IIS Log on my Exchange 2010 server is Filling up with entries from my Office and Home Mac machines

my IIS Log on my Exchange 2010 server is Filling up with entries from my Office and Home Mac machines.
Both Macs are using Outlook 2016, latest updates.

There are a couple other User using Macs with the same version and they don't show up in the log like that.
The Log files are averaging 1.8GB a day and 99% of them are entries from my 2 Machines.


Here are the Log entries:
2018-04-23 10:27:39 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 14
2018-04-23 10:27:39 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 10
2018-04-23 10:27:39 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Home Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 23
2018-04-23 10:27:39 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 10
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 8
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Home Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 22
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 9
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 9
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 10
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Home Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 20
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 11
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 9
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Home Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 18
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 11
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 9
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Home Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 19
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 10
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 18
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 11
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Home Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 40
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 12
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 13
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Home Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 27
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 8
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 11
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 8
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Home Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 19
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 11
2018-04-23 10:27:40 <On-Prem-Server-IP> POST /autodiscover/autodiscover.xml - 443 <AD Username> <Office Mac IP> AppleExchangeWebServices/287.4.1+accountsd/113 200 0 0 

Open in new window

LVL 3
Scott TownsendIT DirectorAsked:
Who is Participating?
 
timgreen7077Connect With a Mentor Exchange EngineerCommented:
The strange this is all the connections show code 200 so the connections are successful. I don't know anything about MACs so it may be something with how they are connecting with that AppleExchangeWebServices. This is something i just read on that:

Exchange Web Services (EWS) is a newer data synchronization protocol that seamlessly syncs SmarterMail messages, contacts and calendars with Apple Mail, iCal and Address Book. NOTE: Before you can configure a mailbox to sync using the Exchange Web Services technology, you must activate the Exchange Web Services add-on.

Not sure if you are syncing other Apple items success ical and address book or other things like the quote mentioned. that may be what's causing this.
0
 
timgreen7077Exchange EngineerCommented:
I can't tell whats home and whats on-prem, but its not uncommon for IIS logs to grow because it's based on what every activity for Web services are being utilized. If you only have 1 CAS server and all the connections are going to that  CAS then you can expect alot of logs growth, also you may be a more active user with mobile devices, active sync connections, or autodiscover connections from your home PC. Its safe to delete these logs. The logs will just continue to grow, so I would suggest only keeping a select number of days. I only keep the logs for 15 days personally.
0
 
Scott TownsendIT DirectorAuthor Commented:
Of the 1.8gb log file, then entries in it are mostly (99%) my 2 machines.
We have 95 users that all have phones and tablets that are also connected to the sever.

My Home mac isn't doing anything special, just logged in and outlook running in the background.

I didn't want to mention this to muddy the waters,but this has been going on and only getting worse for the past 2.5 years.  And here is the interesting part.... in the past month I migrated my mailbox to the cloud. The entries in the log are from my outlook clients talking to the on-Prem server. My outlook is setup to talk to the office 365 server. So I'm not sure why my outlook is querying Autodiscover so many times in a single minute.

I was thinking it's trying to access other users calendar data? But still others have other calendars mounted too and they are not anywhere close to the quantity that I'm in the log.

I was hoping the log entries might give a clue as to what it's asking for. Why would it need to talk to Autodiscover so often?
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
timgreen7077Exchange EngineerCommented:
Does everyone use a MAC or just you?
0
 
Scott TownsendIT DirectorAuthor Commented:
Out of the 95, there are maybe 7 of us that use a Mac to talk to the exchange server.

I can see if I can make sure that the calendar and contact apps on the Mac are not causing it. Since there are soooo many in a minute it should be easy to tell. (-;

Thanks
0
 
timgreen7077Exchange EngineerCommented:
sounds good
0
 
Scott TownsendConnect With a Mentor IT DirectorAuthor Commented:
Couple things to note:

accountsd in the Log Message is the Process that is on the Mac that is making the Connection.
On the Mac Preferences there is a Internet Accounts section. I removed it and the Logs were still there.
I then manually killed the accountsd process and the log messages stopped.  It eventually restarted on its own.

I ran the Following command to verify the connection to the mail server:
sudo lsof -i -n -P | grep <IP Address of Mail Server>

Open in new window


I recreated the Exchange Internet Account for my Exchange account and then ran all of the local Mac Apps (Notes, Calendar, Contacts, Reminders) as well as outlook and then looked at the log again.  There were no more of the Above log entries.  

So it must of been a corrupt entry for the Internet Account for the Exchange server?  I recall these messages prior to Migrating to Office 365, though Its possible they were different and the Internet Accounts didn't know how to Change the Settings to the O365 Server like Outlook did.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.