Email servers are under constant attack from a variety of sources, so it's important to be proactive about email security. One way of doing so is to enable protocol logging for Exchange Server.
Protocol logging lets you see the commands that clients are sending to your Exchange server. If you detect suspicious SMTP, NNTP or HTTP traffic patterns, you can take action before they become a problem. Protocol logs are also an excellent forensic tool for analyzing attacks that occur without warning or detection.
Protocol logging caveats
Enabling SMTP and NNTP protocol logging
By default, your log files will be saved to the C:\WINDOWS\System32\LogFiles folder on the server that's being monitored.
Other logging options
The W3C Extended Log File Format is not the only format available to you. You also have the option of using the Microsoft IIS Log File Format, the NCSA Common Log File Format and ODBC Logging.
The Microsoft IIS Log File Format and the NCSA Common Log File Format are both ASCII log file formats similar to the W3C Extended Log File Format. Given a choice among them, you are usually best off using the W3C Extended Log File Format (unless you have a compelling reason to use one of the other formats). It offers the highest level of logging detail.
The ODBC Logging File Format is completely different from the other three log file formats. It allows you to insert log data into a SQL Server or Microsoft Access database. This allows you to perform complex queries against the database and more easily find specific information within the logs.
To continue reading for free, register below or login
To read more you must become a member of SearchExchange.com
>Enabling HTTP logging for the Exchange virtual server
The log file format and the corresponding options are identical to the ones that I showed you earlier for logging the SMTP and NNTP protocols.
All protocol logs are created as text files with the .LOG extension and placed in the %SYSTEMROOT%\System32\LogFiles folder.
About the author: Brien M. Posey, MCSE, is a Microsoft Most Valuable Professional for his work with Exchange Server, and has previously received Microsoft's MVP award for Windows Server and Internet Information Server (IIS). Brien has served as CIO for a nationwide chain of hospitals and was once responsible for the Department of Information Management at Fort Knox. As a freelance technical writer, Brien has written for Microsoft, TechTarget, CNET, ZDNet, MSD2D, Relevant Technologies and other technology companies. You can visit Brien's personal Web site at http://www.brienposey.com.
Do you have comments on this tip? Let us know.
Related information from SearchExchange.com:
Tip: Free log reporting tool for HTTP and Exchange Server
Tip: How to automatically purge Exchange-related logs
Exchange Server diagnostics: An introduction to application and system logs
Exchange Server diagnostics: Digging into IIS logs
Reference Center: Exchange Server monitoring and logging tips
Please let others know how useful this tip was via the rating scale below. Do you have a useful Exchange Server or Microsoft Outlook tip, timesaver or workaround to share? Submit it to SearchExchange.com. If we publish it, we'll send you a nifty thank-you gift.
