How to get information from exchange logs?

G

grehosh2013-11-12 18:51:55

PowerShell

grehosh, 2013-11-12 18:51:55

There are logs - MSExchange Management, you need to extract information from them, process and send in the form of a letter.
The log XML is the following:
<pre>

- &lt;System&gt;
  &lt;Provider Name="MSExchange CmdletLogs" /&gt; 
  &lt;EventID Qualifiers="16384"&gt;1&lt;/EventID&gt; 
  &lt;Level&gt;4&lt;/Level&gt; 
  &lt;Task&gt;1&lt;/Task&gt; 
  &lt;TimeCreated SystemTime="2013-11-12T11:08:16.000000000Z" /&gt; 
  &lt;EventRecordID&gt;23862&lt;/EventRecordID&gt; 
  &lt;Channel&gt;MSExchange Management&lt;/Channel&gt; 
  &lt;Computer&gt;*&lt;/Computer&gt; 
  &lt;Security /&gt; 
  &lt;/System&gt;
- &lt;EventData&gt;
  &lt;Data&gt;Set-User&lt;/Data&gt; 
  &lt;Data&gt;{Phone=*, Identity=*}&lt;/Data&gt; 
  &lt;Data&gt;*&lt;/Data&gt; 
  &lt;Data&gt;SID&lt;/Data&gt; 
  &lt;Data&gt;SID&lt;/Data&gt; 
  &lt;Data /&gt; 
  &lt;Data&gt;27&lt;/Data&gt; 
  &lt;Data&gt;00:00:00.1248000&lt;/Data&gt; 
   &lt;Data /&gt; 
  &lt;Data /&gt; 
  &lt;Data /&gt; 
  &lt;/EventData&gt;
  &lt;/Event&gt;

</pre>
Previously, I pulled them out using parameters, for example - "Provider Name".
Then I created a letter and sent it.
How to extract from the numerous information - "who, when, whom"

Reply

Answer the question

In order to leave comments, you need to log in

1 answer(s)

Y

Yaroslav Eremin, 2013-11-25
@YaroslavEremin

You could state the problem more coherently.