Exchange 2010 - See IP Of OWA Login

[Fazza]

I'm trying to establish if an email was sent from a students email address via OWA on Exchange 2010 - either internally or externally. I know the IP address of logons are stored in the IIS logs so I need some help in extracting the information I need in to a CSV file please!

 

 

I've gotten the W3SVC1 logs from exchange. I have downloaded, installed and used LogParser to merge all the log files in to a single log file called merge.log but none of the commands I can find to extract the information I need work!

 

 

LogParser "SELECT date, time, c-ip, cs-uri-stem, cs(User-Agent) FROM c:\w3svc1\mergedlog\merge.log TO Output.csv WHERE cs-uri-stem LIKE '%Username%'"

 

When I run this command it just says Syntax Error: unknown field type 'date'

 

Anybody successfully done this - if so what command did you use?

[mukz]

I'm trying to establish if an email was sent from a students email address via OWA on Exchange 2010 - either internally or externally. I know the IP address of logons are stored in the IIS logs so I need some help in extracting the information I need in to a CSV file please!

 

 

I've gotten the W3SVC1 logs from exchange. I have downloaded, installed and used LogParser to merge all the log files in to a single log file called merge.log but none of the commands I can find to extract the information I need work!

 

 

LogParser "SELECT date, time, c-ip, cs-uri-stem, cs(User-Agent) FROM c:\w3svc1\mergedlog\merge.log TO Output.csv WHERE cs-uri-stem LIKE '%Username%'"

 

When I run this command it just says Syntax Error: unknown field type 'date'

 

Anybody successfully done this - if so what command did you use?

 

"SELECT date, time, c-ip, cs-uri-stem, cs-username, cs(User-Agent), cs-uri-query FROM (logfile) TO c:\temp\Output.csv WHERE cs-username LIKE '%username%'"

 

got this from a colleague at one of our sister schools.

Edited December 16, 2016 by mukz

[Fazza]

"SELECT date, time, c-ip, cs-uri-stem, cs-username, cs(User-Agent), cs-uri-query FROM (logfile) TO c:\temp\Output.csv WHERE cs-username LIKE '%username%'"

 

got this from a colleague at one of our sister schools.

 

The first 2 words in your text are the same as what I'm typing and it's that, that it's failing on.

 

Syntax Error: Unknown field 'date'

 

Edited December 16, 2016 by Fazza

[mukz]

Thats weird! He did it and worked on his one! Sorry Fazza i couldn't be of more help.

[ITGURU]

If your using on-site exchange, from the recipients mailbox, open the email, go into the message properties and at the bottom of the header it should have originating Ip:

do an nslookup on this to get the pc name.

I then view the pc logs and see who was logged on at that time.

 

its how we catch the devils logging on to each others emails even though logged onto the computer as themselves.