Answer the question
In order to leave comments, you need to log in
Exchange. How to automate getting AdminAuditLog?
Good afternoon. There is a task to receive AdminAuditLog with Exchange (2013 and 2010). Ideally, this should be in real time, or at least close to it. Logs are needed for their subsequent formatting and sending to the syslog server. Now this is done by a powershell script that starts from the scheduler every 5 minutes. There are no problems with formatting and sending. What is the best way to bring the receipt of logs closer to real time and minimize the probability of losing events?
The part of the script code that implements the connection and collection of logs is presented below. But there is a possibility of loss of events.
$ServerAddress = %адрес сервера%
$StartTime = ((Get-Date).AddMinutes(-5)).ToString()
$session = New-PSSession
$session = New-PSSession -configurationname Microsoft.Exchange -connectionURI http://$ServerAddress/PowerShell
Import-PSSession $session
$Logs=Search-AdminAuditLog -StartDate $StartTime
Answer the question
In order to leave comments, you need to log in
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question