R
R
revko2016-03-10 16:24:40
PowerShell
revko, 2016-03-10 16:24:40

Exchange. How to automate getting AdminAuditLog?

Good afternoon. There is a task to receive AdminAuditLog with Exchange (2013 and 2010). Ideally, this should be in real time, or at least close to it. Logs are needed for their subsequent formatting and sending to the syslog server. Now this is done by a powershell script that starts from the scheduler every 5 minutes. There are no problems with formatting and sending. What is the best way to bring the receipt of logs closer to real time and minimize the probability of losing events?
The part of the script code that implements the connection and collection of logs is presented below. But there is a possibility of loss of events.

$ServerAddress = %адрес сервера% 
$StartTime = ((Get-Date).AddMinutes(-5)).ToString() 
$session = New-PSSession 
$session = New-PSSession -configurationname Microsoft.Exchange -connectionURI http://$ServerAddress/PowerShell 
Import-PSSession $session 
$Logs=Search-AdminAuditLog -StartDate $StartTime

Answer the question

In order to leave comments, you need to log in

1 answer(s)
A
akelsey, 2016-06-09
@akelsey

Use a 3rd party app like Logbinder , or write your own...

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question