Microsoft Exchange

• What is Discovered and Monitored
• Event Types
• Reports
• Configuration
• Collecting Microsoft Exchange Message Track Logs
• Settings for Access Credentials
• Sample Logs

What is Discovered and Monitored

Protocol	Information discovered	Metrics collected	Used for
Protocol	Information discovered	Metrics collected	Used for
SNMP	Application type	Process level CPU and memory utilization for the various exchange server processes	Performance Monitoring
WMI	Application type, service mappings	Process level metrics: uptime, CPU utilization, Memory utilization, Read I/O KBytes/sec, Write I/O KBytes/sec for the various exchange server processes	Performance Monitoring
		Exchange performance metrics (: VM Largest Block size, VM Large Free Block Size, VM Total Free Blocks, RPC Requests, RPC Request Peak, RPC Average Latency, RPC Operations/sec, User count, Active user Count, Peak User Count, Active Connection Count, Max Connection Count Exchange error metrics (obtained from Win32_PerfRawData_MSExchangeIS_MSExchangeIS WMI class): RPC Success, RPC Failed, RPC Denied, RPC Failed - Server Busy, RPC Failed - Server Unavailable, Foreground RPC Failed, Backgorund RPC Failed Exchange mailbox metrics (obtained from Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox and Win32_PerfRawData_MSExchangeIS_MSExchangeISPublic WMI classes): Per Mailbox: Send Queue, Receive Queue, Sent Message, Submitted Message, Delivered Message, Active User, Peak User
		Exchange SMTP metrics (obtained from Win32_PerfRawData_SMTPSVC_SMTPServer WMI class): Categorization Queue, Local Queue, Remote Queue, Inbound Connections, Outbound Connections, Sent Bytes/sec, Received Bytes/sec, Retry Count, Local Retry Queue, Remote Retry Queue Exchange ESE Database (Win32_PerfFormattedData_ESE_MSExchangeDatabase): Exchange Database Instances (Win32_PerfFormattedData_ESE_MSExchangeDatabaseInstances):
		Exchange Mail Submission Metrics (Win32_PerfFormattedData_MSExchangeMailSubmission_MSExchangeMailSubmission): Exchange Replication Metrics (Win32_PerfFormattedData_MSExchangeReplication_MSExchangeReplication): Exchange Store Interface Metrics (Win32_PerfFormattedData_MSExchangeStoreInterface_MSExchangeStoreInterface): Exchange Transport Queue Metrics (Win32_PerfFormattedData_MSExchangeTransportQueues_MSExchangeTransportQueues):
Windows Agent		Application Logs, Microsoft Exchange Message Tracking Logs	Security Monitoring and Compliance

Event Types

In ADMIN > Device Support > Event Types, search for "microsoft exchange" to see the event types associated with this device.

Reports

In RESOURCES > Reports, search for "microsoft exchange" in the main content panel Search... field to see the reports associated with this application or device.

Configuration

• SNMP

• WMI

SNMP

See SNMP Configurations in the Microsoft Windows Server Configuration section.

WMI

See WMI Configurations in the Microsoft Windows Server Configuration section.

Settings for Access Credentials

See Setting Access Credentials in the Microsoft Windows Server Configuration section.

Collecting Microsoft Exchange Message Track Logs

To configure Microsoft Exchange to log message tracking on a Microsoft Exchange Server, take the following steps.

Note: General Windows Agent configuration information can be found here.

1. Locate where your Microsoft Exchange log files reside. Typically, this path is:

   C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking\MSGTRKM*.log

2. Install the FortiSIEM Windows Server Agent on the Microsoft Exchange Server.

3. Configure a new Windows Agent Monitor Template by taking the following steps in FortiSIEM.

   1. Navigate to Admin > Setup > Windows Agent.

   2. Under Windows Agent Monitor Templates, click New.

   3. In the Generic tab, in the Name field, enter a name for the Windows Agent Monitor Template.

   4. Select the User Log tab, then and click New.

   5. In the Full File Name field, enter the path to your Microsoft Exchange Server logs. For example, for a typical Exchange Server, the path would be:
      

      C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking\MSGTRKM*.log

   6. In the Log Prefix field, enter "ExchTrackLog".

   7. Click Save to save the configuration.

   8. Click Save to save the Windows Agent Monitor Template.

4. Configure a Host to Template Association to associate the template with the Exchange Server agent by taking the following steps.

   1. Under Hosts To Template Associations, click New.

   2. In the Name field, enter the name for the Hosts to Template Associations.

   3. Select an Organization with a collector.

   4. Select a Host.

   5. Select the Windows Agent Monitor Template you created earlier.

   6. Select a Collector or Select All.

   7. Click Save.

   8. Under Hosts to Template Associations, click Apply.

Sample Logs

2017-10-05T12:06:00Z EXCH99.foo.com 192.0.2.0 AccelOps-WUA-UserFile-ExchangeTrackLog [monitorStatus]="Success" [Locale]="en-US" [MachineGuid]="d78e4bd5-bc3f-4950-bcdf-926947ee1db7" [timeZone]="+0300" [fileName]="C:\\Program Files\\Microsoft\\Exchange Server\\V15\\TransportRoles\\Logs\\MessageTracking\\MSGTRKMS2017100512-1.LOG" [msg]="2017-10-05T12:05:56.564Z,ffff::eeee:aaaa:bbbb:cccc:dddd%13,EXCH99,,EXCH99.foo.com,\"MDB:d72c63cf-290e-456e-86e5-85dedb1f56de, Mailbox:d7c8c416-c1a7-4225-a17f-552d5274703d, Event:4419662, MessageClass:IPM.Note.ProbeMessage.MBTSubmissionServiceHeartbeatProbe, CreationTime:2017-10-05T12:05:56.267Z, ClientType:Monitoring, SubmissionAssistant:MailboxTransportSubmissionEmailAssistant\",,STOREDRIVER,SUBMIT,,<e545b612256a4c14a563f78a8999fafd@user.example.com>,0a21180c-5932-4c7e-3888-08d50be96f34,HealthMailbox66dd83eddb9b4ee69dbd3fa82c925a3b@user.example.com,,,1,,,00000052-0000-0000-0000-0000ea5a2141-MBTSubmissionServiceHeartbeatProbe,HealthMailbox66dd83eddb9b4ee69dbd3fa82c925a3b@user.example.com,,2017-10-05T12:05:56.267Z;LSRV=EXCH99.foo.com:TOTAL-SUB=0.296|SA=0.078|MTSS=0.209(MTSSD=0.209(MTSSDA=0.005|MTSSDC=0.005|SDSSO=0.161(SMSC=0.020|SMS=0.140)|X-MTSSDPL=0.004|X-MTSSDSS=0.008|MTSSDSDS=0.001)),Originating,,,,S:ItemEntryId=00-00-00-00-ED-99-60-31-E3-76-3C-4B-BE-FE-5B-27-F0-88-3D-0A-07-00-25-D5-0C-8E-46-5A-51-46-A4-18-7D-65-F7-DF-52-1C-00-00-00-00-01-0B-00-00-25-D5-0C-8E-46-5A-51-46-A4-18-7D-65-F7-DF-52-1C-00-00-30-88-0D-FF-00-00,Email,92e0d0ab-4670-41e9-d453-08d50be96f50,15.01.0845.034"