How to identify non-exchange servers and devices that relay through Exchange 2007

annayeg used Ask the Experts™
Hi all,

Is there a way I can identify which non-exchange servers and devices are relaying through Exchange?  IS there a log file I can check?

We have exchange 2007 sp3.  We have a receive connector for Allow relay (non-exchange service only)  but the exchange admin previously added all the subnets (e.g.,

How can we identify these servers that are relaying to exchange?

Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
You need to turn on SMTP logging, then pull the logs out and look. Even though they have .log file extensions, they're CSV format.

So copy off the log file, rename it to CSV, open in a spreadsheet app (Excel, for example). Delete a bunch of columns you don't need. (These exist because in Ex2007, there's "logging off" or "verbose logging" - not like in 2003 where you could pick and choose the fields.) I think the only columns you really need are date-time and Client IP (might be labeled c-ip, I forget). There might be a Client Hostname column that could be useful.

Now do a "remove duplicates" on the Client IP column, expanding the selection to all columns so the date-time stay in the right place. Bam, there's all the devices that have been connecting to SMTP on that server. You can eliminate the lines which are other Exchange servers, since they need to talk with SMTP.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial