Edge SMTP Logs show servers that use the relay?

I was asked to review the SMTP logs on Edge to determine what servers we have using the Relay?  Apparently I am supposed to be able to do this by viewing a SMTP log on Edge and it will give me IP's I can match to server names and create a little list for myself.  Anyone familiar with this?


Thanks
Twhite0909Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Nathan PSystems ArchitectCommented:
First, check that the Logging is on.. In exchange 2010, that setting is under
Exchange Management Console - Server Config - Hub Transport - Receive Connectors.

Right click the Default Receive connector and select Properties.

General Tab - Ensure the "Protocol Logging Level" is set to Verbose.

Then browse to your Exchange install directory, and look for the log files.
Typical install would put them:
C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\ProtocolLog\SmtpReceive

Then inside the log file, it looks a bit messy.  One of the early lines in the file states the type of data logged.. My file says:

#Fields: date-time,connector-id,session-id,sequence-number,local-endpoint,remote-endpoint,event,data,context

And an example line is read by applying all the field titles and applying them to the data.. (data edited for obscurity) eg:

2013-09-20T18:49:09.485Z,EXCH01\Default EXCH01,08D0725F502339BB,3,172.16.xx.xxx:25,208.86.xxx.xx:36787,<,EHLO mx1.example.com,

Which I would read as:
Received 18:49 Zulu (GMT Time) on Sept 20, by the 'default connector' from IP address 208.86.xxx.xx claiming to be called "mx1.example.com.

Hope this helps.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Twhite0909Author Commented:
OK great so I it my connector general tab shows Protocol Logging Level as NONE.  But when I browse tot eh log locations I have a log for each day for past 2 weeks. and they show similar text to what you provided above.  Does this mean it is turned on or should I still change NON to Verbose?

Thanks
0
Nathan PSystems ArchitectCommented:
Did you happen to look at the Connector tab for the receiving, and the logs for the sending, or vice versa?
0
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

Twhite0909Author Commented:
Yes on my receive connector tab under Server config- Hub Transport - Receive Convectors -I show two connectors

Client Encyprt
ServertoServer

I chose Servertoserver and saw the logs are set to NONE.

When I browse to the location on my drive for logs I have

Receive

But I do not have anything under the

Send Folder
0
Nathan PSystems ArchitectCommented:
Ok, look at the "Client Encrypt" connector.  It's logging may be set to on...?
0
Twhite0909Author Commented:
Its not but the Receive logs do show the following indicating that it seems to be turned on lol:


2013-09-16T00:29:59.411Z,EXCASHUB1\Client Encrypt EXCASHUB1,


With this being as it is can I turn the other connector to ON and just see if it begins to log text?
0
Twhite0909Author Commented:
I found it.  LOL I thought the connector was on Cashub too but I went to Edge server and found the Receive connectors and enabled Logging from there TY for your help
0
Nathan PSystems ArchitectCommented:
You're welcome.  Please mark one of my responses as answering your question!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.