Security Compliance

How to create a Microsoft Exchange message tracking connector in SEM

This article describes how to create a Microsoft Exchange message tracking connector in Log and Event manager to track all mail and message activity on your Exchange server.

First published date

11/7/2018 6:48 PM

Last published date

11/7/2018 6:48 PM

Overview

This article describes how to create a Microsoft Exchange Message Tracking connector in the Security Event Manager (formerly Log & Event Manager) so you can to track all mail and message activity on the Exchange server.

Product section

Security Event Manager

Resolution

  1. Navigate to your Message Tracking directory on your Microsoft Exchange server.
  2. Locate the log files that begin with MSGTRK or MSGTRKMD, as shown below.
  3. Log in to Security Event Manager as an administrator.
  4. Create two new connectors that connect to the log files with the MSGTRK or MSGTRKMD (Mailbox server) prefixes. This allows you to track all mail and message activity on the Exchange server.

    Message Tracking log files use the following naming convention: MSGTRKServiceyyyymmdd-nnn.log. MSGTRAK files are log files for the Transport service. MSGTRKMD files are log files for messages delivered to mailboxes by the Mailbox Transport Delivery service.

    Below is an example of a connector for the MSGTRK2 log file that displays in the SEM Console.

     


    An alternative example in the SEM Events Console:


    Learn more about configuring connectors in the SEM Events Console here.