Solved

get-logonstatistics on Exchange 2010 not showing IP Address.

Posted on 2015-02-08
8
1,049 Views
Last Modified: 2015-02-09
Exchange Server 2010 SP3 RU8 Enterprise 64 bit
Windows 2008 R2 Server 64 bit

run this (this is what I ran on Exchange 2007)

get-logonstatistics myuser | sort-object clientipaddress | format-table username,clientipaddress,logontime,clientversion >c:\util\logon.txt

No client ip address appears

UserName                      ClientIPAddress               LogonTime                     ClientVersion
--------                                    ---------------                        ---------                             -------------
myuser                                                               2/3/2015 3:03:51 PM           3587.0.32992.2
myuser                                                               2/4/2015 3:09:13 PM           3587.0.32992.2
myuser                                                               2/3/2015 3:03:51 PM           3587.0.32992.2
myuser                                                               2/3/2015 3:03:51 PM           3587.0.32992.2
myuser                                                               2/3/2015 3:04:35 PM           3587.0.32992.2


I have this in my registry

3.Locate and then click the following registry subkey:
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\CancelRPC
Note If the CancelRPC key does not exist, create this key. To do this, follow these steps: •Click to select the Outlook subkey.
•On the Edit menu, point to New, and then click Key.
•Type CancelRPC, and then press ENTER.
•Select the CancelRPC subkey, and then go to step 4.

4.On the Edit menu, point to New, and then click DWORD Value.
5.Type EnablePerfTracking, and then press ENTER.
6.On the Edit menu, click Modify.
7.Type 28, and then click OK.

But then I found this

Exchange 2010


The above steps do not work for Exchange 2010. However, you can obtain client IP information from the log files in the following folder on your Client Access Server (CAS).


\Program Files\Microsoft\Exchange Server\v14\Logging\RPC Client Access

The log files are named RCA_date-#.log (where date is the date the log was collected and # is an index number starting at 1). This logging is enabled by default, so you should not have to make any configuration changes to collect this information.


I reviewed some of those log files and did not see the ip address yes possible I was not looking at the correct lines.


Does anyone have a example of how to report this information now?  Powershell script  example would be great.

I do have Logparser 2,2 installed any example of that ?

Thanks in advance
0
Comment
Question by:Thomas Grassi
  • 4
  • 4
8 Comments
 
LVL 4

Accepted Solution

by:
Praveen Kumar Bonala earned 500 total points
ID: 40597081
Please check following link and let me know the status:

http://msexchangeguru.com/2012/12/06/find-device-ip/
0
 
LVL 23

Author Comment

by:Thomas Grassi
ID: 40597183
Praveen

I saw that link before thanks

Just installed Advance Logging on IIS 7

How long before the logs start building in the advance Log folder?

Still looking for a report I can run to show the ip address of my clients.
0
 
LVL 4

Expert Comment

by:Praveen Kumar Bonala
ID: 40597191
You can check immediately..
0
 
LVL 23

Author Comment

by:Thomas Grassi
ID: 40597220
Sorry no logs collected as of yet been almost 1 hour now.


Do I need to restart IIS?

The instructions you posted did not say you needed to restart IIS

Also I tried logging on as a client from closing outlook and starting again

Also tried using web mail

My iphone also

No logs entries yet
0
Do email signature updates give you a headache?

Do you feel like all of your time is spent managing email signatures? Too busy to visit every user’s desk to make updates? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today!

 
LVL 4

Expert Comment

by:Praveen Kumar Bonala
ID: 40597403
Restart not required,
It should create logs with out restarting IIS, please cross check once that you have enabled advanced logging option.
if same problem persist try with restarting the IIS.
0
 
LVL 23

Author Closing Comment

by:Thomas Grassi
ID: 40597436
Praveen

I had to restart IIS

After restarting IIS the advancedlog file appeared with the starting records.

Will start to see client records soon I hope.

Thanks for this..

Still need a report any Logparser examples for this log file?
0
 
LVL 4

Expert Comment

by:Praveen Kumar Bonala
ID: 40597574
0
 
LVL 23

Author Comment

by:Thomas Grassi
ID: 40599599
Praveen

My logs are creating files but I see no data in the logs


#Software: IIS Advanced Logging Module
#Version: 1.0
#Start-Date: 2015-02-09 03:43:42.579
#Fields:  date time cs-uri-stem cs-uri-query s-contentpath sc-status s-computername cs(Referer) sc-win32-status sc-bytes cs-bytes X-Forwarded-For cs-username c-ip





Any thoughts?
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

We are happy to announce a brand new addition to our line of acclaimed email signature management products – CodeTwo Email Signatures for Office 365.
Local Continuous Replication is a cost effective and quick way of backing up Exchange server data. The following article describes the steps required to configure Local Continuous Replication. Also, the article tells you how to restore from a backup…
In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now