/library/bb201668(EXCHG.80).aspx
I hope this helps,
Shree