Analyzing Exchange ActiveSync data from .CSV report files

Using the Exchange Management Shell (EMS) command, Export-ActiveSyncLog, you can extract valuable Exchange ActiveSync usage data from your Client Access server's Internet Information Services (IIS) logs. The ActiveSync data extraction process creates six different reports in a .CSV or comma-separated values file format. Learn how to view these reports, what type of data each report contains and how to analyze the data to monitor mobile device activity in an Exchange Server environment.

You can extract Exchange ActiveSync usage data from your Client Access server's Internet Information Services (IIS) logs using the Exchange Management Shell (EMS) command Export-ActiveSyncLog. The Exchange ActiveSync data extraction process creates six different report files. In this tip, learn how to view these reports and what type of information each report contains.


Individual Exchange ActiveSync report files are saved in .CSV or comma-separated values format. In essence, a .CSV file is a comma-delimited text file. Although .CSV files are difficult to read in text format, you can open them in Microsoft Excel, which lets you view the data in spreadsheet form.

More Exchange ActiveSync resources:
How to extract Exchange ActiveSync data from IIS logs

Use Exchange 2007 ActiveSync logs to track mobile device activity

Exchange ActiveSync tips and tutorials

The Exchange Server ActiveSync Web Administration Tool

How to solve common ActiveSync error messages

When using Microsoft Excel to open a report, the Export-ActiveSyncLog command writes a series of words to the .CSV file before it exports data. These words are meaningless when you view the file in text format, but if you open the .CSV file in Excel, the words serve as column headers. This is extremely helpful in interpreting the raw data.

NOTE: Most Microsoft Office applications support the use of .CSV files. For example, if you wanted to analyze Exchange ActiveSync usage trends over a long period of time, you could import the various report files into Microsoft Access.

The users report

The users report or Users.csv file lets you analyze Exchange ActiveSync activity on a user-by-user basis. For example, you can see what type of mobile device individuals use to access Exchange Server. You can also see the number of items each user sends and receives.

The user agents report

The user agents report or User-Agents.csv file generates ActiveSync usage data based on user agent information. The term user agent refers to the operating system and build number the mobile device uses. This report details which mobile device operating systems were in use, how many mobile devices using a particular user agent connected on a given day and how many hits each user agent generated.

Unfortunately, this report doesn't reveal the average number of hits each user agent generated. However, the report will tell you how many of each type of user agent was in use and the total number of hits a user agent type produced. When you divide the total number of hits by the number of user agents, you'll know the average number of hits for a given user agent. You can use this information to determine whether there is a specific type of mobile device that is consuming more wireless traffic than another type of device.

Keep in mind that a higher average number of hits doesn't necessarily mean that a particular user agent is less efficient. It can mean that some user agents were issued to power users or that some mobile devices are not configured effectively.

The servers report

The server's report or Servers.csv file essentially tells you which mailbox servers are used most frequently by mobile device clients.

The status codes report

Generally speaking, the status codes report or StatusCodes.csv file is the least useful report. It is filled with cryptic codes that may be meaningless to most Exchange administrators. I have not been able to track down any documentation on these codes, which I assume are there for Microsoft's own diagnostic purposes.

The policy compliance report

The policy compliance report or PolicyCompliance.csv file supplies the number of Exchange ActiveSync clients that are currently in compliance with established ActiveSync policies. Although this report doesn't provide detailed data, it can help target deficiencies. For example, the report won't tell you why a client is not compliant with the ActiveSync policy, but it will tell you how many clients are compliant, how many are not compliant, how many are partially compliant and the number of clients in an unknown state.

The hourly report

Microsoft designed the hourly report or Hourly.csv file to help you spot network usage trends. You can find out the number of unique mobile devices that synchronized with your Exchange server within a given hour. Because this report tracks activity throughout the day, it is easy to discover peak usage periods.

About the author: Brien M. Posey, MCSE, is a five-time recipient of Microsoft's Most Valuable Professional award for his work with Exchange Server, Windows Server, Internet Information Services (IIS) and File Systems and Storage. He has served as CIO for a nationwide chain of hospitals and was once responsible for the Department of Information Management at Fort Knox. As a freelance technical writer, Brien has written for Microsoft, TechTarget, CNET, ZDNet, MSD2D, Relevant Technologies and other technology companies. You can visit Brien's personal website at www.brienposey.com.

Do you have comments on this tip? Let us know.

Please let others know how useful this tip was via the rating scale below. Do you know a helpful Exchange Server, Microsoft Outlook or SharePoint tip, timesaver or workaround? Email the editors to talk about writing for SearchExchange.com.

This was first published in December 2008

Dig deeper on Mobile Devices

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchWindowsServer

SearchEnterpriseDesktop

SearchCloudComputing

SearchSQLServer

Close