Exchange 2007 Audit Logs

I used the instructions below to configure setting up Audit Logs, but when I look in event viewer under Exchange Auditing or in Application, I do not see any events when I test.  Any ideas?

Launch EMC & navigate to Server Configuration -> Mailbox. Select your mailbox server, right click & select “Manage Diagnostic Logging Properties”. Drill down to MSExchangeIS -> 9000 Private.
Increase the logging level, depending upon the level of information you need & click Configure.
babstxAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
babstxAuthor Commented:
I have set the logging and verified that it is correct.  However, I am not seeing anything in the Event viewer when I access someone's mailbox.

I changed Folder Access to Expert.  I then went into my mailbox and added another user and accessed one of their folders.  When I check the event viewer, I see nothing logged.

Thank you in advance.
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
babstxAuthor Commented:
Any other suggestions or has anyone else had this issue?
0
 
Shreedhar EtteCommented:
Hi,

What is the Exchange 2007 Service Pack Level? If it is Service Pack 1. Then request you to update it to Service Pack 2.

I hope this helps,
Shree
0
 
babstxAuthor Commented:
It is service pack 2.
0
 
babstxAuthor Commented:
I restarted the message store and it began logging.
0
 
Shreedhar EtteCommented:
That' Good
0
 
Shreedhar EtteCommented:
Hi,

I was thinking my solution will be accepted as a Assisted Solution.

However i not happened.

The option of restart the Microsoft Exchange Information Store service before the changes will take effect.

Was mentioned in one of the article i provided:
http://www.msexchange.org/articles_tutorials/exchange-server-2007/compliance-policies-archiving/exchange-2007-mailbox-access-auditing-part1.html

Request the review this.
Shree
0
 
babstxAuthor Commented:
I agree.
0
 
Shreedhar EtteCommented:
Hi babstx,

Any update on this.

Regards,
Shree
0
 
Shreedhar EtteCommented:
Any update on this.
0
 
Shreedhar EtteCommented:
Hi,

Recommend #3 - http:#a29485933

Because the second link i provide point the steps-by-step configuration of the Mailbox Access Auditing.

In that article it has been mentioned that "However the configuration is not complete yet as you must restart the Microsoft Exchange Information Store service before the changes will take effect."

You can search the above same word in the article.

Hope this should help me to get my deserving points.

----------------
Shreedhar
0
 
babstxAuthor Commented:
The expert only gave links to many different articles.  It would have been more helpful to have input from someone who experienced the same issue.
0
 
CoffeeBlackCommented:
I realize this is a 5 yr old issue at this point...but ran in to the issue recently.

Yep the correct answer is once you have completed the change to logging, you need to restart MS Info Store service for it to apply.

http://www.msexchange.org/articles-tutorials/exchange-server-2007/compliance-policies-archiving/exchange-2007-mailbox-access-auditing-part1.html
0
All Courses

From novice to tech pro — start learning today.